File name:

ArmouryCrateInstaller.exe

Full analysis: https://app.any.run/tasks/4ca484a7-4fe9-4ab6-a98f-79b7f8e1470b
Verdict: Malicious activity
Analysis date: February 23, 2025, 19:40:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:

350ADD77EC579BBBDE55F5CD84E5104F

SHA1:

7497FD58BF6F80EFDB8D569C1771FFE9BEC21977

SHA256:

4D05106479102D0AC3B774FB5287DEE09A785CB27F9C64884D46631E2F52337F

SSDEEP:

98304:wWBAn6mYHT6Gl2Bn8uSM1ytXp17JKR7jLVW0Whm9T5DfUqbBiKhOFYMLlt1DM8nJ:w36

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsZip.exe (PID: 6088)

    • Starts CMD.EXE for commands execution

      • ArmouryCrateInstaller.exe (PID: 6236)
      • QueryUWP.exe (PID: 4164)

    • Reads the date of Windows installation

      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsusROGLSLService.exe (PID: 6256)

    • Reads security settings of Internet Explorer

      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsusROGLSLService.exe (PID: 6256)
      • Armoury Crate Installer.exe (PID: 6416)
      • Armoury Crate Installer.exe (PID: 6928)
      • Armoury Crate Installer.exe (PID: 524)

    • Executes as Windows Service

      • AsusROGLSLService.exe (PID: 6256)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6964)
      • cmd.exe (PID: 7080)
      • cmd.exe (PID: 6356)
      • cmd.exe (PID: 6436)

    • The process drops C-runtime libraries

      • AsusROGLSLService.exe (PID: 6256)
      • AsZip.exe (PID: 6088)

    • Process drops legitimate windows executable

      • AsZip.exe (PID: 6088)
      • AsusROGLSLService.exe (PID: 6256)

  • INFO

    • The sample compiled with english language support

      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsusROGLSLService.exe (PID: 6256)
      • AsZip.exe (PID: 6088)

    • The sample compiled with chinese language support

      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsusROGLSLService.exe (PID: 6256)
      • AsZip.exe (PID: 6088)

    • Checks supported languages

      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsusROGLSLService.exe (PID: 3732)
      • Armoury Crate Installer.exe (PID: 6416)
      • AsusROGLSLService.exe (PID: 6256)
      • Armoury Crate Installer.exe (PID: 6928)
      • CheckTool.exe (PID: 7024)
      • QueryUWP.exe (PID: 4164)
      • AsZip.exe (PID: 6344)
      • AsZip.exe (PID: 6088)
      • onePackageLoader.exe (PID: 2324)
      • ROGLSLoader.exe (PID: 1328)
      • Armoury Crate Installer.exe (PID: 524)
      • AsusROGLSLService.exe (PID: 6368)

    • Reads the computer name

      • AsusROGLSLService.exe (PID: 3732)
      • AsusROGLSLService.exe (PID: 6256)
      • Armoury Crate Installer.exe (PID: 6416)
      • Armoury Crate Installer.exe (PID: 6928)
      • CheckTool.exe (PID: 7024)
      • ROGLSLoader.exe (PID: 1328)
      • Armoury Crate Installer.exe (PID: 524)
      • onePackageLoader.exe (PID: 2324)
      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsusROGLSLService.exe (PID: 6368)

    • Reads the machine GUID from the registry

      • Armoury Crate Installer.exe (PID: 6416)
      • Armoury Crate Installer.exe (PID: 6928)
      • CheckTool.exe (PID: 7024)
      • AsusROGLSLService.exe (PID: 6256)
      • Armoury Crate Installer.exe (PID: 524)
      • onePackageLoader.exe (PID: 2324)

    • Process checks computer location settings

      • ArmouryCrateInstaller.exe (PID: 6236)

    • Creates files in the program directory

      • Armoury Crate Installer.exe (PID: 6416)
      • QueryUWP.exe (PID: 4164)
      • CheckTool.exe (PID: 7024)
      • AsusROGLSLService.exe (PID: 6256)
      • AsZip.exe (PID: 6344)
      • Armoury Crate Installer.exe (PID: 6928)
      • AsZip.exe (PID: 6088)
      • Armoury Crate Installer.exe (PID: 524)
      • ROGLSLoader.exe (PID: 1328)
      • onePackageLoader.exe (PID: 2324)
      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsusROGLSLService.exe (PID: 6368)

    • Reads Environment values

      • CheckTool.exe (PID: 7024)
      • onePackageLoader.exe (PID: 2324)
      • ROGLSLoader.exe (PID: 1328)

    • Reads the software policy settings

      • CheckTool.exe (PID: 7024)
      • AsusROGLSLService.exe (PID: 6256)

    • Disables trace logs

      • CheckTool.exe (PID: 7024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (83)
.exe | Win32 Executable (generic) (9)
.exe | Generic Win/DOS Executable (3.9)
.exe | DOS Executable Generic (3.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:01:17 13:47:38+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.16
CodeSize: 398848
InitializedDataSize: 3752960
UninitializedDataSize: -
EntryPoint: 0x37c24
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 3.2.11.2
ProductVersionNumber: 3.2.11.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral 2
CharacterSet: Unicode
CompanyName: ASUS
FileDescription: The installer for Armoury Crate and Aura Creator.
FileVersion: 3.2.11.2
LegalCopyright: Copyright (C) 2019
OriginalFileName: ArmouryCrateInstaller.exe
ProductVersion: 3.2.11.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
30
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start armourycrateinstaller.exe conhost.exe no specs asusroglslservice.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs asusroglslservice.exe no specs conhost.exe no specs asusroglslservice.exe armoury crate installer.exe no specs queryuwp.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs armoury crate installer.exe no specs checktool.exe conhost.exe no specs aszip.exe no specs conhost.exe no specs aszip.exe conhost.exe no specs roglsloader.exe conhost.exe no specs armoury crate installer.exe no specs onepackageloader.exe no specs armourycrateinstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
524"C:\Program Files (x86)\ASUS\ROGLSLoader\Armoury Crate Installer.exe" -asusdownloadbar -bar_report 0 -interruptSatus interrupt_0 -barstyle armourycrate -barProduct "Armoury Crate" -progressbarstatus 2C:\Program Files (x86)\ASUS\ROGLSLoader\Armoury Crate Installer.exe—ROGLSLoader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Armoury Crate Installer
Version:
2.3.11.2
Modules
Images
c:\program files (x86)\asus\roglsloader\armoury crate installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1328"C:\Program Files (x86)\ASUS\ROGLSLoader\ROGLSLoader.exe"C:\Program Files (x86)\ASUS\ROGLSLoader\ROGLSLoader.exe
AsusROGLSLService.exe
User:
SYSTEM
Company:
ASUSTek Computer Inc.
Integrity Level:
SYSTEM
Version:
2.3.11.2
Modules
Images
c:\program files (x86)\asus\roglsloader\roglsloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AsZip.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2324"C:\Program Files (x86)\ASUS\ROGLSLoader\onePackageLoader.exe" -install -product ArmouryCrateC:\Program Files (x86)\ASUS\ROGLSLoader\onePackageLoader.exe—ROGLSLoader.exe
User:
admin
Company:
ASUSTek Computer Inc.
Integrity Level:
MEDIUM
Description:
onePackageLoader
Version:
1.0.7.0
Modules
Images
c:\program files (x86)\asus\roglsloader\onepackageloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3732"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe" -installC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe—ArmouryCrateInstaller.exe
User:
admin
Company:
ASUS
Integrity Level:
HIGH
Exit code:
0
Version:
2.3.11.0
Modules
Images
c:\program files (x86)\asus\asusroglslservice\asusroglslservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3836"C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe" C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe—explorer.exe
User:
admin
Company:
ASUS
Integrity Level:
MEDIUM
Description:
The installer for Armoury Crate and Aura Creator.
Exit code:
3221226540
Version:
3.2.11.2
Modules
Images
c:\users\admin\appdata\local\temp\armourycrateinstaller.exe
c:\windows\system32\ntdll.dll
4164"C:\Program Files (x86)\ASUS\AsusROGLSLService\QueryUWP.exe"C:\Program Files (x86)\ASUS\AsusROGLSLService\QueryUWP.exe—AsusROGLSLService.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Version:
1.0.0.3
Modules
Images
c:\program files (x86)\asus\asusroglslservice\queryuwp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ROGLSLoader.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5892\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AsusROGLSLService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6088"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.exe" "C:\Program Files (x86)\ASUS\ROGLSLoader.zip"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.exe
AsusROGLSLService.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Version:
1.0.0.2
Modules
Images
c:\program files (x86)\asus\asusroglslservice\aszip.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\vcruntime140.dll
Total events
25 072
Read events
25 047
Write events
23
Delete events
2

Modification events

(PID) Process:(6236) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:ACInstallPath
Value:
C:\Users\admin\AppData\Local\Temp
(PID) Process:(6236) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:InstallFinish
Value:
0
(PID) Process:(6236) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:delete valueName:aaiu
Value:
(PID) Process:(6236) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:delete valueName:InstallerSilentMode
Value:
(PID) Process:(3732) AsusROGLSLService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:aaiu
Value:
0
(PID) Process:(6416) Armoury Crate Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
Operation:writeName:Left
Value:
0
(PID) Process:(6416) Armoury Crate Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
Operation:writeName:Top
Value:
0
(PID) Process:(6256) AsusROGLSLService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:InstallApp
Value:
0
(PID) Process:(6256) AsusROGLSLService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:InstallApp2
Value:
1
(PID) Process:(7024) CheckTool.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheckTool_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
24
Suspicious files
12
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\QueryUWP.exeexecutable
MD5:040D1F9B8554F4452473F655C0898A12
SHA256:E96FC05448DEE664BD0CC011E983E98ECF7AB2904AAB25BE401B1EE994141EF9
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\Newtonsoft.Json.dllexecutable
MD5:081D9558BBB7ADCE142DA153B2D5577A
SHA256:B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exeexecutable
MD5:F0CDCAF5152EFDE0DB8B6D962F9D7C6B
SHA256:F2E5C2982BBFAFB9B97DEB17A3D1499768E6A26AA3BAB4CF512ABF033F694AE2
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.dllexecutable
MD5:964068210EDCB3631F02E45856EB291E
SHA256:4CF079D4D7A154CD93F65934B5D115F07AF8F25EE24930E6CC606DFB0AEA2A4E
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.exeexecutable
MD5:9131A40E5770D1170C3093FB0D2F6F63
SHA256:FCF8D154E6B37985434F991B048CEF457DE123DD5A553EF3C6B28A67FB8A3987
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusGCGridServiceSetup.exeexecutable
MD5:242C0332DB5EBA361CC3628DFAB5CE56
SHA256:BCC843B036C22AD4A1485E62C2ED5CA88F33688FA919C73276B93D4CDBE83347
6368AsusROGLSLService.exeC:\ProgramData\ASUS\ALL\ACLoader\ArmouryCrateInstaller.logtext
MD5:17A3F9F99C41F1EAFE9F2FD0D8CFC7C9
SHA256:470E441662AC0C1292D62A2D441DC964CD34B910CBA5B6CFD1949339F43B155D
6416Armoury Crate Installer.exeC:\ProgramData\ASUS\ALL\ACLoader\ROGLSLoaderUI_App_20250223194028.logtext
MD5:0D1AC44ECA673C966D393E7EBC717CFF
SHA256:5B609F2173F588784A75E9F27B0BC750D40369BB04D01278A6038AA4A91DC150
6368AsusROGLSLService.exeC:\ProgramData\ASUS\ALL\ACLoader\AsusROGLSLService.logtext
MD5:DC7A87483870EB6EFB7DBE6CE61C9BBF
SHA256:C918FE217F8B637E9E6F25F1FB20B45141E977F513F30D7032A8B6F12EF7D94A
6480powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jd432k5x.qu1.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
38
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2040
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2040
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5256
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5256
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6504
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
776
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2040
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2040
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.144
  • 104.126.37.129
  • 104.126.37.139
  • 104.126.37.185
  • 104.126.37.186
  • 104.126.37.131
  • 104.126.37.123
  • 104.126.37.154
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.68
  • 20.190.160.4
  • 20.190.160.128
  • 40.126.32.133
  • 20.190.160.67
  • 40.126.32.140
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
Process
Message
AsusROGLSLService.exe
Failed to get baseboard manufacturer via WMI, get via registry.
ROGLSLoader.exe
Failed to get baseboard manufacturer via WMI, get via registry.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ArmouryCrateInstaller.exe