URL:

https://nanocad.com/products/nanocad-free/download/

Full analysis: https://app.any.run/tasks/f9f91350-1dc7-4da7-a672-3a21b0e400c4
Verdict: Malicious activity
Analysis date: January 19, 2025, 18:22:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MD5:

65B8EAC728DED517C9D8D2DB0FF4C108

SHA1:

17984C4984BE1FB77C6E7447FD30053B0A872AE1

SHA256:

03D3EBA56D749112E606B4B97BBB279C8CFA56F317E9CBB531448F468E8D8B6B

SSDEEP:

3:N8TNLK4aQGRWQooIDQfmn:2pLKRRW0+Q+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • NCE5.0_2547.1471.1167.exe (PID: 6668)
      • vcredist_x86.exe (PID: 1796)
      • TiWorker.exe (PID: 6848)
      • setup.exe (PID: 4716)

    • Process drops legitimate windows executable

      • NCE5.0_2547.1471.1167.exe (PID: 6668)
      • vcredist_x86.exe (PID: 1796)
      • msiexec.exe (PID: 7952)
      • TiWorker.exe (PID: 6848)

    • Starts a Microsoft application from unusual location

      • vcredist_x86.exe (PID: 1796)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 7952)
      • setup.exe (PID: 4716)

    • Creates file in the systems drive root

      • vcredist_x86.exe (PID: 1796)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7952)
      • setup.exe (PID: 4716)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 7952)
      • TiWorker.exe (PID: 6848)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 4716)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 4716)
      • nCad.exe (PID: 7648)

    • Adds/modifies Windows certificates

      • setup.exe (PID: 4716)

    • Searches for installed software

      • setup.exe (PID: 4716)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1572)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 7952)

    • Creates/Modifies COM task schedule object

      • nCad.exe (PID: 7708)

  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 7128)
      • NCE5.0_2547.1471.1167.exe (PID: 6668)
      • setup.exe (PID: 4716)
      • vcredist_x86.exe (PID: 1796)
      • install.exe (PID: 7184)
      • msiexec.exe (PID: 7952)
      • msiexec.exe (PID: 8060)
      • nCad.exe (PID: 7708)
      • msiexec.exe (PID: 6728)
      • msiexec.exe (PID: 7420)
      • RegWizard.exe (PID: 7712)
      • nCad.exe (PID: 7648)
      • RegWizard.exe (PID: 5236)

    • Application launched itself

      • msedge.exe (PID: 6236)

    • The process uses the downloaded file

      • msedge.exe (PID: 7752)
      • msedge.exe (PID: 6236)
      • nCad.exe (PID: 7648)

    • Reads the computer name

      • identity_helper.exe (PID: 7128)
      • NCE5.0_2547.1471.1167.exe (PID: 6668)
      • setup.exe (PID: 4716)
      • vcredist_x86.exe (PID: 1796)
      • install.exe (PID: 7184)
      • msiexec.exe (PID: 7952)
      • msiexec.exe (PID: 8060)
      • msiexec.exe (PID: 6728)
      • msiexec.exe (PID: 7420)
      • nCad.exe (PID: 7708)
      • RegWizard.exe (PID: 7712)
      • nCad.exe (PID: 7648)
      • RegWizard.exe (PID: 5236)

    • Reads Environment values

      • identity_helper.exe (PID: 7128)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 6236)
      • msiexec.exe (PID: 7952)
      • msedge.exe (PID: 5572)

    • Create files in a temporary directory

      • NCE5.0_2547.1471.1167.exe (PID: 6668)
      • setup.exe (PID: 4716)
      • install.exe (PID: 7184)

    • The sample compiled with english language support

      • NCE5.0_2547.1471.1167.exe (PID: 6668)
      • vcredist_x86.exe (PID: 1796)
      • msiexec.exe (PID: 7952)
      • TiWorker.exe (PID: 6848)
      • setup.exe (PID: 4716)
      • msedge.exe (PID: 5572)

    • Reads the machine GUID from the registry

      • vcredist_x86.exe (PID: 1796)
      • msiexec.exe (PID: 7952)
      • setup.exe (PID: 4716)

    • The sample compiled with spanish language support

      • vcredist_x86.exe (PID: 1796)
      • msiexec.exe (PID: 7952)
      • TiWorker.exe (PID: 6848)

    • The sample compiled with japanese language support

      • vcredist_x86.exe (PID: 1796)
      • msiexec.exe (PID: 7952)
      • TiWorker.exe (PID: 6848)

    • The sample compiled with Italian language support

      • vcredist_x86.exe (PID: 1796)
      • msiexec.exe (PID: 7952)
      • TiWorker.exe (PID: 6848)

    • The sample compiled with korean language support

      • vcredist_x86.exe (PID: 1796)
      • msiexec.exe (PID: 7952)
      • TiWorker.exe (PID: 6848)

    • The sample compiled with russian language support

      • vcredist_x86.exe (PID: 1796)
      • msiexec.exe (PID: 7952)
      • TiWorker.exe (PID: 6848)

    • The sample compiled with german language support

      • vcredist_x86.exe (PID: 1796)
      • msiexec.exe (PID: 7952)
      • TiWorker.exe (PID: 6848)

    • The sample compiled with french language support

      • vcredist_x86.exe (PID: 1796)
      • msiexec.exe (PID: 7952)
      • TiWorker.exe (PID: 6848)

    • The sample compiled with chinese language support

      • vcredist_x86.exe (PID: 1796)
      • msiexec.exe (PID: 7952)
      • TiWorker.exe (PID: 6848)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7952)
      • setup.exe (PID: 4716)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7952)

    • Reads the software policy settings

      • msiexec.exe (PID: 7952)
      • setup.exe (PID: 4716)

    • Checks proxy server information

      • setup.exe (PID: 4716)

    • Manages system restore points

      • SrTasks.exe (PID: 7260)

    • Sends debugging messages

      • nCad.exe (PID: 7708)
      • nCad.exe (PID: 7648)

    • Manual execution by a user

      • nCad.exe (PID: 7648)

    • Process checks computer location settings

      • nCad.exe (PID: 7648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
219
Monitored processes
79
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs nce5.0_2547.1471.1167.exe no specs nce5.0_2547.1471.1167.exe rundll32.exe no specs setup.exe vcredist_x86.exe install.exe no specs msiexec.exe tiworker.exe msiexec.exe no specs msedge.exe msedge.exe no specs vssvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs ncad.exe regwizard.exe no specs msedge.exe no specs ncad.exe msedge.exe no specs regwizard.exe no specs regwizard.exe no specs regwizard.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
936"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6524 --field-trial-handle=2312,i,4879752826149373150,13501851320081636478,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1296"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6916 --field-trial-handle=2312,i,4879752826149373150,13501851320081636478,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1296"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=7144 --field-trial-handle=2312,i,4879752826149373150,13501851320081636478,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1348"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7260 --field-trial-handle=2312,i,4879752826149373150,13501851320081636478,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1468"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7684 --field-trial-handle=2312,i,4879752826149373150,13501851320081636478,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=6796 --field-trial-handle=2312,i,4879752826149373150,13501851320081636478,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1540"C:\Program Files (x86)\Nanosoft AS\nanoCAD en 5.0\RegWizard.exe" /oem:"C:\Program Files (x86)\Nanosoft AS\nanoCAD en 5.0\bin\oeminfo.dll" /mtx:"WI_Wait_RegWizard"C:\Program Files (x86)\Nanosoft AS\nanoCAD en 5.0\RegWizard.exe—nCad.exe
User:
admin
Company:
«Nanosoft AS»
Integrity Level:
MEDIUM
Description:
Registration Wizard
Exit code:
3221226540
Version:
1.0.84
1572C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1796"C:\Users\admin\AppData\Local\Temp\7zSC0AD6A65\PreReq\VcRedist2008_x86\vcredist_x86.exe" /QC:\Users\admin\AppData\Local\Temp\7zSC0AD6A65\PreReq\VcRedist2008_x86\vcredist_x86.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2008 Redistributable Setup
Exit code:
0
Version:
9.0.30729.5677
Modules
Images
c:\users\admin\appdata\local\temp\7zsc0ad6a65\prereq\vcredist2008_x86\vcredist_x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2120"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4804 --field-trial-handle=2312,i,4879752826149373150,13501851320081636478,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
24 963
Read events
22 052
Write events
2 803
Delete events
108

Modification events

(PID) Process:(6236) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
A5FACD83A98A2F00
(PID) Process:(6236) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328470
Operation:writeName:WindowTabManagerFileMappingId
Value:
{539AAF8E-2BF8-4824-AD70-503F358549C8}
(PID) Process:(6236) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6236) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6236) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6236) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6236) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
0159C183A98A2F00
(PID) Process:(6236) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328470
Operation:writeName:WindowTabManagerFileMappingId
Value:
{FFE1A099-D13A-4064-854B-99436FE03CFC}
(PID) Process:(6236) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328470
Operation:writeName:WindowTabManagerFileMappingId
Value:
{5EC8BAEC-3194-40BF-AAFA-0005A05B8AF6}
(PID) Process:(6236) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328470
Operation:writeName:WindowTabManagerFileMappingId
Value:
{8C923850-B429-42CF-874E-4C9A2956D042}
Executable files
227
Suspicious files
763
Text files
221
Unknown types
0

Dropped files

PID
Process
Filename
Type
6236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF13543e.TMP —
MD5:—
SHA256:—
6236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF13543e.TMP —
MD5:—
SHA256:—
6236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF13543e.TMP —
MD5:—
SHA256:—
6236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF13544d.TMP —
MD5:—
SHA256:—
6236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
6236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF13547c.TMP —
MD5:—
SHA256:—
6236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
55
TCP/UDP connections
135
DNS requests
133
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3996
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3996
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7680
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7680
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5304
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6ca9004c-2afd-40c0-a9b1-4fec460952e5?P1=1737531593&P2=404&P3=2&P4=ZTljHgZHCyYFHEtpwm77q9rBeXLQOYtT5RaMb0KyhfSjX7rjCVtXRNGgSPYWcueRqb4eqaqEw8nOyivb8k5YBA%3d%3d
unknown
—
—
whitelisted
5304
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6ca9004c-2afd-40c0-a9b1-4fec460952e5?P1=1737531593&P2=404&P3=2&P4=ZTljHgZHCyYFHEtpwm77q9rBeXLQOYtT5RaMb0KyhfSjX7rjCVtXRNGgSPYWcueRqb4eqaqEw8nOyivb8k5YBA%3d%3d
unknown
—
—
whitelisted
5304
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6ca9004c-2afd-40c0-a9b1-4fec460952e5?P1=1737531593&P2=404&P3=2&P4=ZTljHgZHCyYFHEtpwm77q9rBeXLQOYtT5RaMb0KyhfSjX7rjCVtXRNGgSPYWcueRqb4eqaqEw8nOyivb8k5YBA%3d%3d
unknown
—
—
whitelisted
5304
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6ca9004c-2afd-40c0-a9b1-4fec460952e5?P1=1737531593&P2=404&P3=2&P4=ZTljHgZHCyYFHEtpwm77q9rBeXLQOYtT5RaMb0KyhfSjX7rjCVtXRNGgSPYWcueRqb4eqaqEw8nOyivb8k5YBA%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3996
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3996
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6580
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6236
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6580
msedge.exe
34.136.43.167:443
nanocad.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.194
  • 23.48.23.190
  • 23.48.23.173
  • 23.48.23.162
  • 23.48.23.159
  • 23.48.23.169
  • 23.48.23.183
  • 23.48.23.167
  • 23.48.23.181
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
nanocad.com
  • 34.136.43.167
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
bzib.nelreports.net
  • 2.16.168.107
  • 2.16.168.113
whitelisted

Threats

No threats detected
Process
Message
nCad.exe
NCAuto.dll(CSDllRegisterServer) started with
nCad.exe
C:\Program Files (x86)\Nanosoft AS\nanoCAD en 5.0\nCad.exe
nCad.exe
nCad.exe
NCAuto.dll(CSDllRegisterServer) is finished 0x00000000
nCad.exe
NCAuto.dll(CSDllRegisterServer) started with
nCad.exe
C:\Program Files (x86)\Nanosoft AS\nanoCAD en 5.0\nCad.exe
nCad.exe
nCad.exe
NCAuto.dll(CSDllRegisterServer) is finished 0x00000000
nCad.exe
MT process attach
nCad.exe
MCGEL.DLL process attach
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://nanocad.com/products/nanocad-free/download/