File name:

WinDirStat-x64.msi

Full analysis: https://app.any.run/tasks/f5c336ae-526e-4e04-a574-2b53dbc10d1f
Verdict: Malicious activity
Threats:

Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes.

Malware Trends Tracker     >>>
Analysis date: June 04, 2025, 19:49:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
rhadamanthys
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: WinDirStat, Author: WinDirStat Team, Keywords: Installer, Comments: WinDirStat 2.2.2 (x64), Template: x64;1033, Revision Number: {9EBE4D37-CA39-4030-BC42-D113938DEAE5}, Create Time/Date: Fri Jan 17 23:11:20 2025, Last Saved Time/Date: Fri Jan 17 23:11:20 2025, Number of Pages: 500, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
MD5:

1CF2DDBA0D045BC053529B2759AAF8C8

SHA1:

EA0A5AF18F008EE7DDE34C2A1CF8F625A3FBF165

SHA256:

029CC7158D5E2D475243B36AE207921D8205C1296E24C2CAB13F142AEFBA473D

SSDEEP:

98304:VZNtuX4x5tWLbdOHooP5x6ZVyeM+LNFfh4l3kOBXDomY7hQi9VKlJyTFQPLLcdGO:m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2384)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2384)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 6032)

    • RHADAMANTHYS has been detected (YARA)

      • WinDirStat.exe (PID: 2416)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 1244)

    • Removes files via Powershell

      • powershell.exe (PID: 2384)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 2384)

    • The process hides Powershell's copyright startup banner

      • msiexec.exe (PID: 6032)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 6032)

    • Get information on the list of running processes

      • msiexec.exe (PID: 6032)

    • Manipulates environment variables

      • powershell.exe (PID: 2384)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 6032)

    • There is functionality for taking screenshot (YARA)

      • WinDirStat.exe (PID: 6660)

    • Kill processes via PowerShell

      • powershell.exe (PID: 2384)

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 2384)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 6032)

  • INFO

    • An automatically generated document

      • msiexec.exe (PID: 7320)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7320)

    • Checks supported languages

      • msiexec.exe (PID: 6032)
      • msiexec.exe (PID: 5228)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7320)

    • Reads the computer name

      • msiexec.exe (PID: 5228)
      • msiexec.exe (PID: 6032)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7320)
      • msiexec.exe (PID: 6032)

    • Checks proxy server information

      • msiexec.exe (PID: 7320)

    • Reads the software policy settings

      • msiexec.exe (PID: 7320)

    • Manages system restore points

      • SrTasks.exe (PID: 3760)

    • Returns hidden items found within a container (POWERSHELL)

      • powershell.exe (PID: 2384)

    • Returns all items recursively from all subfolders (POWERSHELL)

      • powershell.exe (PID: 2384)

    • Manual execution by a user

      • WinDirStat.exe (PID: 6660)
      • WinDirStat.exe (PID: 2416)
      • WinDirStat.exe (PID: 8088)
      • WinDirStat.exe (PID: 5232)
      • WinDirStat.exe (PID: 7036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: WinDirStat
Author: WinDirStat Team
Keywords: Installer
Comments: WinDirStat 2.2.2 (x64)
Template: x64;1033
RevisionNumber: {9EBE4D37-CA39-4030-BC42-D113938DEAE5}
CreateDate: 2025:01:17 23:11:20
ModifyDate: 2025:01:17 23:11:20
Pages: 500
Words: 2
Software: Windows Installer XML Toolset (3.14.1.8722)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe sppextcomobj.exe no specs slui.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe windirstat.exe no specs slui.exe windirstat.exe no specs windirstat.exe no specs #RHADAMANTHYS windirstat.exe no specs windirstat.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1244C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe
powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2384POWERSHELL -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& { $ErrorActionPreference = 'SilentlyContinue' Get-Process 'WinDirStat*' | Stop-Process -Force $Keys = @() $Keys += Get-ChildItem 'Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinDirStat' $Keys += Get-ChildItem 'Registry::HKEY_USERS\*\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinDirStat' ForEach ($Key in $Keys) { $Path = $Key.GetValue('InstallLocation') If (-not (Test-Path ($Path + '\*'))) { Continue } Remove-Item -Path ($Path + '\wdsh*.chm') -Force Remove-Item -Path ($Path + '\wdsr*.dll') -Force Remove-Item -Path ($Path + '\WinDirStat*.*') -Force Remove-Item -Path ($Path + '\Uninstall.exe') -Force If (-not (Test-Path ($Path + '\*'))) { Remove-Item -Path $Path -Force } Remove-Item -Path $Key.PSPath -Force } Remove-Item -Path ($env:SystemDrive + '\Users\*\Desktop\WinDirStat.lnk') -Force Remove-Item -Path ($env:SystemDrive + '\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinDirStat') -Force -Recurse Remove-Item -Path ($env:ProgramData + '\Microsoft\Windows\Start Menu\Programs\WinDirStat') -Force -Recurse }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
2416"C:\Program Files\WinDirStat\WinDirStat.exe" C:\Program Files\WinDirStat\WinDirStat.exe
explorer.exe
User:
admin
Company:
WinDirStat Team
Integrity Level:
MEDIUM
Description:
Windows Directory Statistics (WinDirStat)
Exit code:
0
Version:
2.2.2.1041
Modules
Images
c:\program files\windirstat\windirstat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2924"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\wincorlib.dll
3760C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5024C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5228C:\Windows\syswow64\MsiExec.exe -Embedding AED22C8087A5576E9E7F50C178C22D37 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5232"C:\Program Files\WinDirStat\WinDirStat.exe" C:\Program Files\WinDirStat\WinDirStat.exe—explorer.exe
User:
admin
Company:
WinDirStat Team
Integrity Level:
MEDIUM
Description:
Windows Directory Statistics (WinDirStat)
Exit code:
0
Version:
2.2.2.1041
Modules
Images
c:\program files\windirstat\windirstat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
29 474
Read events
28 151
Write events
1 300
Delete events
23

Modification events

(PID) Process:(6032) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000006A9545D389D5DB01901700007C130000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6032) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000006A9545D389D5DB01901700007C130000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6032) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000C42E62D389D5DB01901700007C130000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6032) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000C42E62D389D5DB01901700007C130000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6032) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000C42E62D389D5DB01901700007C130000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6032) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000F7F466D389D5DB01901700007C130000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6032) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6032) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000E157A7D389D5DB019017000038190000E8030000010000000000000000000000C2B8899E08DAB44AAD1F784582A9052E00000000000000000000000000000000
(PID) Process:(6032) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000AFF2A4D389D5DB01901700007C130000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1244) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000F43AB3D389D5DB01DC04000060100000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
4
Suspicious files
58
Text files
148
Unknown types
24

Dropped files

PID
Process
Filename
Type
6032msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
7320msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_9C2BA0D68BBB93342E457B5FC2988A9Fder
MD5:D642FC9736CAD1C54713300DF9766079
SHA256:C670AADDCFE428701E642D045E80BD4170362AA460E9E8FA234CBAE7E2075826
7320msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061der
MD5:437BB14D098CA32D4FB1BEDD4D82AC59
SHA256:CB2665E00B4EA4642FE7796A59A610C170DFFCE950AE20B72DF128BBBA55F40F
7320msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061binary
MD5:CD5BF484225280D4A9CFAF9016038CCA
SHA256:62126EF96FBAC3A61E333115263AAC18FB1FD13DB95D5FE0DF69DC5A925D588C
6032msiexec.exeC:\Windows\Installer\125750.msiexecutable
MD5:1CF2DDBA0D045BC053529B2759AAF8C8
SHA256:029CC7158D5E2D475243B36AE207921D8205C1296E24C2CAB13F142AEFBA473D
7320msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4der
MD5:B7DD76393E0DCB7537309E17A5F0508A
SHA256:31D224205104D099033ADC56B9A1D0988AD0E40C015EEE420501429BAFDF02D9
6032msiexec.exeC:\Windows\Temp\~DF0318F8356D8EE875.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
7320msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI19D9.tmpexecutable
MD5:CFBB8568BD3711A97E6124C56FCFA8D9
SHA256:7F47D98AB25CFEA9B3A2E898C3376CC9BA1CD893B4948B0C27CAA530FD0E34CC
7320msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4binary
MD5:47AC18A5B0BC3E65B3F391965AF4848F
SHA256:6BE23D5F30F5E049D3C3331080E25C5F7546AD2ABE4C627AEE4A9001A488B9B7
6032msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:A7980AC5C6922F51609180E490348148
SHA256:7510D0CBB1D8B1FF300E220D69DC47CA0F9EE707AFBB1A439F6FCDEE63C029F8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
66
DNS requests
37
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7320
msiexec.exe
GET
200
2.21.239.21:80
http://subca.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEBu1jyUq3yMASSjJrj1%2B7Sc%3D
unknown
—
—
whitelisted
7320
msiexec.exe
GET
200
2.21.239.9:80
http://crl.certum.pl/ctnca.crl
unknown
—
—
whitelisted
7320
msiexec.exe
GET
200
2.21.239.27:80
http://ccsca2021.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRxypYNH69rICCzQBIRXN0YAFa3AAQU3XRdTADbe5%2BgdMqxbvc8wDLAcM0CEAGRWQdNOfHYTFKn1pQEANY%3D
unknown
—
—
unknown
7320
msiexec.exe
GET
200
2.21.239.21:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRIH1V64SBkA%2BzJQVQ6VFBAcvLB3wQUtqFUOQLDoD%2BOirz61PgcptE6Dv0CEQCZo4AKJlU7ZavcboSms%2Bo5
unknown
—
—
whitelisted
8128
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8128
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6544
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
7320
msiexec.exe
2.21.239.21:80
subca.ocsp-certum.com
AKAMAI-AS
TR
suspicious
7320
msiexec.exe
2.21.239.9:80
crl.certum.pl
AKAMAI-AS
TR
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7320
msiexec.exe
2.21.239.27:80
subca.ocsp-certum.com
AKAMAI-AS
TR
suspicious
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 40.126.32.134
  • 20.190.160.67
  • 20.190.160.66
  • 20.190.160.14
  • 40.126.32.136
  • 20.190.160.20
  • 40.126.32.133
  • 20.190.160.22
whitelisted
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
subca.ocsp-certum.com
  • 2.21.239.21
  • 2.21.239.27
whitelisted
crl.certum.pl
  • 2.21.239.9
  • 2.21.239.23
whitelisted
ccsca2021.ocsp-certum.com
  • 2.21.239.27
  • 2.21.239.21
unknown
ocsp.digicert.com
  • 2.23.77.188
  • 23.54.109.203
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinDirStat-x64.msi