File name:

wt_dev_launcher.exe

Full analysis: https://app.any.run/tasks/c9f5f19f-32f0-4c43-84fc-06d4b3a4ac16
Verdict: Malicious activity
Analysis date: November 01, 2024, 19:27:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

EA300E3B06097B0B213C5EB9E242FE77

SHA1:

85DA55512C4500DD7A5E61AD95D2FFA271215390

SHA256:

807A3C2D2C8CA0C1F09C4911563D5FE1A1F5705FCD88FF316BC3D1852EF33ADC

SSDEEP:

98304:EgOeSD4luI1booVhUvr40ndaUC2IYdAJdWbs1+uE3EHzp1rNBsdvIQuMHRSdm2IT:9DFhrHPVfhl8vP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • wt_dev_launcher.exe (PID: 6024)
      • wt_dev_launcher.tmp (PID: 6436)

    • Process drops legitimate windows executable

      • wt_dev_launcher.tmp (PID: 6436)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • wt_dev_launcher.tmp (PID: 6436)

  • INFO

    • Checks supported languages

      • wt_dev_launcher.tmp (PID: 6436)
      • wt_dev_launcher.exe (PID: 6024)

    • Manual execution by a user

      • msedge.exe (PID: 4164)
      • notepad.exe (PID: 6584)
      • rundll32.exe (PID: 2780)
      • rundll32.exe (PID: 7644)
      • rundll32.exe (PID: 7196)
      • rundll32.exe (PID: 5604)
      • rundll32.exe (PID: 7740)
      • rundll32.exe (PID: 7500)
      • rundll32.exe (PID: 7848)
      • rundll32.exe (PID: 7308)
      • rundll32.exe (PID: 8008)
      • rundll32.exe (PID: 8108)
      • rundll32.exe (PID: 7184)
      • rundll32.exe (PID: 7288)
      • rundll32.exe (PID: 7336)
      • rundll32.exe (PID: 7352)
      • rundll32.exe (PID: 7840)
      • rundll32.exe (PID: 7376)

    • Reads the computer name

      • wt_dev_launcher.tmp (PID: 6436)

    • Create files in a temporary directory

      • wt_dev_launcher.exe (PID: 6024)

    • Application launched itself

      • msedge.exe (PID: 4164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (57.2)
.exe | Win32 Executable (generic) (18.2)
.exe | Win16/32 Executable Delphi generic (8.3)
.exe | Generic Win/DOS Executable (8)
.exe | DOS Executable Generic (8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:06 14:39:04+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 197632
UninitializedDataSize: -
EntryPoint: 0x117dc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Gaijin Entertainment
FileDescription: War Thunder Launcher Dev version Setup
FileVersion:
LegalCopyright: Copyright © 2011-2018 Gaijin Entertainment
ProductName: War Thunder Launcher Dev version
ProductVersion:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
222
Monitored processes
96
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wt_dev_launcher.exe wt_dev_launcher.tmp netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs msedge.exe netsh.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs netsh.exe no specs conhost.exe no specs notepad.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs rundll32.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs netsh.exe no specs conhost.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs netsh.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5160 --field-trial-handle=2032,i,16305934933184372714,6323156160512341848,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864"C:\WINDOWS\system32\netsh" firewall add portopening protocol = TCP port = 7852 name = "War Thunder"C:\Windows\SysWOW64\netsh.exe—wt_dev_launcher.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
948"C:\WINDOWS\system32\netsh.exe" firewall add allowedprogram "C:\Users\admin\AppData\Local\WarThunderDev\bpreport.exe" "War Thunder Crash Reporter" ENABLE ALLC:\Windows\SysWOW64\netsh.exe—wt_dev_launcher.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1084"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2648 --field-trial-handle=2032,i,16305934933184372714,6323156160512341848,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1160"C:\WINDOWS\system32\netsh" firewall add portopening protocol = TCP port = 7853 name = "War Thunder"C:\Windows\SysWOW64\netsh.exe—wt_dev_launcher.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2380"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5780 --field-trial-handle=2032,i,16305934933184372714,6323156160512341848,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2444"C:\WINDOWS\system32\netsh.exe" firewall add allowedprogram "C:\Users\admin\AppData\Local\WarThunderDev\win64\AFR-FriendlyD3D.exe" "War Thunder Game Client for CrossFire\SLI" ENABLE ALLC:\Windows\SysWOW64\netsh.exe—wt_dev_launcher.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2444\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2684"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6272 --field-trial-handle=2032,i,16305934933184372714,6323156160512341848,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2780"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Desktop\slider_bg.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
35 680
Read events
35 614
Write events
66
Delete events
0

Modification events

(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:StartupWithWindows
Value:
Yes
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:InstallDir
Value:
C:\Users\admin\AppData\Local\WarThunderDev
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:InstallPath
Value:
C:\Users\admin\AppData\Local\WarThunderDev
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:Dir
Value:
C:\Users\admin\AppData\Local\WarThunderDev
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:Path
Value:
C:\Users\admin\AppData\Local\WarThunderDev\launcher.exe
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:language
Value:
English
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.9 (u)
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Local\WarThunderDev
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\WarThunderDev\
(PID) Process:(6436) wt_dev_launcher.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
WarThunderDev
Executable files
16
Suspicious files
105
Text files
48
Unknown types
0

Dropped files

PID
Process
Filename
Type
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\is-155VC.tmpexecutable
MD5:6929FBEAFC0D4A056D56134EC80B32D8
SHA256:5BA63F6464D2D29408583EC3F399DF1FC46DFA42A3A96C8B1D81475D7AD921BB
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\Temp\is-94VCG.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\is-O1O48.tmpexecutable
MD5:2D2015BF999E31D09E74D9828E5745D4
SHA256:BE1562249F3FFEE5E15DE2AE1B43B96A3415F2DAB5AD35F0B8624A5462152D0D
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\is-SKNL8.tmpexecutable
MD5:05D92ACFD2C736B99DA01B12D9D55B14
SHA256:9119858DCA8C5A86333B0C91CC9CB06B3675D8DCE17B9EB7158D1FDBF577BA3A
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\unins000.exeexecutable
MD5:05D92ACFD2C736B99DA01B12D9D55B14
SHA256:9119858DCA8C5A86333B0C91CC9CB06B3675D8DCE17B9EB7158D1FDBF577BA3A
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\gaijin_downloader.exeexecutable
MD5:5FB5DF9424B5D644057DE9D440CDB3EF
SHA256:FCFC141208D5166715A2BF439EEFF371DAF19CBA369F1BA5129703FA3A37020B
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\is-49COL.tmpcompressed
MD5:6E41D717BC13F42081D6A49004ABE815
SHA256:9DF8F77923EEFD6FC68CDA43DFED4EABD4FEF4A588FDCBF2917F90CC1B93DFDE
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\bpreport.exeexecutable
MD5:6929FBEAFC0D4A056D56134EC80B32D8
SHA256:5BA63F6464D2D29408583EC3F399DF1FC46DFA42A3A96C8B1D81475D7AD921BB
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\is-QHUB5.tmpexecutable
MD5:C725D983DA82E00CC026B04E02E3DC52
SHA256:DF2AA73F18CE52E6D78E6BA3E7AC9941988B97A40B8A4365A8193F0A0EE20929
6436wt_dev_launcher.tmpC:\Users\admin\AppData\Local\WarThunderDev\is-EQCO9.tmpexecutable
MD5:5FB5DF9424B5D644057DE9D440CDB3EF
SHA256:FCFC141208D5166715A2BF439EEFF371DAF19CBA369F1BA5129703FA3A37020B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
47
DNS requests
40
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
2.21.20.133:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1280
RUXIMICS.exe
GET
200
2.21.20.133:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.21.20.133:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1280
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
401
13.107.6.158:443
https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox
unknown
—
—
—
—
—
GET
304
13.107.21.239:443
https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist
unknown
—
—
—
—
—
OPTIONS
503
23.50.131.21:443
https://bzib.nelreports.net/api/report?cat=bingbusiness
unknown
html
373 b
whitelisted
—
—
GET
401
13.107.6.158:443
https://business.bing.com/work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox
unknown
binary
584 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1280
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
2.21.20.133:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1280
RUXIMICS.exe
2.21.20.133:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
2.21.20.133:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5488
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 2.21.20.133
  • 2.21.20.137
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
launcher-bq.gaijin.net
  • 188.42.61.240
whitelisted
www.bing.com
  • 104.126.37.160
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.155
  • 104.126.37.170
  • 104.126.37.161
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.153
  • 104.126.37.131
  • 104.126.37.137
  • 104.126.37.145
  • 104.126.37.185
  • 104.126.37.144
  • 104.126.37.136
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wt_dev_launcher.exe