File name:

Install-GooglePlayGames-Beta.exe

Full analysis: https://app.any.run/tasks/fe0f6859-d48a-4388-b8c1-421bf5fec7f0
Verdict: Malicious activity
Analysis date: August 11, 2024, 23:27:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5:

03A9E25F375937CBF837BE2B6A23E295

SHA1:

3585A7E9E1F32743013695D44D7F5FEAE226D5DF

SHA256:

94FAAE0ED8F19AE4A160BF6BA38B190F5454164FF9BA0277CE3343847FE1C81B

SSDEEP:

98304:K22Hs3Ha+cpTINAnF5WC+p5pnjgQaCpW8J1pT0jcflB2bz14buCU51wnvECMXZwc:u00YrAuNEYtd5OwN20G+eqXrFlox+me

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • GoogleUpdateSetup.exe (PID: 7008)

    • Reads security settings of Internet Explorer

      • Install-GooglePlayGames-Beta.exe (PID: 6380)

    • Executable content was dropped or overwritten

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • GoogleUpdateSetup.exe (PID: 7008)

    • Reads the date of Windows installation

      • Install-GooglePlayGames-Beta.exe (PID: 6380)

    • Application launched itself

      • Install-GooglePlayGames-Beta.exe (PID: 6380)

    • Checks Windows Trust Settings

      • Install-GooglePlayGames-Beta.exe (PID: 6380)

    • Potential Corporate Privacy Violation

      • GoogleUpdate.exe (PID: 6320)

  • INFO

    • Reads the computer name

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • Install-GooglePlayGames-Beta.exe (PID: 6872)
      • GoogleUpdate.exe (PID: 7048)
      • GoogleUpdate.exe (PID: 7124)
      • GoogleUpdate.exe (PID: 7164)
      • GoogleUpdate.exe (PID: 6228)
      • GoogleUpdate.exe (PID: 6320)

    • Checks supported languages

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • crashpad_handler.exe (PID: 6468)
      • Install-GooglePlayGames-Beta.exe (PID: 6872)
      • GoogleUpdate.exe (PID: 7048)
      • GoogleUpdate.exe (PID: 7124)
      • GoogleUpdate.exe (PID: 6228)
      • GoogleUpdateBroker.exe (PID: 6276)
      • crashpad_handler.exe (PID: 6912)
      • GoogleUpdateSetup.exe (PID: 7008)
      • GoogleUpdateOnDemand.exe (PID: 6192)
      • GoogleUpdate.exe (PID: 6320)
      • GoogleUpdate.exe (PID: 7164)

    • Reads the machine GUID from the registry

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • Install-GooglePlayGames-Beta.exe (PID: 6872)

    • Creates files in the program directory

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • GoogleUpdate.exe (PID: 7124)
      • GoogleUpdate.exe (PID: 7164)
      • GoogleUpdate.exe (PID: 6320)
      • GoogleUpdate.exe (PID: 6228)
      • GoogleUpdate.exe (PID: 7048)

    • Creates files or folders in the user directory

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • crashpad_handler.exe (PID: 6468)

    • Create files in a temporary directory

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • GoogleUpdate.exe (PID: 6320)

    • Checks proxy server information

      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • GoogleUpdate.exe (PID: 6320)
      • GoogleUpdate.exe (PID: 7164)

    • Process checks computer location settings

      • Install-GooglePlayGames-Beta.exe (PID: 6380)

    • Reads the software policy settings

      • GoogleUpdate.exe (PID: 6320)
      • Install-GooglePlayGames-Beta.exe (PID: 6380)
      • GoogleUpdate.exe (PID: 7164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2057:09:27 15:36:58+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 2797056
InitializedDataSize: 72192
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 24.7.551.0
ProductVersionNumber: 24.7.551.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Google LLC
FileDescription: Google Play Games Installer
FileVersion: 24.7.551.0
InternalName: ProdBrandedInstaller.exe
LegalCopyright: Copyright 2023 Google LLC
OriginalFileName: ProdBrandedInstaller.exe
ProductName: Google Play Games
ProductVersion: 24.7.551.0
AssemblyVersion: 24.7.551.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
12
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start install-googleplaygames-beta.exe crashpad_handler.exe no specs install-googleplaygames-beta.exe crashpad_handler.exe no specs googleupdatesetup.exe googleupdate.exe no specs googleupdate.exe no specs googleupdate.exe googleupdatebroker.exe no specs googleupdate.exe no specs googleupdateondemand.exe no specs googleupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
6192"C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateOnDemand.exe" -EmbeddingC:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateOnDemand.exe—svchost.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Update
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\program files (x86)\google\update\1.3.36.372\googleupdateondemand.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6228"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker C:\Program Files (x86)\Google\Update\GoogleUpdate.exe—GoogleUpdateBroker.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Installer
Exit code:
0
Version:
1.3.36.51
Modules
Images
c:\program files (x86)\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6276"C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateBroker.exe" -EmbeddingC:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateBroker.exe—svchost.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Update
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\program files (x86)\google\update\1.3.36.372\googleupdatebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6320"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
GoogleUpdateOnDemand.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Installer
Version:
1.3.36.51
Modules
Images
c:\program files (x86)\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6380"C:\Users\admin\AppData\Local\Temp\Install-GooglePlayGames-Beta.exe" C:\Users\admin\AppData\Local\Temp\Install-GooglePlayGames-Beta.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Play Games Installer
Version:
24.7.551.0
Modules
Images
c:\users\admin\appdata\local\temp\install-googleplaygames-beta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6468C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\crashpad_handler.exe --no-rate-limit "--database=C:\Users\admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=24.7.551.0 --initial-client-data=0x730,0x734,0x738,0x708,0x73c,0x7fffd553b380,0x7fffd553b390,0x7fffd553b3a0C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\crashpad_handler.exe—Install-GooglePlayGames-Beta.exe
User:
admin
Integrity Level:
MEDIUM
Version:
24.7.551.0
Modules
Images
c:\users\admin\appdata\local\temp\bmn0bmac.b52\crashpad_handler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6872"C:\Users\admin\AppData\Local\Temp\Install-GooglePlayGames-Beta.exe" -install gpg_install_49a78052-739b-4edc-b730-b83b3dc2962b "C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52"C:\Users\admin\AppData\Local\Temp\Install-GooglePlayGames-Beta.exe
Install-GooglePlayGames-Beta.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Play Games Installer
Version:
24.7.551.0
Modules
Images
c:\users\admin\appdata\local\temp\install-googleplaygames-beta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6912C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\crashpad_handler.exe --no-rate-limit "--database=C:\Users\admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=24.7.551.0 --initial-client-data=0x468,0x46c,0x470,0x444,0x474,0x7fffd553b380,0x7fffd553b390,0x7fffd553b3a0C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\crashpad_handler.exe—Install-GooglePlayGames-Beta.exe
User:
admin
Integrity Level:
HIGH
Version:
24.7.551.0
Modules
Images
c:\users\admin\appdata\local\temp\bmn0bmac.b52\crashpad_handler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7008"C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\GoogleUpdateSetup.exe" /install "runtime=true&needsadmin=true" /silentC:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\GoogleUpdateSetup.exe
Install-GooglePlayGames-Beta.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Update Setup
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\users\admin\appdata\local\temp\bmn0bmac.b52\googleupdatesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
7048C:\WINDOWS\SystemTemp\GUM7E16.tmp\GoogleUpdate.exe /install "runtime=true&needsadmin=true" /silentC:\Windows\SystemTemp\GUM7E16.tmp\GoogleUpdate.exe—GoogleUpdateSetup.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Installer
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\windows\systemtemp\gum7e16.tmp\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
12 296
Read events
7 964
Write events
4 293
Delete events
39

Modification events

(PID) Process:(6380) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
Operation:writeName:C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\CrashReporting.dll
Value:
0
(PID) Process:(6380) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6380) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6380) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6380) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6872) Install-GooglePlayGames-Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
Operation:writeName:C:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\CrashReporting.dll
Value:
0
(PID) Process:(6872) Install-GooglePlayGames-Beta.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Play Games
Operation:writeName:WindowsGuid
Value:
b81900e0-a286-4724-b283-e94a7fd0ae69
(PID) Process:(7048) GoogleUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update
Operation:delete valueName:uid
Value:
(PID) Process:(7048) GoogleUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update
Operation:delete valueName:old-uid
Value:
(PID) Process:(7048) GoogleUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update
Operation:delete valueName:uid
Value:
Executable files
72
Suspicious files
7
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6380Install-GooglePlayGames-Beta.exeC:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\GoogleUpdateSetup.exeexecutable
MD5:88A857CB7CA6702AB812666B4C88DFE9
SHA256:027299EA8DFA96E0E59794C59ABFD562E2F675E8B8B9A84028DA8C58C58D243F
6380Install-GooglePlayGames-Beta.exeC:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\recorder_delegate_lib.dllexecutable
MD5:54E9D3E2CA5121BE2F74E4CEA5BEDC93
SHA256:0A61B9CB13C82D2E0E26ED6AACF5D4092F7E8869ED1CA9254AE930049986771D
6380Install-GooglePlayGames-Beta.exeC:\Users\admin\AppData\Local\Temp\bmn0bmac.b52\CrashReporting.dllexecutable
MD5:8F2908AAF792561991A1B51588099B52
SHA256:FBB3BB351F6AC4A812F1C7834540EA46095EBD531527DE6A835C0F9EBBCE6D07
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\GoogleCrashHandler.exeexecutable
MD5:4C3832FBE84B8CE63D8E3AB7D76F9983
SHA256:8FE2226E8BEC5A45D4B819359192AB92446B54859BF8877573AB7A3C8B4ADA76
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\psmachine.dllexecutable
MD5:D29E1462E84BD5E59D4401F14F1069F7
SHA256:52D3432856E24B91B7CB2F01862F710B3442E3BE38661B429942A6A18D451DEC
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\GoogleUpdateCore.exeexecutable
MD5:021C57C74DE40F7C3B4FCF58A54D3649
SHA256:04ADF40BA58D0AB892091C188822191F2597BC47DAB8B92423E8FC546DC437EF
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\goopdateres_am.dllexecutable
MD5:918CA03AB85D9DFC85C226D33F8BF58C
SHA256:4B6CA63521B29332FCF70E56BCEAF5E87DDAF0889618F3A6B6E35825F4BB0F00
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\goopdate.dllexecutable
MD5:9A7CD2CC8647D6052DA0413A95777398
SHA256:3244DD164B91B1DB785B84438D54EA69051BC9E2A21BF523BD09BBE1005C3307
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\GoogleUpdateBroker.exeexecutable
MD5:FF2D1B951CAFE2A3B88A168900844303
SHA256:F8E20A4EFB9BB32AF39E3CBC414412B3B01C0442ABFE214A58BC3ECCFFFD35B7
7008GoogleUpdateSetup.exeC:\Windows\SystemTemp\GUM7E16.tmp\GoogleUpdateOnDemand.exeexecutable
MD5:B191834EB918C5BCAA46E594561C53C9
SHA256:0FA78EEA190E3AE9DDB0E6CD85EB5188947CE0BA748FC6D567ADE48B1FB3AE27
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
45
DNS requests
23
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6320
GoogleUpdate.exe
GET
—
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/Play/fbmlgjt5xrv3zoytvy5yfmojae_24.6.755.3/HPE-24.6.755.3-CIP.exe
US
—
—
whitelisted
2536
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
312 b
whitelisted
3844
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
4592
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
6380
Install-GooglePlayGames-Beta.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
binary
1.41 Kb
whitelisted
6380
Install-GooglePlayGames-Beta.exe
GET
200
142.250.186.99:80
http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCjHbN8Q48ByBJsBZfEZOeO
US
binary
472 b
whitelisted
6380
Install-GooglePlayGames-Beta.exe
GET
200
142.250.186.99:80
http://c.pki.goog/r/r1.crl
US
binary
854 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1164
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2680
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2680
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
7164
GoogleUpdate.exe
172.217.18.99:443
update.googleapis.com
GOOGLE
US
whitelisted
6320
GoogleUpdate.exe
172.217.18.99:443
update.googleapis.com
GOOGLE
US
whitelisted
6320
GoogleUpdate.exe
34.104.35.123:80
edgedl.me.gvt1.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 4.231.128.59
whitelisted
update.googleapis.com
  • 172.217.18.99
whitelisted
edgedl.me.gvt1.com
  • 34.104.35.123
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.187
  • 2.23.209.179
  • 2.23.209.133
  • 104.126.37.163
  • 104.126.37.139
  • 104.126.37.144
  • 104.126.37.123
  • 104.126.37.145
  • 104.126.37.128
  • 104.126.37.154
  • 104.126.37.130
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.133
  • 40.126.32.140
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.72
whitelisted
th.bing.com
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.187
  • 2.23.209.179
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
6320
GoogleUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6320
GoogleUpdate.exe
Misc activity
ET INFO EXE - Served Attached HTTP
Process
Message
Install-GooglePlayGames-Beta.exe
I0000 00:00:1723418859.807002 6460 battlestar_recorder_delegate.cc:95] Successfully initialized recorder using log source value: 1518
Install-GooglePlayGames-Beta.exe
I0000 00:00:1723418919.822066 6604 portable_clearcut_uploader.cc:73] Calling SendToClearcutAsync
Install-GooglePlayGames-Beta.exe
I0000 00:00:1723418919.823017 6604 portable_clearcut_uploader.cc:129] Returning future status
Install-GooglePlayGames-Beta.exe
I0000 00:00:1723418920.201065 6520 portable_clearcut_uploader.cc:155] Successfully sending LogRequest to clearcut backend
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Install-GooglePlayGames-Beta.exe