File name:

LunarClient-Installer.exe

Full analysis: https://app.any.run/tasks/c31a0760-adb9-459c-b3ef-c05dac84c76e
Verdict: Malicious activity
Analysis date: September 05, 2024, 10:32:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

6BFA0D98C81F43E113C8B890B8012302

SHA1:

8125412E0505B09E4DA8E9D655F37E642253E84D

SHA256:

677AB9AAA9A8ACA1EA5A1BF672417C21F2A6287001526DE3D6985C0717FD2645

SSDEEP:

98304:JH/nd8HT07J/A9nGcRa1xXcVsy3RxeLLCIJgap176MVhbD2bLd129hhoA6qT6p91:Cb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • LunarClient-Installer.exe (PID: 5920)

    • Executable content was dropped or overwritten

      • LunarClient-Installer.exe (PID: 5920)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • LunarClient-Installer.exe (PID: 5920)

    • Reads security settings of Internet Explorer

      • OWInstaller.exe (PID: 6900)

    • Drops 7-zip archiver for unpacking

      • LunarClient-Installer.exe (PID: 5920)

    • Reads Microsoft Outlook installation path

      • OWInstaller.exe (PID: 6900)

    • Reads Internet Explorer settings

      • OWInstaller.exe (PID: 6900)

    • Checks Windows Trust Settings

      • OWInstaller.exe (PID: 6900)

  • INFO

    • Checks supported languages

      • LunarClient-Installer.exe (PID: 5920)
      • OWInstaller.exe (PID: 6900)
      • identity_helper.exe (PID: 7084)

    • Create files in a temporary directory

      • LunarClient-Installer.exe (PID: 5920)
      • OWInstaller.exe (PID: 6900)

    • Creates files or folders in the user directory

      • LunarClient-Installer.exe (PID: 5920)
      • OWInstaller.exe (PID: 6900)

    • Reads the machine GUID from the registry

      • OWInstaller.exe (PID: 6900)

    • Reads Environment values

      • OWInstaller.exe (PID: 6900)
      • identity_helper.exe (PID: 7084)

    • Checks proxy server information

      • OWInstaller.exe (PID: 6900)

    • Disables trace logs

      • OWInstaller.exe (PID: 6900)

    • Reads the computer name

      • OWInstaller.exe (PID: 6900)
      • identity_helper.exe (PID: 7084)

    • The process uses the downloaded file

      • OWInstaller.exe (PID: 6900)

    • Reads the software policy settings

      • OWInstaller.exe (PID: 6900)

    • Application launched itself

      • msedge.exe (PID: 3672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:57:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 186880
UninitializedDataSize: 2048
EntryPoint: 0x352d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.258.1.5
ProductVersionNumber: 2.258.1.5
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: Overwolf Ltd.
FileDescription: Lunar Client
FileVersion: 2.258.1.5
LegalCopyright: Copyright (C) 2021 Overwolf Ltd. All Rights Reserved.
LegalTrademarks: -
ProductName: Lunar Client
ProductVersion: 2.258.1.5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
164
Monitored processes
42
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start lunarclient-installer.exe owinstaller.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2640 --field-trial-handle=2268,i,1107108834811890774,3639772275612096193,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
376"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-appcompat-clear --mojo-platform-channel-handle=4992 --field-trial-handle=2268,i,1107108834811890774,3639772275612096193,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
936"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2264 --field-trial-handle=2268,i,1107108834811890774,3639772275612096193,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1156"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6656 --field-trial-handle=2268,i,1107108834811890774,3639772275612096193,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1688"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5328 --field-trial-handle=2268,i,1107108834811890774,3639772275612096193,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1764"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5884 --field-trial-handle=2268,i,1107108834811890774,3639772275612096193,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2040"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6788 --field-trial-handle=2268,i,1107108834811890774,3639772275612096193,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2112"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5808 --field-trial-handle=2268,i,1107108834811890774,3639772275612096193,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2232"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5776 --field-trial-handle=2268,i,1107108834811890774,3639772275612096193,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2608"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6808 --field-trial-handle=2268,i,1107108834811890774,3639772275612096193,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
9 497
Read events
9 462
Write events
35
Delete events
0

Modification events

(PID) Process:(6900) OWInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\OverwolfElectron
Operation:writeName:MUID
Value:
bb926e54-e3ca-40fd-ae90-2764341e7792
(PID) Process:(6900) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6900) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6900) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6900) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6900) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6900) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6900) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6900) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6900) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
24
Suspicious files
179
Text files
155
Unknown types
4

Dropped files

PID
Process
Filename
Type
5920LunarClient-Installer.exeC:\Users\admin\AppData\Local\Temp\nsxABBA.tmp\nsProcess.dllexecutable
MD5:10E47E822B85D2A12FA4727001612182
SHA256:D530589A90918334B8E08D7355630892DD62F41333D948A860735D5BECFCB391
5920LunarClient-Installer.exeC:\Users\admin\AppData\Local\Temp\nsxABBA.tmp\CommandLine.dllexecutable
MD5:29D9046304542E1CE30EBA022C49DFCC
SHA256:DD954BC5C2F8EAD7580EE492A242EA3F09DC07B601BFADD1AB5AC804FC54DA01
5920LunarClient-Installer.exeC:\Users\admin\AppData\Local\Temp\nsxABBA.tmp\Microsoft.Win32.TaskScheduler.dllexecutable
MD5:25802E743767FDC032480CE80725EF21
SHA256:495A72C7EA5F479B3BC4A9A2782E73A1CD3FC398C6598C0F3C0BB2E57C30B482
5920LunarClient-Installer.exeC:\Users\admin\AppData\Local\Temp\nsxABBA.tmp\utils.dllexecutable
MD5:C6B46A5FCDCCBF3AEFF930B1E5B383D4
SHA256:251AB3E2690562DCFCD510642607F206E6DCF626D06D94B74E1FA8297B1050A0
5920LunarClient-Installer.exeC:\Users\admin\AppData\Local\Temp\nsxABBA.tmp\websocket-sharp.dllexecutable
MD5:7D7B21A6C7BAD831559FE4E5E58CF44B
SHA256:B93AFFD08EDB54FE4E88BE626A95ECA78897FB874DC0AAB214782B5D27CFF7F5
5920LunarClient-Installer.exeC:\Users\admin\AppData\Local\Temp\nsxABBA.tmp\OverWolf.Client.CommonUtils.dllexecutable
MD5:F927B95203A3D1D253938EAD1F8143C6
SHA256:AC480A104D0EC21BB96EC6E5EA3418A3118EA80A07426DCD2E1E01FF41147F40
5920LunarClient-Installer.exeC:\Users\admin\AppData\Local\Temp\nsxABBA.tmp\nsis7z64.dllexecutable
MD5:284C46AF1FD2EC3A60EE0C28F276F2A4
SHA256:2368BE6D8B21E0047146D3F61F90966A71D0737EED0146BC692B59F3CAC97793
5920LunarClient-Installer.exeC:\Users\admin\AppData\Local\Temp\nsxABBA.tmp\log4net.dllexecutable
MD5:F15C8A9E2876568B3910189B2D493706
SHA256:AE9C8073C3357C490F5D1C64101362918357C568F6B9380A60B09A4A4C1FF309
5920LunarClient-Installer.exeC:\Users\admin\AppData\Local\Temp\nsxABBA.tmp\app\game_detection_database.jsonbinary
MD5:336D26D3E0AB31E8DC102EA86C48FA26
SHA256:F30B571B8BB396AA0BCA9AA9B80638416EC638DE5C4788BC281AC67D3D54CCAF
5920LunarClient-Installer.exeC:\Users\admin\AppData\Local\Temp\nsxABBA.tmp\app\cmp.htmlhtml
MD5:D7B8B31B190E552677589CFD4CBB5D8E
SHA256:6C21E8C07CE28327DCA05F873D73FE85D5473F9B22A751A4D3D28931F5D0C74F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
128
TCP/UDP connections
111
DNS requests
90
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7072
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
HEAD
200
108.138.26.98:443
https://content.overwolf.com/Installer/promo/jilehohlakeokncafogkgnicgndeecdiengddbcc/index.html
unknown
—
—
—
6900
OWInstaller.exe
GET
200
216.58.206.78:80
http://www.google-analytics.com/__utm.gif?utmwv=4.7.2&utmn=408962667&utmhn=&utmcs=UTF-8&utmsr=-&utmsc=-&utmul=-&utmje=0&utmfl=-&utmdt=&utmhid=702447288&utmr=/&utmp=/&utmac=UA-18298709-8&utmcc=__utma%3D0.2004815793.1725532369.1725532369.1725532369.2%3B%2B__utmz%3D0.1725532369.1.1.utmcsr%3D%28direct%29%7Cutmccn%3D%7Cutmcmd%3D%3B&utme=5%28Funnel2%2AInstaller%20Launched%2A%29%28%29&gaq=1&utmt=event
unknown
—
—
whitelisted
6900
OWInstaller.exe
GET
200
216.58.206.78:80
http://www.google-analytics.com/__utm.gif?utmwv=4.7.2&utmn=70853684&utmhn=&utmcs=UTF-8&utmsr=-&utmsc=-&utmul=-&utmje=0&utmfl=-&utmdt=&utmhid=798456790&utmr=/&utmp=/&utmac=UA-80584726-1&utmcc=__utma%3D0.2004815793.1725532369.1725532369.1725532369.2%3B%2B__utmz%3D0.1725532369.1.1.utmcsr%3D%28direct%29%7Cutmccn%3D%7Cutmcmd%3D%3B&utme=5%28Funnel2%2AInstaller%20Launched%2A%29%28%29&gaq=1&utmt=event
unknown
—
—
whitelisted
—
—
GET
—
108.138.26.27:443
https://content.overwolf.com/Installer/promo/jilehohlakeokncafogkgnicgndeecdiengddbcc/js/block_inputs.js
unknown
—
—
—
—
—
GET
200
18.244.18.51:443
https://analyticsnew.overwolf.com/analytics/Counter?CurrentVersion=&PartnerID=0&Name=Manual_Installer_Launched&Value=1&UserName=&GameSessionId=&Extra=%255b%257b%2522Name%2522%253a%2522OSBuild%2522%252c%2522Value%2522%253a%252210.0.19045.4046%2522%257d%252c%257b%2522Name%2522%253a%2522isElectron%2522%252c%2522Value%2522%253a%2522true%2522%257d%252c%257b%2522Name%2522%253a%2522appId%2522%252c%2522Value%2522%253a%2522jilehohlakeokncafogkgnicgndeecdiengddbcc%2522%257d%252c%257b%2522Name%2522%253a%2522existingUUID%2522%252c%2522Value%2522%253a%2522bb926e54-e3ca-40fd-ae90-2764341e7792%2522%257d%252c%257b%2522Name%2522%253a%2522appstoreUUID%2522%252c%2522Value%2522%253anull%257d%252c%257b%2522Name%2522%253a%2522uid%2522%252c%2522Value%2522%253a%2522jilehohlakeokncafogkgnicgndeecdiengddbcc%2522%257d%252c%257b%2522Name%2522%253a%2522clientInstalled%2522%252c%2522Value%2522%253a%2522False%2522%257d%255d&owver=2.258.0.8&MUID=bb926e54-e3ca-40fd-ae90-2764341e7792
unknown
binary
2 b
—
2120
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
108.138.26.25:443
https://content.overwolf.com/Installer/promo/jilehohlakeokncafogkgnicgndeecdiengddbcc/js/libs/jquery-1.10.2.min.js
unknown
text
90.9 Kb
—
—
—
GET
200
18.244.18.46:443
https://analyticsnew.overwolf.com/analytics/Counter?CurrentVersion=&PartnerID=0&Name=Manual_Funnel2_Installer_Launched&Value=1&UserName=&GameSessionId=&Extra=%255b%257b%2522Name%2522%253a%2522OSBuild%2522%252c%2522Value%2522%253a%252210.0.19045.4046%2522%257d%252c%257b%2522Name%2522%253a%2522isElectron%2522%252c%2522Value%2522%253a%2522true%2522%257d%252c%257b%2522Name%2522%253a%2522appId%2522%252c%2522Value%2522%253a%2522jilehohlakeokncafogkgnicgndeecdiengddbcc%2522%257d%255d&owver=2.258.0.8&MUID=bb926e54-e3ca-40fd-ae90-2764341e7792
unknown
binary
2 b
—
—
—
GET
200
108.138.26.77:443
https://content.overwolf.com/Installer/promo/jilehohlakeokncafogkgnicgndeecdiengddbcc/js/block_inputs.js
unknown
text
281 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7072
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
736
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6900
OWInstaller.exe
216.58.206.78:80
www.google-analytics.com
GOOGLE
US
whitelisted
7072
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6900
OWInstaller.exe
18.244.18.51:443
analyticsnew.overwolf.com
—
US
whitelisted
2120
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6900
OWInstaller.exe
18.245.86.39:443
content.overwolf.com
—
US
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.google-analytics.com
  • 216.58.206.78
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
analyticsnew.overwolf.com
  • 18.244.18.51
  • 18.244.18.56
  • 18.244.18.106
  • 18.244.18.46
whitelisted
content.overwolf.com
  • 18.245.86.39
  • 18.245.86.117
  • 18.245.86.110
  • 18.245.86.78
whitelisted
storeapi.overwolf.com
  • 18.172.112.72
  • 18.172.112.62
  • 18.172.112.84
  • 18.172.112.117
shared
fonts.googleapis.com
  • 142.250.186.74
whitelisted
fonts.gstatic.com
  • 142.250.186.35
whitelisted
www.overwolf.com
  • 108.138.26.98
  • 108.138.26.27
  • 108.138.26.77
  • 108.138.26.25
whitelisted

Threats

PID
Process
Class
Message
236
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] An application monitoring request to sentry .io
236
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] An application monitoring request to sentry .io
236
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
236
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LunarClient-Installer.exe