File name:

wt_dev_launcher.exe

Full analysis: https://app.any.run/tasks/c9f5f19f-32f0-4c43-84fc-06d4b3a4ac16
Verdict: Malicious activity
Analysis date: November 01, 2024, 19:27:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

EA300E3B06097B0B213C5EB9E242FE77

SHA1:

85DA55512C4500DD7A5E61AD95D2FFA271215390

SHA256:

807A3C2D2C8CA0C1F09C4911563D5FE1A1F5705FCD88FF316BC3D1852EF33ADC

SSDEEP:

98304:EgOeSD4luI1booVhUvr40ndaUC2IYdAJdWbs1+uE3EHzp1rNBsdvIQuMHRSdm2IT:9DFhrHPVfhl8vP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • wt_dev_launcher.exe (PID: 6024)
      • wt_dev_launcher.tmp (PID: 6436)

    • Process drops legitimate windows executable

      • wt_dev_launcher.tmp (PID: 6436)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • wt_dev_launcher.tmp (PID: 6436)

  • INFO

    • Checks supported languages

      • wt_dev_launcher.exe (PID: 6024)
      • wt_dev_launcher.tmp (PID: 6436)

    • Manual execution by a user

      • msedge.exe (PID: 4164)
      • notepad.exe (PID: 6584)
      • rundll32.exe (PID: 7848)
      • rundll32.exe (PID: 8108)
      • rundll32.exe (PID: 2780)
      • rundll32.exe (PID: 7308)
      • rundll32.exe (PID: 7288)
      • rundll32.exe (PID: 8008)
      • rundll32.exe (PID: 7336)
      • rundll32.exe (PID: 7352)
      • rundll32.exe (PID: 7184)
      • rundll32.exe (PID: 7840)
      • rundll32.exe (PID: 5604)
      • rundll32.exe (PID: 7644)
      • rundll32.exe (PID: 7196)
      • rundll32.exe (PID: 7500)
      • rundll32.exe (PID: 7376)
      • rundll32.exe (PID: 7740)

    • Create files in a temporary directory

      • wt_dev_launcher.exe (PID: 6024)

    • Reads the computer name

      • wt_dev_launcher.tmp (PID: 6436)

    • Application launched itself

      • msedge.exe (PID: 4164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (57.2)
.exe | Win32 Executable (generic) (18.2)
.exe | Win16/32 Executable Delphi generic (8.3)
.exe | Generic Win/DOS Executable (8)
.exe | DOS Executable Generic (8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:06 14:39:04+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 197632
UninitializedDataSize: -
EntryPoint: 0x117dc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Gaijin Entertainment
FileDescription: War Thunder Launcher Dev version Setup
FileVersion:
LegalCopyright: Copyright © 2011-2018 Gaijin Entertainment
ProductName: War Thunder Launcher Dev version
ProductVersion:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
222
Monitored processes
96
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wt_dev_launcher.exe wt_dev_launcher.tmp netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs msedge.exe netsh.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs netsh.exe no specs conhost.exe no specs notepad.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs rundll32.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs netsh.exe no specs conhost.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs netsh.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5160 --field-trial-handle=2032,i,16305934933184372714,6323156160512341848,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864"C:\WINDOWS\system32\netsh" firewall add portopening protocol = TCP port = 7852 name = "War Thunder"C:\Windows\SysWOW64\netsh.exe—wt_dev_launcher.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
948"C:\WINDOWS\system32\netsh.exe" firewall add allowedprogram "C:\Users\admin\AppData\Local\WarThunderDev\bpreport.exe" "War Thunder Crash Reporter" ENABLE ALLC:\Windows\SysWOW64\netsh.exe—wt_dev_launcher.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1084"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2648 --field-trial-handle=2032,i,16305934933184372714,6323156160512341848,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1160"C:\WINDOWS\system32\netsh" firewall add portopening protocol = TCP port = 7853 name = "War Thunder"C:\Windows\SysWOW64\netsh.exe—wt_dev_launcher.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2380"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5780 --field-trial-handle=2032,i,16305934933184372714,6323156160512341848,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2444"C:\WINDOWS\system32\netsh.exe" firewall add allowedprogram "C:\Users\admin\AppData\Local\WarThunderDev\win64\AFR-FriendlyD3D.exe" "War Thunder Game Client for CrossFire\SLI" ENABLE ALLC:\Windows\SysWOW64\netsh.exe—wt_dev_launcher.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2444\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2684"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6272 --field-trial-handle=2032,i,16305934933184372714,6323156160512341848,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2780"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Desktop\slider_bg.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
35 680
Read events
35 614
Write events
66
Delete events
0

Modification events

(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:StartupWithWindows
Value:
Yes
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:InstallDir
Value:
C:\Users\admin\AppData\Local\WarThunderDev
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:InstallPath
Value:
C:\Users\admin\AppData\Local\WarThunderDev
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:Dir
Value:
C:\Users\admin\AppData\Local\WarThunderDev
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:Path
Value:
C:\Users\admin\AppData\Local\WarThunderDev\launcher.exe
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:language
Value:
English
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.9 (u)
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Local\WarThunderDev
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\WarThunderDev\
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
WarThunderDev
Executable files
16
Suspicious files
105
Text files
48
Unknown types
0

Dropped files

PID
Process
Filename
Type
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\Temp\is-94VCG.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\is-SKNL8.tmpexecutable
MD5:05D92ACFD2C736B99DA01B12D9D55B14
SHA256:9119858DCA8C5A86333B0C91CC9CB06B3675D8DCE17B9EB7158D1FDBF577BA3A
6024wt_dev_launcher.exeC:\Users\admin\AppData\Local\Temp\is-VHKDG.tmp\wt_dev_launcher.tmpexecutable
MD5:05D92ACFD2C736B99DA01B12D9D55B14
SHA256:9119858DCA8C5A86333B0C91CC9CB06B3675D8DCE17B9EB7158D1FDBF577BA3A
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\unins000.exeexecutable
MD5:05D92ACFD2C736B99DA01B12D9D55B14
SHA256:9119858DCA8C5A86333B0C91CC9CB06B3675D8DCE17B9EB7158D1FDBF577BA3A
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\is-7QHKH.tmptext
MD5:1E32496378E8FEE43CB01B0689963A67
SHA256:5B47AEE36F594B7737E00990C9922A87252729B74CC2F1A83C0FCEED9816BDB9
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\ca-bundle.crttext
MD5:1E32496378E8FEE43CB01B0689963A67
SHA256:5B47AEE36F594B7737E00990C9922A87252729B74CC2F1A83C0FCEED9816BDB9
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\launcherr.datcompressed
MD5:6E41D717BC13F42081D6A49004ABE815
SHA256:9DF8F77923EEFD6FC68CDA43DFED4EABD4FEF4A588FDCBF2917F90CC1B93DFDE
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\htmlayout.dllexecutable
MD5:A6DFEEBC1E610036CAD09744E1AE836B
SHA256:20E51AA8480BDAA3EEFE33874F83542F316FCA1A275AE44B1739B0EDB91E8212
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\is-8BP39.tmpimage
MD5:945B144169D97344B11E182F773DBB67
SHA256:FAC97A96962BE6B9347FE414AACD99B02A0DE63D79BA6E49D8690506A3C96EE4
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\is-PUD8D.tmpexecutable
MD5:A6DFEEBC1E610036CAD09744E1AE836B
SHA256:20E51AA8480BDAA3EEFE33874F83542F316FCA1A275AE44B1739B0EDB91E8212
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
47
DNS requests
40
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
2.21.20.133:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.21.20.133:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1280
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1280
RUXIMICS.exe
GET
200
2.21.20.133:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
13.107.21.239:443
https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist
unknown
—
—
unknown
—
—
GET
401
13.107.6.158:443
https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox
unknown
—
—
unknown
—
—
GET
200
204.79.197.239:443
https://edge.microsoft.com/extensionwebstorebase/v1/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=122.0.2365.59&lang=en-US&acceptformat=crx3,puff&x=id%3Djmjflgjpcpepeafmmgdpfkogkghcpiha%26v%3D1.2.1%26installedby%3Dother%26uc%26ping%3Dr%253D106%2526e%253D1
unknown
xml
413 b
whitelisted
—
—
GET
200
13.107.21.239:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=122.0.2365.59&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
unknown
binary
1.72 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1280
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
2.21.20.133:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1280
RUXIMICS.exe
2.21.20.133:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
2.21.20.133:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5488
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 2.21.20.133
  • 2.21.20.137
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
launcher-bq.gaijin.net
  • 188.42.61.240
whitelisted
www.bing.com
  • 104.126.37.160
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.155
  • 104.126.37.170
  • 104.126.37.161
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.153
  • 104.126.37.131
  • 104.126.37.137
  • 104.126.37.145
  • 104.126.37.185
  • 104.126.37.144
  • 104.126.37.136
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wt_dev_launcher.exe