File name:

wt_launcher_1.0.3.446-q4gnzmgpg.exe

Full analysis: https://app.any.run/tasks/8d6020d8-a539-4c23-a707-c97b6c31932e
Verdict: Malicious activity
Analysis date: December 25, 2024, 06:00:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

2739A976BA1714A6F45A916891C5A78A

SHA1:

AF3EC1C860D3A80EC9E22637CD440A0D03ED18B1

SHA256:

C08D97F8F9A1AE7166AC92C83F420C953AA866F3D3723B3A13DDF5D7B2A557FB

SSDEEP:

98304:C+cD4dnveSD4bRBNq9W06o3B4nQMNXR8D+VTrAwidbwGm/gCpDR/r3bidx/C+kxg:y2b0254bvBaBMdkt6aiajuX2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • wt_launcher_1.0.3.446-q4gnzmgpg.exe (PID: 6056)
      • wt_launcher_1.0.3.446-q4gnzmgpg.tmp (PID: 5432)

    • Reads the Windows owner or organization settings

      • wt_launcher_1.0.3.446-q4gnzmgpg.tmp (PID: 5432)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • wt_launcher_1.0.3.446-q4gnzmgpg.tmp (PID: 5432)

  • INFO

    • Checks supported languages

      • wt_launcher_1.0.3.446-q4gnzmgpg.exe (PID: 6056)
      • wt_launcher_1.0.3.446-q4gnzmgpg.tmp (PID: 5432)
      • identity_helper.exe (PID: 7284)

    • Create files in a temporary directory

      • wt_launcher_1.0.3.446-q4gnzmgpg.exe (PID: 6056)
      • wt_launcher_1.0.3.446-q4gnzmgpg.tmp (PID: 5432)

    • Reads the computer name

      • wt_launcher_1.0.3.446-q4gnzmgpg.tmp (PID: 5432)
      • identity_helper.exe (PID: 7284)

    • Reads the software policy settings

      • wt_launcher_1.0.3.446-q4gnzmgpg.tmp (PID: 5432)

    • Reads the machine GUID from the registry

      • wt_launcher_1.0.3.446-q4gnzmgpg.tmp (PID: 5432)

    • Creates files or folders in the user directory

      • wt_launcher_1.0.3.446-q4gnzmgpg.tmp (PID: 5432)

    • Creates a software uninstall entry

      • wt_launcher_1.0.3.446-q4gnzmgpg.tmp (PID: 5432)

    • Manual execution by a user

      • notepad.exe (PID: 4976)
      • msedge.exe (PID: 1200)
      • rundll32.exe (PID: 6784)
      • msedge.exe (PID: 7120)
      • msedge.exe (PID: 2736)
      • msedge.exe (PID: 6888)
      • msedge.exe (PID: 6688)
      • msedge.exe (PID: 7052)
      • rundll32.exe (PID: 6472)
      • msedge.exe (PID: 7544)
      • msedge.exe (PID: 7720)
      • msedge.exe (PID: 8088)
      • msedge.exe (PID: 7844)
      • msedge.exe (PID: 7968)
      • rundll32.exe (PID: 7364)
      • msedge.exe (PID: 7856)
      • msedge.exe (PID: 7384)
      • rundll32.exe (PID: 7428)
      • msedge.exe (PID: 7860)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 4976)
      • rundll32.exe (PID: 6784)

    • Application launched itself

      • msedge.exe (PID: 1200)

    • Reads Microsoft Office registry keys

      • rundll32.exe (PID: 6784)

    • Reads Environment values

      • identity_helper.exe (PID: 7284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:15 14:54:16+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 182272
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Gaijin Network
FileDescription: War Thunder Launcher Setup
FileVersion:
LegalCopyright: 2014-2023 Gaijin Games KFT
OriginalFileName:
ProductName: War Thunder Launcher
ProductVersion:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
235
Monitored processes
113
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wt_launcher_1.0.3.446-q4gnzmgpg.exe wt_launcher_1.0.3.446-q4gnzmgpg.tmp netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs notepad.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs msedge.exe netsh.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs netsh.exe no specs conhost.exe no specs rundll32.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
396"C:\WINDOWS\system32\netsh.exe" firewall add allowedprogram "C:\Users\admin\AppData\Local\WarThunder\win64\bpreport.exe" "War Thunder Crash Reporter" ENABLE ALLC:\Windows\SysWOW64\netsh.exe—wt_launcher_1.0.3.446-q4gnzmgpg.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
448\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644"C:\WINDOWS\system32\netsh" firewall add portopening protocol = UDP port = 3478-3480 name = "War Thunder"C:\Windows\SysWOW64\netsh.exe—wt_launcher_1.0.3.446-q4gnzmgpg.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
732"C:\WINDOWS\system32\netsh" firewall add portopening protocol = TCP port = 27022-27042 name = "War Thunder"C:\Windows\SysWOW64\netsh.exe—wt_launcher_1.0.3.446-q4gnzmgpg.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
848"C:\WINDOWS\system32\netsh.exe" firewall add allowedprogram "C:\Users\admin\AppData\Local\WarThunder\ForceSingleGPU.exe" "War Thunder Game Client for disabled CrossFire\SLI" ENABLE ALLC:\Windows\SysWOW64\netsh.exe—wt_launcher_1.0.3.446-q4gnzmgpg.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1064\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1200"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" C:\Users\admin\Desktop\telegram_ico.svgC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1296"C:\WINDOWS\system32\netsh" firewall add portopening protocol = TCP port = 6881 name = "War Thunder"C:\Windows\SysWOW64\netsh.exe—wt_launcher_1.0.3.446-q4gnzmgpg.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1416"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5200 --field-trial-handle=2328,i,16416300999299810353,6371864999109344402,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
22 400
Read events
22 305
Write events
95
Delete events
0

Modification events

(PID) Process:(5432) wt_launcher_1.0.3.446-q4gnzmgpg.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:StartupWithWindows
Value:
Yes
(PID) Process:(5432) wt_launcher_1.0.3.446-q4gnzmgpg.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:InstallDir
Value:
C:\Users\admin\AppData\Local\WarThunder
(PID) Process:(5432) wt_launcher_1.0.3.446-q4gnzmgpg.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:InstallPath
Value:
C:\Users\admin\AppData\Local\WarThunder
(PID) Process:(5432) wt_launcher_1.0.3.446-q4gnzmgpg.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:Dir
Value:
C:\Users\admin\AppData\Local\WarThunder
(PID) Process:(5432) wt_launcher_1.0.3.446-q4gnzmgpg.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:Path
Value:
C:\Users\admin\AppData\Local\WarThunder\launcher.exe
(PID) Process:(5432) wt_launcher_1.0.3.446-q4gnzmgpg.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Gaijin\WarThunder
Operation:writeName:language
Value:
English
(PID) Process:(5432) wt_launcher_1.0.3.446-q4gnzmgpg.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.2.2
(PID) Process:(5432) wt_launcher_1.0.3.446-q4gnzmgpg.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Local\WarThunder
(PID) Process:(5432) wt_launcher_1.0.3.446-q4gnzmgpg.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\WarThunder\
(PID) Process:(5432) wt_launcher_1.0.3.446-q4gnzmgpg.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
WarThunder
Executable files
16
Suspicious files
340
Text files
52
Unknown types
0

Dropped files

PID
Process
Filename
Type
5432wt_launcher_1.0.3.446-q4gnzmgpg.tmpC:\Users\admin\AppData\Local\Temp\is-GUPGS.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6056wt_launcher_1.0.3.446-q4gnzmgpg.exeC:\Users\admin\AppData\Local\Temp\is-AD7RK.tmp\wt_launcher_1.0.3.446-q4gnzmgpg.tmpexecutable
MD5:1EE2BA9595F06D6287EFEA41FAFE9589
SHA256:03875721400F5FE8AB2B28B058EA89B0175D5B36360882953FFF63B239B56D31
5432wt_launcher_1.0.3.446-q4gnzmgpg.tmpC:\Users\admin\AppData\Local\WarThunder\is-CQ2S9.tmpexecutable
MD5:1EE2BA9595F06D6287EFEA41FAFE9589
SHA256:03875721400F5FE8AB2B28B058EA89B0175D5B36360882953FFF63B239B56D31
5432wt_launcher_1.0.3.446-q4gnzmgpg.tmpC:\Users\admin\AppData\Local\WarThunder\is-KR1D7.tmpexecutable
MD5:31911C6EA459F516D1DA0A12EC677BEA
SHA256:44C1DB6B7BF4103B2C4D3A1F014A1EA8FAFBBEBA19CD028525D494E3E390A896
5432wt_launcher_1.0.3.446-q4gnzmgpg.tmpC:\Users\admin\AppData\Local\WarThunder\is-S9I4B.tmpexecutable
MD5:58115B095C523466950E2F745B70B867
SHA256:41CF304562A6240AF02157B17800C0EC01154626258A809D665AADD59E7276CA
5432wt_launcher_1.0.3.446-q4gnzmgpg.tmpC:\Users\admin\AppData\Local\WarThunder\bpreport.exeexecutable
MD5:31911C6EA459F516D1DA0A12EC677BEA
SHA256:44C1DB6B7BF4103B2C4D3A1F014A1EA8FAFBBEBA19CD028525D494E3E390A896
5432wt_launcher_1.0.3.446-q4gnzmgpg.tmpC:\Users\admin\AppData\Local\WarThunder\gjagent.exeexecutable
MD5:65F9CBA4FB02014A13685D8358CB0E67
SHA256:2ED5BFDA0B759B4CD795514C0F1FFBDBD0DF40A82EA4FD50044BDFD8AD25CE37
5432wt_launcher_1.0.3.446-q4gnzmgpg.tmpC:\Users\admin\AppData\Local\WarThunder\is-BM7IC.tmpcompressed
MD5:36A01E2FADC727BC33E35F669631C4E9
SHA256:C0A975BB2E2474650C76D781A0B72F04BE49668E0194AB97D66863F2C0BC3DC2
5432wt_launcher_1.0.3.446-q4gnzmgpg.tmpC:\Users\admin\AppData\Local\WarThunder\is-92P9P.tmpexecutable
MD5:ADC796431F36632ED86663E8BCAFDDB8
SHA256:699783D9218C730A4334532DD0ADC6FA9D6E22395E96274B20CDB32EFEA6EDBA
5432wt_launcher_1.0.3.446-q4gnzmgpg.tmpC:\Users\admin\AppData\Local\WarThunder\gaijin_downloader.exeexecutable
MD5:ADC796431F36632ED86663E8BCAFDDB8
SHA256:699783D9218C730A4334532DD0ADC6FA9D6E22395E96274B20CDB32EFEA6EDBA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
62
TCP/UDP connections
54
DNS requests
47
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
488
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
488
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
401
13.107.6.158:443
https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox
unknown
—
—
—
—
—
GET
304
13.107.21.239:443
https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist
unknown
—
—
—
—
—
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v1/Edge/122.0.2365.59?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=44&mngd=0&installdate=1661339457&edu=0&bphint=2&soobedate=1504771245&fg=1
unknown
binary
768 b
whitelisted
—
—
POST
204
2.21.110.146:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
whitelisted
—
—
POST
200
188.42.61.240:443
https://launcher-bq.gaijin.net/launcher
unknown
binary
15 b
whitelisted
—
—
GET
200
13.107.246.45:443
https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-US&setchannel=stable
unknown
binary
14.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
488
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
488
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
488
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
488
svchost.exe
13.71.55.58:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IN
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 13.71.55.58
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
launcher-bq.gaijin.net
  • 188.42.61.240
whitelisted
www.bing.com
  • 2.23.209.193
  • 2.23.209.148
  • 2.23.209.130
  • 2.23.209.140
  • 2.23.209.149
  • 2.23.209.177
  • 2.23.209.187
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.150
  • 2.23.209.158
  • 2.23.209.189
  • 2.21.110.139
  • 2.21.110.146
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
config.edge.skype.com
  • 52.123.243.207
  • 52.123.243.209
  • 52.123.224.70
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wt_launcher_1.0.3.446-q4gnzmgpg.exe