File name:

WinDirStat-x64 (2).msi

Full analysis: https://app.any.run/tasks/b4c56b0d-4c2e-403e-9c0a-ba41a8f79bb0
Verdict: Malicious activity
Analysis date: July 21, 2025, 15:38:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: WinDirStat, Author: WinDirStat Team, Keywords: Installer, Comments: WinDirStat 2.2.2 (x64), Template: x64;1033, Revision Number: {9EBE4D37-CA39-4030-BC42-D113938DEAE5}, Create Time/Date: Fri Jan 17 23:11:20 2025, Last Saved Time/Date: Fri Jan 17 23:11:20 2025, Number of Pages: 500, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
MD5:

1CF2DDBA0D045BC053529B2759AAF8C8

SHA1:

EA0A5AF18F008EE7DDE34C2A1CF8F625A3FBF165

SHA256:

029CC7158D5E2D475243B36AE207921D8205C1296E24C2CAB13F142AEFBA473D

SSDEEP:

98304:VZNtuX4x5tWLbdOHooP5x6ZVyeM+LNFfh4l3kOBXDomY7hQi9VKlJyTFQPLLcdGO:m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 1644)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 700)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 700)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6388)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 1644)

    • Kill processes via PowerShell

      • powershell.exe (PID: 700)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 1644)

    • The process hides Powershell's copyright startup banner

      • msiexec.exe (PID: 1644)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 700)

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 700)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 1644)

    • Manipulates environment variables

      • powershell.exe (PID: 700)

    • Get information on the list of running processes

      • msiexec.exe (PID: 1644)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 1644)

    • Removes files via Powershell

      • powershell.exe (PID: 700)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 1644)
      • msiexec.exe (PID: 4528)
      • WinDirStat.exe (PID: 3100)

    • Checks proxy server information

      • msiexec.exe (PID: 6232)

    • An automatically generated document

      • msiexec.exe (PID: 6232)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6232)

    • Reads the software policy settings

      • msiexec.exe (PID: 6232)
      • msiexec.exe (PID: 1644)
      • powershell.exe (PID: 700)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6232)

    • Reads the computer name

      • msiexec.exe (PID: 1644)
      • msiexec.exe (PID: 4528)
      • WinDirStat.exe (PID: 3100)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6232)
      • msiexec.exe (PID: 1644)

    • Manages system restore points

      • SrTasks.exe (PID: 4544)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 1644)

    • Returns all items recursively from all subfolders (POWERSHELL)

      • powershell.exe (PID: 700)

    • Returns hidden items found within a container (POWERSHELL)

      • powershell.exe (PID: 700)
      • conhost.exe (PID: 4456)

    • Create files in a temporary directory

      • powershell.exe (PID: 700)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1644)

    • Manual execution by a user

      • WinDirStat.exe (PID: 3100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: WinDirStat
Author: WinDirStat Team
Keywords: Installer
Comments: WinDirStat 2.2.2 (x64)
Template: x64;1033
RevisionNumber: {9EBE4D37-CA39-4030-BC42-D113938DEAE5}
CreateDate: 2025:01:17 23:11:20
ModifyDate: 2025:01:17 23:11:20
Pages: 500
Words: 2
Software: Windows Installer XML Toolset (3.14.1.8722)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe windirstat.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
700POWERSHELL -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& { $ErrorActionPreference = 'SilentlyContinue' Get-Process 'WinDirStat*' | Stop-Process -Force $Keys = @() $Keys += Get-ChildItem 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinDirStat' $Keys += Get-ChildItem 'Registry::HKEY_USERS\*\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinDirStat' ForEach ($Key in $Keys) { $Path = $Key.GetValue('InstallLocation') If (-not (Test-Path ($Path + '\*'))) { Continue } Remove-Item -Path ($Path + '\wdsh*.chm') -Force Remove-Item -Path ($Path + '\wdsr*.dll') -Force Remove-Item -Path ($Path + '\WinDirStat*.*') -Force Remove-Item -Path ($Path + '\Uninstall.exe') -Force If (-not (Test-Path ($Path + '\*'))) { Remove-Item -Path $Path -Force } Remove-Item -Path $Key.PSPath -Force } Remove-Item -Path ($env:SystemDrive + '\Users\*\Desktop\WinDirStat.lnk') -Force Remove-Item -Path ($env:SystemDrive + '\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinDirStat') -Force -Recurse Remove-Item -Path ($env:ProgramData + '\Microsoft\Windows\Start Menu\Programs\WinDirStat') -Force -Recurse }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1644C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3100"C:\Program Files\WinDirStat\WinDirStat.exe" C:\Program Files\WinDirStat\WinDirStat.exe—explorer.exe
User:
admin
Company:
WinDirStat Team
Integrity Level:
MEDIUM
Description:
Windows Directory Statistics (WinDirStat)
Version:
2.2.2.1041
Modules
Images
c:\program files\windirstat\windirstat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3608C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe
powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4528C:\Windows\syswow64\MsiExec.exe -Embedding F1BAE75F62AE56690FEE2AE9900F11FC CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4544C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6232"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\WinDirStat-x64 (2).msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6388C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
14 578
Read events
14 308
Write events
253
Delete events
17

Modification events

(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000006FCE877D55FADB016C06000064100000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000006FCE877D55FADB016C06000064100000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000006FCE877D55FADB016C06000064100000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000005292CA7D55FADB016C060000BC150000E803000001000000000000000000000051919746AC10574DA2E22AB77A68F98D00000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000002415F7D55FADB016C06000064100000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000007EA4617D55FADB016C06000064100000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000037F88E7D55FADB016C06000064100000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000D52CC87D55FADB016C06000064100000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6388) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
Executable files
4
Suspicious files
16
Text files
3
Unknown types
15

Dropped files

PID
Process
Filename
Type
1644msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6232msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\856FDBDDFEAC90A3D62D621EBF196637der
MD5:E4AF6DEBFB86571BCBFBCEE68DABA556
SHA256:13943EB10C5A474E425C87DF08683D23444349344F48F66D2AC12768D28C93B4
6232msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061der
MD5:C2537D6B314FB6BF50459F071372CF76
SHA256:D732A92AE90450E9B32DACB3D67E11BCA205BCE9CAA44E8895A0CFE780A82597
6232msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061binary
MD5:2421E6E1DBCDA98398D6E944FE10D40A
SHA256:6C3D55151A28FA02CF1DBE367AF423A82A4F73BF613A159A415049BB1FD643C2
6232msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4binary
MD5:36E03AAEDF64F0170042EC9DF3BB4E1D
SHA256:CA9F9FB76AF895DAA194F9BBAF8F1193401267B05746E20271C9759A4057CE2B
1644msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:B70F3793AF3D07704997265F0F53A524
SHA256:27DF393DD78D3072BF7EF1A6EA2D983EEB8A3669727BC29622B9C1093845B330
6232msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_9C2BA0D68BBB93342E457B5FC2988A9Fder
MD5:0A692E3FF09D331314497837382B5288
SHA256:B1F93AAE3D5A80C06F9FA3E242ACA57778C20AEC77E94AF5847BF1D18F229D78
6232msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIE327.tmpexecutable
MD5:CFBB8568BD3711A97E6124C56FCFA8D9
SHA256:7F47D98AB25CFEA9B3A2E898C3376CC9BA1CD893B4948B0C27CAA530FD0E34CC
6232msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\856FDBDDFEAC90A3D62D621EBF196637binary
MD5:7976D315EAAC1556D86C1B8F2F798E1E
SHA256:C60B33EAE84E7FB710FF5E78B70179748A6EA0665899CE73DC7C417E298737E3
6232msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E4160FB650E5091C535216313A4ECD3_9C2BA0D68BBB93342E457B5FC2988A9Fbinary
MD5:D3A1B4B1E5AC6FE413939B1C3D0B9E4B
SHA256:4422EE9D3767483B3DCA3A798EF468A17CF96F7807DA640A436AE54F7910AD3B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
37
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6232
msiexec.exe
GET
200
23.50.131.150:80
http://subca.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEBu1jyUq3yMASSjJrj1%2B7Sc%3D
unknown
—
—
whitelisted
6232
msiexec.exe
GET
200
23.50.131.150:80
http://subca.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEBu1jyUq3yMASSjJrj1%2B7Sc%3D
unknown
—
—
whitelisted
6232
msiexec.exe
GET
200
23.50.131.160:80
http://crl.certum.pl/ctnca.crl
unknown
—
—
whitelisted
6232
msiexec.exe
GET
200
23.50.131.150:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRIH1V64SBkA%2BzJQVQ6VFBAcvLB3wQUtqFUOQLDoD%2BOirz61PgcptE6Dv0CEQCZo4AKJlU7ZavcboSms%2Bo5
unknown
—
—
whitelisted
6232
msiexec.exe
GET
200
23.50.131.132:80
http://ccsca2021.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRxypYNH69rICCzQBIRXN0YAFa3AAQU3XRdTADbe5%2BgdMqxbvc8wDLAcM0CEAGRWQdNOfHYTFKn1pQEANY%3D
unknown
—
—
unknown
5724
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4708
SIHClient.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4708
SIHClient.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4456
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6232
msiexec.exe
23.50.131.150:80
subca.ocsp-certum.com
Akamai International B.V.
DE
suspicious
6232
msiexec.exe
23.50.131.160:80
crl.certum.pl
Akamai International B.V.
DE
whitelisted
6232
msiexec.exe
23.50.131.132:80
subca.ocsp-certum.com
Akamai International B.V.
DE
suspicious
4
System
192.168.100.255:138
—
—
—
whitelisted
5724
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5724
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
subca.ocsp-certum.com
  • 23.50.131.150
  • 23.50.131.132
whitelisted
crl.certum.pl
  • 23.50.131.160
  • 23.50.131.148
whitelisted
ccsca2021.ocsp-certum.com
  • 23.50.131.132
  • 23.50.131.150
unknown
login.live.com
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.68
  • 40.126.31.2
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.0
  • 40.126.31.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.35
  • 23.216.77.22
  • 23.216.77.18
  • 23.216.77.20
  • 23.216.77.6
  • 23.216.77.37
  • 23.216.77.8
  • 23.216.77.41
whitelisted
www.microsoft.com
  • 23.32.97.216
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinDirStat-x64 (2).msi