File name:

WinDirStat-x64 (2).msi

Full analysis: https://app.any.run/tasks/b4c56b0d-4c2e-403e-9c0a-ba41a8f79bb0
Verdict: Malicious activity
Analysis date: July 21, 2025, 15:38:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: WinDirStat, Author: WinDirStat Team, Keywords: Installer, Comments: WinDirStat 2.2.2 (x64), Template: x64;1033, Revision Number: {9EBE4D37-CA39-4030-BC42-D113938DEAE5}, Create Time/Date: Fri Jan 17 23:11:20 2025, Last Saved Time/Date: Fri Jan 17 23:11:20 2025, Number of Pages: 500, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
MD5:

1CF2DDBA0D045BC053529B2759AAF8C8

SHA1:

EA0A5AF18F008EE7DDE34C2A1CF8F625A3FBF165

SHA256:

029CC7158D5E2D475243B36AE207921D8205C1296E24C2CAB13F142AEFBA473D

SSDEEP:

98304:VZNtuX4x5tWLbdOHooP5x6ZVyeM+LNFfh4l3kOBXDomY7hQi9VKlJyTFQPLLcdGO:m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 1644)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 700)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 700)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6388)

    • Kill processes via PowerShell

      • powershell.exe (PID: 700)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 1644)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 1644)

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 700)

    • Manipulates environment variables

      • powershell.exe (PID: 700)

    • Get information on the list of running processes

      • msiexec.exe (PID: 1644)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 1644)

    • Removes files via Powershell

      • powershell.exe (PID: 700)

    • The process hides Powershell's copyright startup banner

      • msiexec.exe (PID: 1644)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 700)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 1644)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 1644)
      • msiexec.exe (PID: 4528)
      • WinDirStat.exe (PID: 3100)

    • Reads the software policy settings

      • msiexec.exe (PID: 6232)
      • msiexec.exe (PID: 1644)
      • powershell.exe (PID: 700)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6232)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6232)

    • Reads the computer name

      • msiexec.exe (PID: 1644)
      • msiexec.exe (PID: 4528)
      • WinDirStat.exe (PID: 3100)

    • Checks proxy server information

      • msiexec.exe (PID: 6232)

    • An automatically generated document

      • msiexec.exe (PID: 6232)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6232)
      • msiexec.exe (PID: 1644)

    • Manages system restore points

      • SrTasks.exe (PID: 4544)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 1644)

    • Returns all items recursively from all subfolders (POWERSHELL)

      • powershell.exe (PID: 700)

    • Returns hidden items found within a container (POWERSHELL)

      • powershell.exe (PID: 700)
      • conhost.exe (PID: 4456)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1644)

    • Create files in a temporary directory

      • powershell.exe (PID: 700)

    • Manual execution by a user

      • WinDirStat.exe (PID: 3100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: WinDirStat
Author: WinDirStat Team
Keywords: Installer
Comments: WinDirStat 2.2.2 (x64)
Template: x64;1033
RevisionNumber: {9EBE4D37-CA39-4030-BC42-D113938DEAE5}
CreateDate: 2025:01:17 23:11:20
ModifyDate: 2025:01:17 23:11:20
Pages: 500
Words: 2
Software: Windows Installer XML Toolset (3.14.1.8722)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe windirstat.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
700POWERSHELL -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& { $ErrorActionPreference = 'SilentlyContinue' Get-Process 'WinDirStat*' | Stop-Process -Force $Keys = @() $Keys += Get-ChildItem 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinDirStat' $Keys += Get-ChildItem 'Registry::HKEY_USERS\*\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinDirStat' ForEach ($Key in $Keys) { $Path = $Key.GetValue('InstallLocation') If (-not (Test-Path ($Path + '\*'))) { Continue } Remove-Item -Path ($Path + '\wdsh*.chm') -Force Remove-Item -Path ($Path + '\wdsr*.dll') -Force Remove-Item -Path ($Path + '\WinDirStat*.*') -Force Remove-Item -Path ($Path + '\Uninstall.exe') -Force If (-not (Test-Path ($Path + '\*'))) { Remove-Item -Path $Path -Force } Remove-Item -Path $Key.PSPath -Force } Remove-Item -Path ($env:SystemDrive + '\Users\*\Desktop\WinDirStat.lnk') -Force Remove-Item -Path ($env:SystemDrive + '\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinDirStat') -Force -Recurse Remove-Item -Path ($env:ProgramData + '\Microsoft\Windows\Start Menu\Programs\WinDirStat') -Force -Recurse }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1644C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3100"C:\Program Files\WinDirStat\WinDirStat.exe" C:\Program Files\WinDirStat\WinDirStat.exe—explorer.exe
User:
admin
Company:
WinDirStat Team
Integrity Level:
MEDIUM
Description:
Windows Directory Statistics (WinDirStat)
Version:
2.2.2.1041
Modules
Images
c:\program files\windirstat\windirstat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3608C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe
powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4528C:\Windows\syswow64\MsiExec.exe -Embedding F1BAE75F62AE56690FEE2AE9900F11FC CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4544C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6232"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\WinDirStat-x64 (2).msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6388C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
14 578
Read events
14 308
Write events
253
Delete events
17

Modification events

(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000006FCE877D55FADB016C06000064100000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000006FCE877D55FADB016C06000064100000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000006FCE877D55FADB016C06000064100000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000005292CA7D55FADB016C060000BC150000E803000001000000000000000000000051919746AC10574DA2E22AB77A68F98D00000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000002415F7D55FADB016C06000064100000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000007EA4617D55FADB016C06000064100000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000037F88E7D55FADB016C06000064100000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1644) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000D52CC87D55FADB016C06000064100000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6388) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
Executable files
4
Suspicious files
16
Text files
3
Unknown types
15

Dropped files

PID
Process
Filename
Type
1644msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6232msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4der
MD5:A8068B264896264716D820A8D74C19DD
SHA256:3315646C41EE76E4A29B0012F182A63F6E70493733E011787091CC24C1CB431F
6232msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\856FDBDDFEAC90A3D62D621EBF196637der
MD5:E4AF6DEBFB86571BCBFBCEE68DABA556
SHA256:13943EB10C5A474E425C87DF08683D23444349344F48F66D2AC12768D28C93B4
6232msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061der
MD5:C2537D6B314FB6BF50459F071372CF76
SHA256:D732A92AE90450E9B32DACB3D67E11BCA205BCE9CAA44E8895A0CFE780A82597
1644msiexec.exeC:\Windows\Installer\MSI1C58.tmpbinary
MD5:4DB583DD804840176338DD51026A91CB
SHA256:67F7B3C4AB301C281814C1588EF45ADC50F43B799EBDA3BFF2782705C846C58B
700powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ppt3vp1h.aoo.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1644msiexec.exeC:\Windows\Temp\~DFA236D9CBA4908BAE.TMPbinary
MD5:BA739DC6F30AFED10948865D0EBF5486
SHA256:E2CFB2A80BF79BD3DEEE61483B5719D840B82CDF0CF3CCE86CA09301483498C2
1644msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{46979151-10ac-4d57-a2e2-2ab77a68f98d}_OnDiskSnapshotPropbinary
MD5:B70F3793AF3D07704997265F0F53A524
SHA256:27DF393DD78D3072BF7EF1A6EA2D983EEB8A3669727BC29622B9C1093845B330
1644msiexec.exeC:\Windows\Installer\1919a8.msiexecutable
MD5:1CF2DDBA0D045BC053529B2759AAF8C8
SHA256:029CC7158D5E2D475243B36AE207921D8205C1296E24C2CAB13F142AEFBA473D
1644msiexec.exeC:\Windows\Temp\~DFE848591E66F908FB.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
37
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6232
msiexec.exe
GET
200
23.50.131.150:80
http://subca.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEBu1jyUq3yMASSjJrj1%2B7Sc%3D
unknown
—
—
whitelisted
5724
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6232
msiexec.exe
GET
200
23.50.131.160:80
http://crl.certum.pl/ctnca.crl
unknown
—
—
whitelisted
6232
msiexec.exe
GET
200
23.50.131.150:80
http://subca.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEBu1jyUq3yMASSjJrj1%2B7Sc%3D
unknown
—
—
whitelisted
6232
msiexec.exe
GET
200
23.50.131.150:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRIH1V64SBkA%2BzJQVQ6VFBAcvLB3wQUtqFUOQLDoD%2BOirz61PgcptE6Dv0CEQCZo4AKJlU7ZavcboSms%2Bo5
unknown
—
—
whitelisted
6232
msiexec.exe
GET
200
23.50.131.132:80
http://ccsca2021.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRxypYNH69rICCzQBIRXN0YAFa3AAQU3XRdTADbe5%2BgdMqxbvc8wDLAcM0CEAGRWQdNOfHYTFKn1pQEANY%3D
unknown
—
—
unknown
4708
SIHClient.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4708
SIHClient.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4456
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6232
msiexec.exe
23.50.131.150:80
subca.ocsp-certum.com
Akamai International B.V.
DE
suspicious
6232
msiexec.exe
23.50.131.160:80
crl.certum.pl
Akamai International B.V.
DE
whitelisted
6232
msiexec.exe
23.50.131.132:80
subca.ocsp-certum.com
Akamai International B.V.
DE
suspicious
4
System
192.168.100.255:138
—
—
—
whitelisted
5724
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5724
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
subca.ocsp-certum.com
  • 23.50.131.150
  • 23.50.131.132
whitelisted
crl.certum.pl
  • 23.50.131.160
  • 23.50.131.148
whitelisted
ccsca2021.ocsp-certum.com
  • 23.50.131.132
  • 23.50.131.150
unknown
login.live.com
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.68
  • 40.126.31.2
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.0
  • 40.126.31.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.35
  • 23.216.77.22
  • 23.216.77.18
  • 23.216.77.20
  • 23.216.77.6
  • 23.216.77.37
  • 23.216.77.8
  • 23.216.77.41
whitelisted
www.microsoft.com
  • 23.32.97.216
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinDirStat-x64 (2).msi