File name:

Stormshot.PC.V1.0_6c370a0c5a.exe

Full analysis: https://app.any.run/tasks/5941363d-1fbb-4a5a-ab15-14270e0d26fb
Verdict: Malicious activity
Analysis date: March 20, 2025, 19:19:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
antivm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

6AAE47CBAA4C56095A1EB0422C1D2ECB

SHA1:

34E29D1801D270A2BD7AC02D4EA84C14C553D66F

SHA256:

FFD63FE2AEAA91F05BEF47B3583290CCDBA3F44912AB8B67044F3D58BF817EBF

SSDEEP:

98304:5qXfKQQqTpl6ykKzUczpKnUOsGMG7F/1jzzXcVNbgtgz9GMGevZ7DTQ4H:DrzZtE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • PC-Launcher.exe (PID: 7400)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • st_6c370a0c5a.exe (PID: 5360)
      • 7za.exe (PID: 6388)

    • Drops 7-zip archiver for unpacking

      • st_6c370a0c5a.exe (PID: 5360)

    • Process drops legitimate windows executable

      • st_6c370a0c5a.exe (PID: 5360)
      • 7za.exe (PID: 6388)

    • The process drops C-runtime libraries

      • st_6c370a0c5a.exe (PID: 5360)
      • 7za.exe (PID: 6388)

    • Creates a software uninstall entry

      • st_6c370a0c5a.exe (PID: 5360)

    • The process checks if it is being run in the virtual environment

      • PC-Launcher.exe (PID: 7400)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 7232)

    • There is functionality for taking screenshot (YARA)

      • PC-Launcher.exe (PID: 7400)

    • The process creates files with name similar to system file names

      • 7za.exe (PID: 6388)

    • There is functionality for VM detection antiVM strings (YARA)

      • PC-Launcher.exe (PID: 7400)

  • INFO

    • Reads CPU info

      • Stormshot.PC.V1.0_6c370a0c5a.exe (PID: 7192)
      • PC-Launcher.exe (PID: 7400)

    • Reads the machine GUID from the registry

      • Stormshot.PC.V1.0_6c370a0c5a.exe (PID: 7192)
      • PC-Launcher.exe (PID: 7400)

    • Reads the computer name

      • Stormshot.PC.V1.0_6c370a0c5a.exe (PID: 7192)
      • st_6c370a0c5a.exe (PID: 5360)
      • PC-Launcher.exe (PID: 7400)
      • 7za.exe (PID: 6388)
      • ShellExperienceHost.exe (PID: 7232)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7020)
      • slui.exe (PID: 7280)
      • slui.exe (PID: 5728)

    • Checks supported languages

      • Stormshot.PC.V1.0_6c370a0c5a.exe (PID: 7192)
      • st_6c370a0c5a.exe (PID: 5360)
      • Launcher.exe (PID: 1072)
      • PC-Launcher.exe (PID: 7400)
      • 7za.exe (PID: 6388)
      • ShellExperienceHost.exe (PID: 7232)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7020)
      • PC-Launcher.exe (PID: 7400)
      • slui.exe (PID: 5728)

    • Create files in a temporary directory

      • Stormshot.PC.V1.0_6c370a0c5a.exe (PID: 7192)
      • PC-Launcher.exe (PID: 7400)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7020)
      • PC-Launcher.exe (PID: 7400)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7020)
      • BackgroundTransferHost.exe (PID: 8016)
      • BackgroundTransferHost.exe (PID: 2088)
      • BackgroundTransferHost.exe (PID: 7640)
      • BackgroundTransferHost.exe (PID: 7180)

    • Creates files in the program directory

      • st_6c370a0c5a.exe (PID: 5360)
      • PC-Launcher.exe (PID: 7400)
      • 7za.exe (PID: 6388)

    • The sample compiled with english language support

      • st_6c370a0c5a.exe (PID: 5360)
      • 7za.exe (PID: 6388)

    • The sample compiled with chinese language support

      • st_6c370a0c5a.exe (PID: 5360)
      • 7za.exe (PID: 6388)

    • Qt framework related mutex has been found

      • PC-Launcher.exe (PID: 7400)

    • Autorun file from Registry key

      • PC-Launcher.exe (PID: 7400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:06:12 11:20:51+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.29
CodeSize: 1302016
InitializedDataSize: 1638912
UninitializedDataSize: -
EntryPoint: 0x11272c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
16
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start stormshot.pc.v1.0_6c370a0c5a.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs st_6c370a0c5a.exe launcher.exe no specs pc-launcher.exe slui.exe shellexperiencehost.exe no specs 7za.exe conhost.exe no specs stormshot.pc.v1.0_6c370a0c5a.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904"C:\Users\admin\AppData\Local\Temp\Stormshot.PC.V1.0_6c370a0c5a.exe" C:\Users\admin\AppData\Local\Temp\Stormshot.PC.V1.0_6c370a0c5a.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\stormshot.pc.v1.0_6c370a0c5a.exe
c:\windows\system32\ntdll.dll
1072"C:\Program Files (x86)\FunPlus\Stormshot\Launcher.exe" C:\Program Files (x86)\FunPlus\Stormshot\Launcher.exe—st_6c370a0c5a.exe
User:
admin
Company:
FunPlus, Inc.
Integrity Level:
HIGH
Description:
Stormshot
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files (x86)\funplus\stormshot\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2088"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5360C:\Users\admin\AppData\Local\Temp\st_6c370a0c5a.exeC:\Users\admin\AppData\Local\Temp\st_6c370a0c5a.exe
Stormshot.PC.V1.0_6c370a0c5a.exe
User:
admin
Company:
FunPlus, Inc.
Integrity Level:
HIGH
Description:
Stormshot
Exit code:
0
Version:
1, 0, 0, 96
Modules
Images
c:\users\admin\appdata\local\temp\st_6c370a0c5a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5728C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6388"C:\Program Files (x86)\FunPlus\Stormshot\Plugin\7z.21.07\7za.exe" x -aoa -bsp2 -bse1 -bso0 "C:/Program Files (x86)/FunPlus/Stormshot/download/ngame/st_global_4.14.100_d098299069082dbc704f09cec410bc63.7z" "-oC:/Program Files (x86)/FunPlus/Stormshot/nGame/4.14.100"C:\Program Files (x86)\FunPlus\Stormshot\Plugin\7z.21.07\7za.exe
PC-Launcher.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Version:
23.01
Modules
Images
c:\program files (x86)\funplus\stormshot\plugin\7z.21.07\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7020"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7180"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7192"C:\Users\admin\AppData\Local\Temp\Stormshot.PC.V1.0_6c370a0c5a.exe" C:\Users\admin\AppData\Local\Temp\Stormshot.PC.V1.0_6c370a0c5a.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stormshot.pc.v1.0_6c370a0c5a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7232"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
Total events
6 276
Read events
6 249
Write events
27
Delete events
0

Modification events

(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2088) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2088) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2088) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7180) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
182
Suspicious files
1 928
Text files
106
Unknown types
0

Dropped files

PID
Process
Filename
Type
7020BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\a9f59ca7-3154-449b-8ed8-7e126d0bcc35.down_data —
MD5:—
SHA256:—
7192Stormshot.PC.V1.0_6c370a0c5a.exeC:\Users\admin\AppData\Local\Temp\st_tmp.dl —
MD5:—
SHA256:—
7192Stormshot.PC.V1.0_6c370a0c5a.exeC:\Users\admin\AppData\Local\Temp\st_6c370a0c5a.exe —
MD5:—
SHA256:—
7020BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\a9f59ca7-3154-449b-8ed8-7e126d0bcc35.335ac4f0-c986-407b-a01f-33f8a77d31f2.down_metabinary
MD5:DC24E548AC04ADAA28492B10AC4870B2
SHA256:ACE2223A47D441EB9D16778ED1EDFA044895465FBC97CB2F7BCA6C7B130B284A
5360st_6c370a0c5a.exeC:\Program Files (x86)\FunPlus\Stormshot\1.0.0.96\QtQml\StateMachine\qmldirtext
MD5:48521EF985C2D6D22D0EFB27B732455D
SHA256:5344415B19287C163B3031BB07A2FCE8CC16F8D0715682BF803D497D0557F9DE
7020BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4f589d79-fd72-4945-a11c-a57fab400930.335ac4f0-c986-407b-a01f-33f8a77d31f2.down_metabinary
MD5:DC24E548AC04ADAA28492B10AC4870B2
SHA256:ACE2223A47D441EB9D16778ED1EDFA044895465FBC97CB2F7BCA6C7B130B284A
7020BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4f589d79-fd72-4945-a11c-a57fab400930.up_meta_securebinary
MD5:A068A529733EE8C021D37A2A27A56E84
SHA256:E89F50EEE70328CB5C2D304B7037D539710BCC27DCF75C3A865AA00A69880F8D
5360st_6c370a0c5a.exeC:\Program Files (x86)\FunPlus\Stormshot\1.0.0.96\QtQuick\Timeline\qmldirtext
MD5:8610059F5530F0E4B2111A2E1596DB94
SHA256:50E526690F8C397D9136436A1B44F1D93AE0363F5DABAB98481B8788E42ADD13
5360st_6c370a0c5a.exeC:\Program Files (x86)\FunPlus\Stormshot\1.0.0.96\QtQml\Models.2\qmldirtext
MD5:C6D831AD43AFA82977D838183DE61CD2
SHA256:62F50F9B9AE3B9E6628DD2660B18D326C41794586E0D76B2E40F6FA4B182E0A7
5360st_6c370a0c5a.exeC:\Program Files (x86)\FunPlus\Stormshot\1.0.0.96\QtQml\WorkerScript.2\qmldirtext
MD5:71D7D495C303E56EC10F6D88F3791BA2
SHA256:3C41BB992D227AFC1C613A4FEDC127121C4BC9703F6398CAC9B08766FD3F63C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
44
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7384
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.199:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7020
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7936
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7936
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.199:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7192
Stormshot.PC.V1.0_6c370a0c5a.exe
50.112.61.78:443
kg-logagent-st.kingsgroupgames.com
AMAZON-02
US
unknown
7192
Stormshot.PC.V1.0_6c370a0c5a.exe
2.16.10.176:443
userplatform-download.akamaized.net
Akamai International B.V.
AT
whitelisted
2112
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 2.16.168.199
  • 2.16.168.200
whitelisted
kg-logagent-st.kingsgroupgames.com
  • 50.112.61.78
  • 54.200.9.113
unknown
userplatform-download.akamaized.net
  • 2.16.10.176
  • 2.16.10.167
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.4
  • 20.190.159.130
  • 20.190.159.71
  • 40.126.31.3
  • 20.190.159.131
  • 20.190.159.128
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
www.bing.com
  • 104.126.37.153
  • 104.126.37.163
  • 104.126.37.177
  • 104.126.37.176
  • 104.126.37.162
  • 104.126.37.145
  • 104.126.37.171
  • 104.126.37.160
  • 104.126.37.144
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Stormshot.PC.V1.0_6c370a0c5a.exe