File name:

Install-GooglePlayGames-Beta.exe

Full analysis: https://app.any.run/tasks/fe0f6859-d48a-4388-b8c1-421bf5fec7f0
Verdict: Malicious activity
Analysis date: August 11, 2024, 23:27:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5:

03A9E25F375937CBF837BE2B6A23E295

SHA1:

3585A7E9E1F32743013695D44D7F5FEAE226D5DF

SHA256:

94FAAE0ED8F19AE4A160BF6BA38B190F5454164FF9BA0277CE3343847FE1C81B

SSDEEP:

98304:K22Hs3Ha+cpTINAnF5WC+p5pnjgQaCpW8J1pT0jcflB2bz14buCU51wnvECMXZwc:u00YrAuNEYtd5OwN20G+eqXrFlox+me

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Install-GooglePlayGames-Beta.exe (PID: 6380)

    • Executable content was dropped or overwritten

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • GoogleUpdateSetup.exe (PID: 7008)

    • Application launched itself

      • Install-GooglePlayGames-Beta.exe (PID: 6380)

    • Reads the date of Windows installation

      • Install-GooglePlayGames-Beta.exe (PID: 6380)

    • Drops the executable file immediately after the start

      • GoogleUpdateSetup.exe (PID: 7008)
      • Install-GooglePlayGames-Beta.exe (PID: 6380)

    • Potential Corporate Privacy Violation

      • GoogleUpdate.exe (PID: 6320)

    • Checks Windows Trust Settings

      • Install-GooglePlayGames-Beta.exe (PID: 6380)

  • INFO

    • Checks supported languages

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • GoogleUpdateSetup.exe (PID: 7008)
      • crashpad_handler.exe (PID: 6468)
      • GoogleUpdate.exe (PID: 7048)
      • GoogleUpdate.exe (PID: 7124)
      • GoogleUpdate.exe (PID: 7164)
      • GoogleUpdate.exe (PID: 6228)
      • GoogleUpdateBroker.exe (PID: 6276)
      • GoogleUpdate.exe (PID: 6320)
      • GoogleUpdateOnDemand.exe (PID: 6192)
      • crashpad_handler.exe (PID: 6912)
      • Install-GooglePlayGames-Beta.exe (PID: 6872)

    • Create files in a temporary directory

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • GoogleUpdate.exe (PID: 6320)

    • Reads the machine GUID from the registry

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • Install-GooglePlayGames-Beta.exe (PID: 6872)

    • Reads the computer name

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • Install-GooglePlayGames-Beta.exe (PID: 6872)
      • GoogleUpdate.exe (PID: 7164)
      • GoogleUpdate.exe (PID: 7124)
      • GoogleUpdate.exe (PID: 7048)
      • GoogleUpdate.exe (PID: 6228)
      • GoogleUpdate.exe (PID: 6320)

    • Creates files in the program directory

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • GoogleUpdate.exe (PID: 7124)
      • GoogleUpdate.exe (PID: 7048)
      • GoogleUpdate.exe (PID: 7164)
      • GoogleUpdate.exe (PID: 6228)
      • GoogleUpdate.exe (PID: 6320)

    • Checks proxy server information

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • GoogleUpdate.exe (PID: 7164)
      • GoogleUpdate.exe (PID: 6320)

    • Process checks computer location settings

      • Install-GooglePlayGames-Beta.exe (PID: 6380)

    • Creates files or folders in the user directory

      • crashpad_handler.exe (PID: 6468)
      • Install-GooglePlayGames-Beta.exe (PID: 6380)

    • Reads the software policy settings

      • GoogleUpdate.exe (PID: 7164)
      • GoogleUpdate.exe (PID: 6320)
      • Install-GooglePlayGames-Beta.exe (PID: 6380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2057:09:27 15:36:58+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 2797056
InitializedDataSize: 72192
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 24.7.551.0
ProductVersionNumber: 24.7.551.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Google LLC
FileDescription: Google Play Games Installer
FileVersion: 24.7.551.0
InternalName: ProdBrandedInstaller.exe
LegalCopyright: Copyright 2023 Google LLC
OriginalFileName: ProdBrandedInstaller.exe
ProductName: Google Play Games
ProductVersion: 24.7.551.0
AssemblyVersion: 24.7.551.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
12
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start install-googleplaygames-beta.exe crashpad_handler.exe no specs install-googleplaygames-beta.exe crashpad_handler.exe no specs googleupdatesetup.exe googleupdate.exe no specs googleupdate.exe no specs googleupdate.exe googleupdatebroker.exe no specs googleupdate.exe no specs googleupdateondemand.exe no specs googleupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
6192"C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateOnDemand.exe" -EmbeddingC:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateOnDemand.exe—svchost.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Update
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\program files (x86)\google\update\1.3.36.372\googleupdateondemand.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6228"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker C:\Program Files (x86)\Google\Update\GoogleUpdate.exe—GoogleUpdateBroker.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Installer
Exit code:
0
Version:
1.3.36.51
Modules
Images
c:\program files (x86)\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6276"C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateBroker.exe" -EmbeddingC:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateBroker.exe—svchost.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Update
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\program files (x86)\google\update\1.3.36.372\googleupdatebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6320"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
GoogleUpdateOnDemand.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Installer
Version:
1.3.36.51
Modules
Images
c:\program files (x86)\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6380"C:\Users\admin\AppData\Local\Temp\Install-GooglePlayGames-Beta.exe" C:\Users\admin\AppData\Local\Temp\Install-GooglePlayGames-Beta.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Play Games Installer
Version:
24.7.551.0
Modules
Images
c:\users\admin\appdata\local\temp\install-googleplaygames-beta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6468C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\crashpad_handler.exe --no-rate-limit "--database=C:\Users\admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=24.7.551.0 --initial-client-data=0x730,0x734,0x738,0x708,0x73c,0x7fffd553b380,0x7fffd553b390,0x7fffd553b3a0C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\crashpad_handler.exe—Install-GooglePlayGames-Beta.exe
User:
admin
Integrity Level:
MEDIUM
Version:
24.7.551.0
Modules
Images
c:\users\admin\appdata\local\temp\bmn0bmac.b52\crashpad_handler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6872"C:\Users\admin\AppData\Local\Temp\Install-GooglePlayGames-Beta.exe" -install gpg_install_49a78052-739b-4edc-b730-b83b3dc2962b "C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52"C:\Users\admin\AppData\Local\Temp\Install-GooglePlayGames-Beta.exe
Install-GooglePlayGames-Beta.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Play Games Installer
Version:
24.7.551.0
Modules
Images
c:\users\admin\appdata\local\temp\install-googleplaygames-beta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6912C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\crashpad_handler.exe --no-rate-limit "--database=C:\Users\admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=24.7.551.0 --initial-client-data=0x468,0x46c,0x470,0x444,0x474,0x7fffd553b380,0x7fffd553b390,0x7fffd553b3a0C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\crashpad_handler.exe—Install-GooglePlayGames-Beta.exe
User:
admin
Integrity Level:
HIGH
Version:
24.7.551.0
Modules
Images
c:\users\admin\appdata\local\temp\bmn0bmac.b52\crashpad_handler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7008"C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\GoogleUpdateSetup.exe" /install "runtime=true&needsadmin=true" /silentC:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\GoogleUpdateSetup.exe
Install-GooglePlayGames-Beta.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Update Setup
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\users\admin\appdata\local\temp\bmn0bmac.b52\googleupdatesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
7048C:\WINDOWS\SystemTemp\GUM7E16.tmp\GoogleUpdate.exe /install "runtime=true&needsadmin=true" /silentC:\Windows\SystemTemp\GUM7E16.tmp\GoogleUpdate.exe—GoogleUpdateSetup.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Installer
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\windows\systemtemp\gum7e16.tmp\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
12 296
Read events
7 964
Write events
4 293
Delete events
39

Modification events

(PID) Process:(6380) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
Operation:writeName:C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\CrashReporting.dll
Value:
0
(PID) Process:(6380) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6380) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6380) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6380) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6872) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
Operation:writeName:C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\CrashReporting.dll
Value:
0
(PID) Process:(6872) Install-GooglePlayGames-Beta.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Play Games
Operation:writeName:WindowsGuid
Value:
b81900e0-a286-4724-b283-e94a7fd0ae69
(PID) Process:(7048) GoogleUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update
Operation:delete valueName:uid
Value:
(PID) Process:(7048) GoogleUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update
Operation:delete valueName:old-uid
Value:
(PID) Process:(7048) GoogleUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update
Operation:delete valueName:uid
Value:
Executable files
72
Suspicious files
7
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\psuser_64.dllexecutable
MD5:ED5DB5AE586E040F563D40A78BFAE380
SHA256:5C4FDAC58EFB80BE9A5A43CEA1A6A6A772B0356B6E29E66ED43237893C30518B
6380Install-GooglePlayGames-Beta.exeC:\Users\admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad\settings.datbinary
MD5:502B09C8AD2972AAA67BBC530100BA7B
SHA256:03DD65EADD335402F7A8534CC496C8A5BB8DC7358FF15A8E9C7A0E83F2429993
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\GoogleCrashHandler64.exeexecutable
MD5:DAE993327723122C9288504A62E9F082
SHA256:38903DEC79D41ABDA6FB7750B48A31FFCA418B3EAB19395A0A5D75D8A9204EE7
6380Install-GooglePlayGames-Beta.exeC:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\crashpad_handler.exeexecutable
MD5:9C227F7DE3ED86A7789E80A4D71BF915
SHA256:282249A8761831390F5ECBB99A14F85CC8CAAD81DF7BACB90B652D8F32052366
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\GoogleUpdate.exeexecutable
MD5:BAF0B64AF9FCEAB44942506F3AF21C87
SHA256:581EDECA339BB8C5EBC1D0193AD77F5CAFA329C5A9ADF8F5299B1AFABED6623B
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\goopdateres_am.dllexecutable
MD5:918CA03AB85D9DFC85C226D33F8BF58C
SHA256:4B6CA63521B29332FCF70E56BCEAF5E87DDAF0889618F3A6B6E35825F4BB0F00
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\GoogleUpdateComRegisterShell64.exeexecutable
MD5:0FE3644C905D5547B3A855B2DC3DB469
SHA256:7D5C0ED6617DBC1B78D2994A6E5BBDA474B5F4814D4A34D41F844CE9A3A4EB66
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\GoogleUpdateCore.exeexecutable
MD5:021C57C74DE40F7C3B4FCF58A54D3649
SHA256:04ADF40BA58D0AB892091C188822191F2597BC47DAB8B92423E8FC546DC437EF
6380Install-GooglePlayGames-Beta.exeC:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\recorder_delegate_lib.dllexecutable
MD5:54E9D3E2CA5121BE2F74E4CEA5BEDC93
SHA256:0A61B9CB13C82D2E0E26ED6AACF5D4092F7E8869ED1CA9254AE930049986771D
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\goopdateres_bg.dllexecutable
MD5:C7C2B093594CD7ACB811A3FE7FC4885D
SHA256:0A5CB4559E58D670D84A2CE83B12762FC914CD2B46A59CB83A6CD0D69993AF72
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
45
DNS requests
23
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6380
Install-GooglePlayGames-Beta.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
6320
GoogleUpdate.exe
GET
—
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/Play/fbmlgjt5xrv3zoytvy5yfmojae_24.6.755.3/HPE-24.6.755.3-CIP.exe
unknown
—
—
whitelisted
2536
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4592
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6380
Install-GooglePlayGames-Beta.exe
GET
200
142.250.186.99:80
http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCjHbN8Q48ByBJsBZfEZOeO
unknown
—
—
whitelisted
6380
Install-GooglePlayGames-Beta.exe
GET
200
142.250.186.99:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
3844
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1164
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2680
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2680
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
7164
GoogleUpdate.exe
172.217.18.99:443
update.googleapis.com
GOOGLE
US
whitelisted
6320
GoogleUpdate.exe
172.217.18.99:443
update.googleapis.com
GOOGLE
US
whitelisted
6320
GoogleUpdate.exe
34.104.35.123:80
edgedl.me.gvt1.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 4.231.128.59
whitelisted
update.googleapis.com
  • 172.217.18.99
whitelisted
edgedl.me.gvt1.com
  • 34.104.35.123
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.187
  • 2.23.209.179
  • 2.23.209.133
  • 104.126.37.163
  • 104.126.37.139
  • 104.126.37.144
  • 104.126.37.123
  • 104.126.37.145
  • 104.126.37.128
  • 104.126.37.154
  • 104.126.37.130
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.133
  • 40.126.32.140
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.72
whitelisted
th.bing.com
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.187
  • 2.23.209.179
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
6320
GoogleUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6320
GoogleUpdate.exe
Misc activity
ET INFO EXE - Served Attached HTTP
Process
Message
Install-GooglePlayGames-Beta.exe
I0000 00:00:1723418859.807002 6460 battlestar_recorder_delegate.cc:95] Successfully initialized recorder using log source value: 1518
Install-GooglePlayGames-Beta.exe
I0000 00:00:1723418919.822066 6604 portable_clearcut_uploader.cc:73] Calling SendToClearcutAsync
Install-GooglePlayGames-Beta.exe
I0000 00:00:1723418919.823017 6604 portable_clearcut_uploader.cc:129] Returning future status
Install-GooglePlayGames-Beta.exe
I0000 00:00:1723418920.201065 6520 portable_clearcut_uploader.cc:155] Successfully sending LogRequest to clearcut backend
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Install-GooglePlayGames-Beta.exe