File name:

Stormshot.PC.V1.0_6c370a0c5a.exe

Full analysis: https://app.any.run/tasks/5941363d-1fbb-4a5a-ab15-14270e0d26fb
Verdict: Malicious activity
Analysis date: March 20, 2025, 19:19:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
antivm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

6AAE47CBAA4C56095A1EB0422C1D2ECB

SHA1:

34E29D1801D270A2BD7AC02D4EA84C14C553D66F

SHA256:

FFD63FE2AEAA91F05BEF47B3583290CCDBA3F44912AB8B67044F3D58BF817EBF

SSDEEP:

98304:5qXfKQQqTpl6ykKzUczpKnUOsGMG7F/1jzzXcVNbgtgz9GMGevZ7DTQ4H:DrzZtE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • PC-Launcher.exe (PID: 7400)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • st_6c370a0c5a.exe (PID: 5360)
      • 7za.exe (PID: 6388)

    • Drops 7-zip archiver for unpacking

      • st_6c370a0c5a.exe (PID: 5360)

    • Process drops legitimate windows executable

      • st_6c370a0c5a.exe (PID: 5360)
      • 7za.exe (PID: 6388)

    • The process drops C-runtime libraries

      • st_6c370a0c5a.exe (PID: 5360)
      • 7za.exe (PID: 6388)

    • Creates a software uninstall entry

      • st_6c370a0c5a.exe (PID: 5360)

    • The process checks if it is being run in the virtual environment

      • PC-Launcher.exe (PID: 7400)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 7232)

    • There is functionality for taking screenshot (YARA)

      • PC-Launcher.exe (PID: 7400)

    • The process creates files with name similar to system file names

      • 7za.exe (PID: 6388)

    • There is functionality for VM detection antiVM strings (YARA)

      • PC-Launcher.exe (PID: 7400)

  • INFO

    • Reads CPU info

      • Stormshot.PC.V1.0_6c370a0c5a.exe (PID: 7192)
      • PC-Launcher.exe (PID: 7400)

    • Checks supported languages

      • Stormshot.PC.V1.0_6c370a0c5a.exe (PID: 7192)
      • st_6c370a0c5a.exe (PID: 5360)
      • Launcher.exe (PID: 1072)
      • PC-Launcher.exe (PID: 7400)
      • ShellExperienceHost.exe (PID: 7232)
      • 7za.exe (PID: 6388)

    • Reads the computer name

      • Stormshot.PC.V1.0_6c370a0c5a.exe (PID: 7192)
      • st_6c370a0c5a.exe (PID: 5360)
      • PC-Launcher.exe (PID: 7400)
      • ShellExperienceHost.exe (PID: 7232)
      • 7za.exe (PID: 6388)

    • Reads the machine GUID from the registry

      • Stormshot.PC.V1.0_6c370a0c5a.exe (PID: 7192)
      • PC-Launcher.exe (PID: 7400)

    • Create files in a temporary directory

      • Stormshot.PC.V1.0_6c370a0c5a.exe (PID: 7192)
      • PC-Launcher.exe (PID: 7400)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7020)
      • PC-Launcher.exe (PID: 7400)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8016)
      • BackgroundTransferHost.exe (PID: 2088)
      • BackgroundTransferHost.exe (PID: 7180)
      • BackgroundTransferHost.exe (PID: 7020)
      • BackgroundTransferHost.exe (PID: 7640)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7020)
      • PC-Launcher.exe (PID: 7400)
      • slui.exe (PID: 5728)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7020)
      • slui.exe (PID: 7280)
      • slui.exe (PID: 5728)

    • Creates files in the program directory

      • st_6c370a0c5a.exe (PID: 5360)
      • PC-Launcher.exe (PID: 7400)
      • 7za.exe (PID: 6388)

    • The sample compiled with english language support

      • st_6c370a0c5a.exe (PID: 5360)
      • 7za.exe (PID: 6388)

    • The sample compiled with chinese language support

      • st_6c370a0c5a.exe (PID: 5360)
      • 7za.exe (PID: 6388)

    • Autorun file from Registry key

      • PC-Launcher.exe (PID: 7400)

    • Qt framework related mutex has been found

      • PC-Launcher.exe (PID: 7400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:06:12 11:20:51+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.29
CodeSize: 1302016
InitializedDataSize: 1638912
UninitializedDataSize: -
EntryPoint: 0x11272c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
16
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start stormshot.pc.v1.0_6c370a0c5a.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs st_6c370a0c5a.exe launcher.exe no specs pc-launcher.exe slui.exe shellexperiencehost.exe no specs 7za.exe conhost.exe no specs stormshot.pc.v1.0_6c370a0c5a.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904"C:\Users\admin\AppData\Local\Temp\Stormshot.PC.V1.0_6c370a0c5a.exe" C:\Users\admin\AppData\Local\Temp\Stormshot.PC.V1.0_6c370a0c5a.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\stormshot.pc.v1.0_6c370a0c5a.exe
c:\windows\system32\ntdll.dll
1072"C:\Program Files (x86)\FunPlus\Stormshot\Launcher.exe" C:\Program Files (x86)\FunPlus\Stormshot\Launcher.exe—st_6c370a0c5a.exe
User:
admin
Company:
FunPlus, Inc.
Integrity Level:
HIGH
Description:
Stormshot
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files (x86)\funplus\stormshot\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2088"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5360C:\Users\admin\AppData\Local\Temp\st_6c370a0c5a.exeC:\Users\admin\AppData\Local\Temp\st_6c370a0c5a.exe
Stormshot.PC.V1.0_6c370a0c5a.exe
User:
admin
Company:
FunPlus, Inc.
Integrity Level:
HIGH
Description:
Stormshot
Exit code:
0
Version:
1, 0, 0, 96
Modules
Images
c:\users\admin\appdata\local\temp\st_6c370a0c5a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5728C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6388"C:\Program Files (x86)\FunPlus\Stormshot\Plugin\7z.21.07\7za.exe" x -aoa -bsp2 -bse1 -bso0 "C:/Program Files (x86)/FunPlus/Stormshot/download/ngame/st_global_4.14.100_d098299069082dbc704f09cec410bc63.7z" "-oC:/Program Files (x86)/FunPlus/Stormshot/nGame/4.14.100"C:\Program Files (x86)\FunPlus\Stormshot\Plugin\7z.21.07\7za.exe
PC-Launcher.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Version:
23.01
Modules
Images
c:\program files (x86)\funplus\stormshot\plugin\7z.21.07\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7020"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7180"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7192"C:\Users\admin\AppData\Local\Temp\Stormshot.PC.V1.0_6c370a0c5a.exe" C:\Users\admin\AppData\Local\Temp\Stormshot.PC.V1.0_6c370a0c5a.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stormshot.pc.v1.0_6c370a0c5a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7232"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
Total events
6 276
Read events
6 249
Write events
27
Delete events
0

Modification events

(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2088) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2088) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2088) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7180) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
182
Suspicious files
1 928
Text files
106
Unknown types
0

Dropped files

PID
Process
Filename
Type
7020BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\a9f59ca7-3154-449b-8ed8-7e126d0bcc35.down_data —
MD5:—
SHA256:—
7192Stormshot.PC.V1.0_6c370a0c5a.exeC:\Users\admin\AppData\Local\Temp\st_tmp.dl —
MD5:—
SHA256:—
7192Stormshot.PC.V1.0_6c370a0c5a.exeC:\Users\admin\AppData\Local\Temp\st_6c370a0c5a.exe —
MD5:—
SHA256:—
5360st_6c370a0c5a.exeC:\Program Files (x86)\FunPlus\Stormshot\1.0.0.96\QtQml\WorkerScript.2\qmldirtext
MD5:71D7D495C303E56EC10F6D88F3791BA2
SHA256:3C41BB992D227AFC1C613A4FEDC127121C4BC9703F6398CAC9B08766FD3F63C9
5360st_6c370a0c5a.exeC:\Program Files (x86)\FunPlus\Stormshot\Plugin\7z.21.07\Far\far7z.txttext
MD5:E1FA666BC582130D4700A3FA7EA77A2B
SHA256:6F464CF2417FE86D88634A3BE72060B26B4CE695B9BF60E46B1D8FCE8835B2E5
5360st_6c370a0c5a.exeC:\Program Files (x86)\FunPlus\Stormshot\1.0.0.96\QtQml\RemoteObjects\qmldirtext
MD5:A1EDA6630C96C80E8FA7E8D870DF7516
SHA256:46B7932B643C11FC40268BAEDC58004A70F1135C50CDE5D4BC2B7841864FBC12
5360st_6c370a0c5a.exeC:\Program Files (x86)\FunPlus\Stormshot\1.0.0.96\QtQuick.2\qmldirtext
MD5:D2CF96786CE59E93A2FEB2178603A27F
SHA256:B6F63056ADE6925AA070D3B2BD4133D26E80DF4EA2719E81AD90027E19661AE8
5360st_6c370a0c5a.exeC:\Program Files (x86)\FunPlus\Stormshot\1.0.0.96\QtQml\Models.2\qmldirtext
MD5:C6D831AD43AFA82977D838183DE61CD2
SHA256:62F50F9B9AE3B9E6628DD2660B18D326C41794586E0D76B2E40F6FA4B182E0A7
5360st_6c370a0c5a.exeC:\Program Files (x86)\FunPlus\Stormshot\1.0.0.96\fpx_config_pctext
MD5:1AA7531D47B56ABD7855F18B316C5053
SHA256:80DDBBC093AAEABA141BE65A4AF592A94EB77F8BBEB39652A5BA70851EE6BC9B
7020BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:A83800B4A873256E5858541869FA4C4C
SHA256:B4719770739F4DA95A310D0F3B0AD4BE41E73F997E432BE8D57373B95A6762E0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
44
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.199:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7384
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7020
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7936
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7936
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.199:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7192
Stormshot.PC.V1.0_6c370a0c5a.exe
50.112.61.78:443
kg-logagent-st.kingsgroupgames.com
AMAZON-02
US
unknown
7192
Stormshot.PC.V1.0_6c370a0c5a.exe
2.16.10.176:443
userplatform-download.akamaized.net
Akamai International B.V.
AT
whitelisted
2112
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 2.16.168.199
  • 2.16.168.200
whitelisted
kg-logagent-st.kingsgroupgames.com
  • 50.112.61.78
  • 54.200.9.113
unknown
userplatform-download.akamaized.net
  • 2.16.10.176
  • 2.16.10.167
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.4
  • 20.190.159.130
  • 20.190.159.71
  • 40.126.31.3
  • 20.190.159.131
  • 20.190.159.128
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
www.bing.com
  • 104.126.37.153
  • 104.126.37.163
  • 104.126.37.177
  • 104.126.37.176
  • 104.126.37.162
  • 104.126.37.145
  • 104.126.37.171
  • 104.126.37.160
  • 104.126.37.144
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Stormshot.PC.V1.0_6c370a0c5a.exe