File name:

ArmouryCrateInstaller.exe

Full analysis: https://app.any.run/tasks/4ca484a7-4fe9-4ab6-a98f-79b7f8e1470b
Verdict: Malicious activity
Analysis date: February 23, 2025, 19:40:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:

350ADD77EC579BBBDE55F5CD84E5104F

SHA1:

7497FD58BF6F80EFDB8D569C1771FFE9BEC21977

SHA256:

4D05106479102D0AC3B774FB5287DEE09A785CB27F9C64884D46631E2F52337F

SSDEEP:

98304:wWBAn6mYHT6Gl2Bn8uSM1ytXp17JKR7jLVW0Whm9T5DfUqbBiKhOFYMLlt1DM8nJ:w36

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsZip.exe (PID: 6088)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6436)
      • cmd.exe (PID: 6964)
      • cmd.exe (PID: 7080)
      • cmd.exe (PID: 6356)

    • Starts CMD.EXE for commands execution

      • ArmouryCrateInstaller.exe (PID: 6236)
      • QueryUWP.exe (PID: 4164)

    • Reads security settings of Internet Explorer

      • ArmouryCrateInstaller.exe (PID: 6236)
      • Armoury Crate Installer.exe (PID: 6928)
      • Armoury Crate Installer.exe (PID: 6416)
      • AsusROGLSLService.exe (PID: 6256)
      • Armoury Crate Installer.exe (PID: 524)

    • Executes as Windows Service

      • AsusROGLSLService.exe (PID: 6256)

    • The process drops C-runtime libraries

      • AsusROGLSLService.exe (PID: 6256)
      • AsZip.exe (PID: 6088)

    • Process drops legitimate windows executable

      • AsusROGLSLService.exe (PID: 6256)
      • AsZip.exe (PID: 6088)

    • Reads the date of Windows installation

      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsusROGLSLService.exe (PID: 6256)

  • INFO

    • The sample compiled with chinese language support

      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsusROGLSLService.exe (PID: 6256)
      • AsZip.exe (PID: 6088)

    • Creates files in the program directory

      • AsusROGLSLService.exe (PID: 6368)
      • ArmouryCrateInstaller.exe (PID: 6236)
      • Armoury Crate Installer.exe (PID: 6416)
      • QueryUWP.exe (PID: 4164)
      • Armoury Crate Installer.exe (PID: 6928)
      • AsusROGLSLService.exe (PID: 6256)
      • AsZip.exe (PID: 6344)
      • CheckTool.exe (PID: 7024)
      • AsZip.exe (PID: 6088)
      • ROGLSLoader.exe (PID: 1328)
      • Armoury Crate Installer.exe (PID: 524)
      • onePackageLoader.exe (PID: 2324)

    • Process checks computer location settings

      • ArmouryCrateInstaller.exe (PID: 6236)

    • Checks supported languages

      • AsusROGLSLService.exe (PID: 3732)
      • AsusROGLSLService.exe (PID: 6368)
      • ArmouryCrateInstaller.exe (PID: 6236)
      • Armoury Crate Installer.exe (PID: 6416)
      • QueryUWP.exe (PID: 4164)
      • AsusROGLSLService.exe (PID: 6256)
      • Armoury Crate Installer.exe (PID: 6928)
      • CheckTool.exe (PID: 7024)
      • ROGLSLoader.exe (PID: 1328)
      • Armoury Crate Installer.exe (PID: 524)
      • onePackageLoader.exe (PID: 2324)
      • AsZip.exe (PID: 6344)
      • AsZip.exe (PID: 6088)

    • Reads the computer name

      • AsusROGLSLService.exe (PID: 6256)
      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsusROGLSLService.exe (PID: 6368)
      • AsusROGLSLService.exe (PID: 3732)
      • Armoury Crate Installer.exe (PID: 6416)
      • Armoury Crate Installer.exe (PID: 6928)
      • CheckTool.exe (PID: 7024)
      • Armoury Crate Installer.exe (PID: 524)
      • ROGLSLoader.exe (PID: 1328)
      • onePackageLoader.exe (PID: 2324)

    • The sample compiled with english language support

      • ArmouryCrateInstaller.exe (PID: 6236)
      • AsusROGLSLService.exe (PID: 6256)
      • AsZip.exe (PID: 6088)

    • Reads the machine GUID from the registry

      • Armoury Crate Installer.exe (PID: 6928)
      • CheckTool.exe (PID: 7024)
      • Armoury Crate Installer.exe (PID: 6416)
      • AsusROGLSLService.exe (PID: 6256)
      • Armoury Crate Installer.exe (PID: 524)
      • onePackageLoader.exe (PID: 2324)

    • Reads Environment values

      • CheckTool.exe (PID: 7024)
      • ROGLSLoader.exe (PID: 1328)
      • onePackageLoader.exe (PID: 2324)

    • Disables trace logs

      • CheckTool.exe (PID: 7024)

    • Reads the software policy settings

      • CheckTool.exe (PID: 7024)
      • AsusROGLSLService.exe (PID: 6256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (83)
.exe | Win32 Executable (generic) (9)
.exe | Generic Win/DOS Executable (3.9)
.exe | DOS Executable Generic (3.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:01:17 13:47:38+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.16
CodeSize: 398848
InitializedDataSize: 3752960
UninitializedDataSize: -
EntryPoint: 0x37c24
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 3.2.11.2
ProductVersionNumber: 3.2.11.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral 2
CharacterSet: Unicode
CompanyName: ASUS
FileDescription: The installer for Armoury Crate and Aura Creator.
FileVersion: 3.2.11.2
LegalCopyright: Copyright (C) 2019
OriginalFileName: ArmouryCrateInstaller.exe
ProductVersion: 3.2.11.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
30
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start armourycrateinstaller.exe conhost.exe no specs asusroglslservice.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs asusroglslservice.exe no specs conhost.exe no specs asusroglslservice.exe armoury crate installer.exe no specs queryuwp.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs armoury crate installer.exe no specs checktool.exe conhost.exe no specs aszip.exe no specs conhost.exe no specs aszip.exe conhost.exe no specs roglsloader.exe conhost.exe no specs armoury crate installer.exe no specs onepackageloader.exe no specs armourycrateinstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
524"C:\Program Files (x86)\ASUS\ROGLSLoader\Armoury Crate Installer.exe" -asusdownloadbar -bar_report 0 -interruptSatus interrupt_0 -barstyle armourycrate -barProduct "Armoury Crate" -progressbarstatus 2C:\Program Files (x86)\ASUS\ROGLSLoader\Armoury Crate Installer.exe—ROGLSLoader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Armoury Crate Installer
Version:
2.3.11.2
Modules
Images
c:\program files (x86)\asus\roglsloader\armoury crate installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1328"C:\Program Files (x86)\ASUS\ROGLSLoader\ROGLSLoader.exe"C:\Program Files (x86)\ASUS\ROGLSLoader\ROGLSLoader.exe
AsusROGLSLService.exe
User:
SYSTEM
Company:
ASUSTek Computer Inc.
Integrity Level:
SYSTEM
Version:
2.3.11.2
Modules
Images
c:\program files (x86)\asus\roglsloader\roglsloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AsZip.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2324"C:\Program Files (x86)\ASUS\ROGLSLoader\onePackageLoader.exe" -install -product ArmouryCrateC:\Program Files (x86)\ASUS\ROGLSLoader\onePackageLoader.exe—ROGLSLoader.exe
User:
admin
Company:
ASUSTek Computer Inc.
Integrity Level:
MEDIUM
Description:
onePackageLoader
Version:
1.0.7.0
Modules
Images
c:\program files (x86)\asus\roglsloader\onepackageloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3732"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe" -installC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe—ArmouryCrateInstaller.exe
User:
admin
Company:
ASUS
Integrity Level:
HIGH
Exit code:
0
Version:
2.3.11.0
Modules
Images
c:\program files (x86)\asus\asusroglslservice\asusroglslservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3836"C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe" C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe—explorer.exe
User:
admin
Company:
ASUS
Integrity Level:
MEDIUM
Description:
The installer for Armoury Crate and Aura Creator.
Exit code:
3221226540
Version:
3.2.11.2
Modules
Images
c:\users\admin\appdata\local\temp\armourycrateinstaller.exe
c:\windows\system32\ntdll.dll
4164"C:\Program Files (x86)\ASUS\AsusROGLSLService\QueryUWP.exe"C:\Program Files (x86)\ASUS\AsusROGLSLService\QueryUWP.exe—AsusROGLSLService.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Version:
1.0.0.3
Modules
Images
c:\program files (x86)\asus\asusroglslservice\queryuwp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ROGLSLoader.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5892\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AsusROGLSLService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6088"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.exe" "C:\Program Files (x86)\ASUS\ROGLSLoader.zip"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.exe
AsusROGLSLService.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Version:
1.0.0.2
Modules
Images
c:\program files (x86)\asus\asusroglslservice\aszip.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\vcruntime140.dll
Total events
25 072
Read events
25 047
Write events
23
Delete events
2

Modification events

(PID) Process:(6236) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:ACInstallPath
Value:
C:\Users\admin\AppData\Local\Temp
(PID) Process:(6236) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:InstallFinish
Value:
0
(PID) Process:(6236) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:delete valueName:aaiu
Value:
(PID) Process:(6236) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:delete valueName:InstallerSilentMode
Value:
(PID) Process:(3732) AsusROGLSLService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:aaiu
Value:
0
(PID) Process:(6416) Armoury Crate Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
Operation:writeName:Left
Value:
0
(PID) Process:(6416) Armoury Crate Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
Operation:writeName:Top
Value:
0
(PID) Process:(6256) AsusROGLSLService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:InstallApp
Value:
0
(PID) Process:(6256) AsusROGLSLService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:InstallApp2
Value:
1
(PID) Process:(7024) CheckTool.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CheckTool_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
24
Suspicious files
12
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
6236ArmouryCrateInstaller.exeC:\ProgramData\ASUS\ALL\ACLoader\ACSE.initext
MD5:D79AAB1FE0A7F19EF95F2FD496C1E856
SHA256:A6582FDCBF0787373491FECB74B4B7368DD796F3533F9A3A1FA181900B0699C9
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\CheckTool.exeexecutable
MD5:12AB05AE37EF47DA353EFF14D5A81382
SHA256:87D2FF260502B5C954C1BB4B867264BD5343451260151070A8B56225A8B4986E
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exeexecutable
MD5:F0CDCAF5152EFDE0DB8B6D962F9D7C6B
SHA256:F2E5C2982BBFAFB9B97DEB17A3D1499768E6A26AA3BAB4CF512ABF033F694AE2
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.dllexecutable
MD5:964068210EDCB3631F02E45856EB291E
SHA256:4CF079D4D7A154CD93F65934B5D115F07AF8F25EE24930E6CC606DFB0AEA2A4E
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exeexecutable
MD5:12D2B87765FA26B2FCE79C806F4EB2EA
SHA256:43A0C9E2B294656EFF305EC8A247D647BC3B85542F2FE1EC424D7FDC822A5F07
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\Newtonsoft.Json.dllexecutable
MD5:081D9558BBB7ADCE142DA153B2D5577A
SHA256:B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\ProductInfoLib.dllexecutable
MD5:48CEB044F0876024635C22BB5A5B4DBA
SHA256:E0404A40233C8B4DD7731B361C6E7BD6BC22496825ABD733C26643B50BF2243F
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusGCGridServiceSetup.exeexecutable
MD5:242C0332DB5EBA361CC3628DFAB5CE56
SHA256:BCC843B036C22AD4A1485E62C2ED5CA88F33688FA919C73276B93D4CDBE83347
6236ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.exeexecutable
MD5:9131A40E5770D1170C3093FB0D2F6F63
SHA256:FCF8D154E6B37985434F991B048CEF457DE123DD5A553EF3C6B28A67FB8A3987
6480powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jd432k5x.qu1.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
38
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
2040
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
2040
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
DE
binary
312 b
whitelisted
5256
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
QA
binary
419 b
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
6504
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
DE
binary
471 b
whitelisted
5256
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
QA
binary
408 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
776
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2040
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2040
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.144
  • 104.126.37.129
  • 104.126.37.139
  • 104.126.37.185
  • 104.126.37.186
  • 104.126.37.131
  • 104.126.37.123
  • 104.126.37.154
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.68
  • 20.190.160.4
  • 20.190.160.128
  • 40.126.32.133
  • 20.190.160.67
  • 40.126.32.140
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
Process
Message
AsusROGLSLService.exe
Failed to get baseboard manufacturer via WMI, get via registry.
ROGLSLoader.exe
Failed to get baseboard manufacturer via WMI, get via registry.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ArmouryCrateInstaller.exe