File name:

ConnectifyInstaller.exe

Full analysis: https://app.any.run/tasks/7f48bd88-95d7-4d8f-bfa7-8be74e0e911a
Verdict: Malicious activity
Analysis date: January 30, 2025, 20:05:05
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

989B701CFD666960D48F9A3019FE1020

SHA1:

A9F316DD441F586CE7625136EFCB823F0E1DC885

SHA256:

0D7350DAB6CA9F9A575F53238732BAB013AA7912F6F31062BA448E2EF8A42A81

SSDEEP:

196608:jpN8uNvGR2PPBQGD/w4uqY0FCZyoKIJWXiY4Ugk1d7C6Uo26pOziO2jlt:jw5wxJ/wHCboKIJVV4mno2jiht

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • ConnectifyInstaller.exe (PID: 6824)
      • GlobalAtomTable.exe (PID: 7156)
      • ConnectifySupportCenter.exe (PID: 5404)
      • ConnectifyShutdown.exe (PID: 2076)
      • DriverSwitcher.exe (PID: 6220)
      • GlobalAtomTable.exe (PID: 3188)
      • GlobalAtomTable.exe (PID: 6264)
      • ConnectifyService.exe (PID: 2232)
      • Connectifyd.exe (PID: 4160)
      • ConnectifyShutdown.exe (PID: 444)

    • Changes the autorun value in the registry

      • ConnectifyInstaller.exe (PID: 6824)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • ConnectifyInstaller.exe (PID: 6616)
      • ConnectifyInstaller.exe (PID: 6824)
      • ConnectifySupportCenter.exe (PID: 5404)
      • ConnectifyShutdown.exe (PID: 2076)
      • ConnectifyShutdown.exe (PID: 444)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • ConnectifyInstaller.exe (PID: 6616)
      • ConnectifyInstaller.exe (PID: 6824)

    • Application launched itself

      • ConnectifyInstaller.exe (PID: 6616)

    • Executable content was dropped or overwritten

      • ConnectifyInstaller.exe (PID: 6616)
      • ConnectifyInstaller.exe (PID: 6824)
      • DriverSwitcher.exe (PID: 6220)
      • snetcfg.exe (PID: 6096)
      • drvinst.exe (PID: 6588)

    • The process creates files with name similar to system file names

      • ConnectifyInstaller.exe (PID: 6824)

    • There is functionality for taking screenshot (YARA)

      • ConnectifyInstaller.exe (PID: 6616)
      • ConnectifyInstaller.exe (PID: 6824)
      • ConnectifySupportCenter.exe (PID: 5404)

    • Reads Microsoft Outlook installation path

      • ConnectifyInstaller.exe (PID: 6824)

    • Checks Windows Trust Settings

      • ConnectifySupportCenter.exe (PID: 5404)
      • ConnectifyShutdown.exe (PID: 2076)
      • ConnectifyShutdown.exe (PID: 444)
      • Connectifyd.exe (PID: 4160)

    • Windows service management via SC.EXE

      • sc.exe (PID: 188)
      • sc.exe (PID: 7112)
      • sc.exe (PID: 4160)
      • sc.exe (PID: 420)
      • sc.exe (PID: 5236)
      • sc.exe (PID: 4864)

    • Creates a software uninstall entry

      • ConnectifyInstaller.exe (PID: 6824)

    • Suspicious use of NETSH.EXE

      • ConnectifyShutdown.exe (PID: 2076)
      • ConnectifyShutdown.exe (PID: 444)

    • Drops a system driver (possible attempt to evade defenses)

      • DriverSwitcher.exe (PID: 6220)
      • snetcfg.exe (PID: 6096)
      • drvinst.exe (PID: 6588)

    • Creates files in the driver directory

      • drvinst.exe (PID: 6588)
      • snetcfg.exe (PID: 6096)

    • Creates a new Windows service

      • sc.exe (PID: 6540)

    • Restarts service on failure

      • sc.exe (PID: 2012)

    • Executes as Windows Service

      • ConnectifyService.exe (PID: 2232)

  • INFO

    • Checks supported languages

      • ConnectifyInstaller.exe (PID: 6616)
      • ConnectifyInstaller.exe (PID: 6824)
      • GlobalAtomTable.exe (PID: 7156)
      • ConnectifySupportCenter.exe (PID: 5404)
      • DriverSwitcher.exe (PID: 6220)
      • snetcfg.exe (PID: 6096)
      • ConnectifyShutdown.exe (PID: 2076)
      • GlobalAtomTable.exe (PID: 6264)
      • GlobalAtomTable.exe (PID: 3188)
      • ConnectifyShutdown.exe (PID: 444)
      • ConnectifyService.exe (PID: 2232)
      • Connectifyd.exe (PID: 4160)

    • The sample compiled with english language support

      • ConnectifyInstaller.exe (PID: 6616)
      • ConnectifyInstaller.exe (PID: 6824)

    • Process checks computer location settings

      • ConnectifyInstaller.exe (PID: 6616)

    • Reads the computer name

      • ConnectifyInstaller.exe (PID: 6616)
      • ConnectifyInstaller.exe (PID: 6824)
      • ConnectifySupportCenter.exe (PID: 5404)
      • DriverSwitcher.exe (PID: 6220)
      • ConnectifyShutdown.exe (PID: 2076)
      • drvinst.exe (PID: 6588)
      • ConnectifyService.exe (PID: 2232)
      • Connectifyd.exe (PID: 4160)
      • ConnectifyShutdown.exe (PID: 444)

    • Create files in a temporary directory

      • ConnectifyInstaller.exe (PID: 6616)
      • ConnectifyInstaller.exe (PID: 6824)
      • DriverSwitcher.exe (PID: 6220)
      • snetcfg.exe (PID: 6096)

    • UPX packer has been detected

      • ConnectifyInstaller.exe (PID: 6616)

    • Reads the machine GUID from the registry

      • ConnectifySupportCenter.exe (PID: 5404)
      • ConnectifyShutdown.exe (PID: 2076)
      • drvinst.exe (PID: 6588)
      • ConnectifyShutdown.exe (PID: 444)
      • Connectifyd.exe (PID: 4160)

    • Reads the software policy settings

      • ConnectifySupportCenter.exe (PID: 5404)
      • ConnectifyShutdown.exe (PID: 2076)
      • drvinst.exe (PID: 6588)
      • ConnectifyShutdown.exe (PID: 444)

    • Creates files or folders in the user directory

      • ConnectifySupportCenter.exe (PID: 5404)

    • Checks proxy server information

      • ConnectifySupportCenter.exe (PID: 5404)

    • Creates files in the program directory

      • ConnectifyInstaller.exe (PID: 6824)
      • DriverSwitcher.exe (PID: 6220)
      • Connectifyd.exe (PID: 4160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 23.0.1.40175
ProductVersionNumber: 23.0.1.40175
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Connectify
FileDescription: Connectify Hotspot 23
FileVersion: 23.0.1.40175
LegalCopyright: Copyright 2009-2023
ProductName: Connectify Hotspot 23
ProductVersion: 23.0.1.40175
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
39
Malicious processes
10
Suspicious processes
3

Behavior graph

Click at the process to see the details
start connectifyinstaller.exe connectifyinstaller.exe globalatomtable.exe no specs conhost.exe no specs connectifysupportcenter.exe sc.exe no specs conhost.exe no specs connectifyshutdown.exe no specs netsh.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs driverswitcher.exe conhost.exe no specs snetcfg.exe conhost.exe no specs drvinst.exe globalatomtable.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs globalatomtable.exe no specs conhost.exe no specs connectifyshutdown.exe no specs netsh.exe no specs conhost.exe no specs connectifyservice.exe no specs connectifyd.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188sc query ConnectifyC:\Windows\SysWOW64\sc.exe—ConnectifyInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
420sc query wlansvcC:\Windows\SysWOW64\sc.exe—ConnectifyInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
444"C:\Program Files (x86)\Connectify\ConnectifyShutdown.exe" -noui -nosupport -noall -restartserviceC:\Program Files (x86)\Connectify\ConnectifyShutdown.exe—ConnectifyInstaller.exe
User:
admin
Company:
Connectify
Integrity Level:
HIGH
Description:
Connectify Shutdown App
Exit code:
0
Version:
23.0.1.40175
Modules
Images
c:\program files (x86)\connectify\connectifyshutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1016\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—snetcfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1580\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—GlobalAtomTable.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2012sc failure Connectify actions= restart/10000/restart/30000/restart/300000 reset= 6000C:\Windows\SysWOW64\sc.exe—ConnectifyInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2076"C:\Users\admin\AppData\Local\Temp\Connectify\f8df1d88c6b54709f6e35ca62e7265d0\ConnectifyShutdown"C:\Users\admin\AppData\Local\Temp\Connectify\f8df1d88c6b54709f6e35ca62e7265d0\ConnectifyShutdown.exe—ConnectifyInstaller.exe
User:
admin
Company:
Connectify
Integrity Level:
HIGH
Description:
Connectify Shutdown App
Exit code:
0
Version:
23.0.1.40175
Modules
Images
c:\users\admin\appdata\local\temp\connectify\f8df1d88c6b54709f6e35ca62e7265d0\connectifyshutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2168\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Connectifyd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2232"C:\Program Files (x86)\Connectify\ConnectifyService.exe"C:\Program Files (x86)\Connectify\ConnectifyService.exe—services.exe
User:
SYSTEM
Company:
Connectify
Integrity Level:
SYSTEM
Version:
23.0.1.40175
Modules
Images
c:\program files (x86)\connectify\connectifyservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
20 536
Read events
20 465
Write events
58
Delete events
13

Modification events

(PID) Process:(6824) ConnectifyInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Connectify-Installer
Value:
(PID) Process:(6824) ConnectifyInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Connectify-Installer
Value:
C:\Users\admin\AppData\Local\Temp\Connectify\runInstaller.bat
(PID) Process:(6824) ConnectifyInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Connectify
Operation:writeName:PolicyDate
Value:
20180510
(PID) Process:(6824) ConnectifyInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Connectify
Operation:writeName:InstallType
Value:
False
(PID) Process:(6824) ConnectifyInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Connectify Hotspot 2018
Value:
(PID) Process:(6824) ConnectifyInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Connectify Hotspot 2019
Value:
(PID) Process:(6824) ConnectifyInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Connectify Hotspot 2020
Value:
(PID) Process:(6824) ConnectifyInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Connectify Hotspot 2021
Value:
(PID) Process:(6824) ConnectifyInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Connectify
Value:
(PID) Process:(6824) ConnectifyInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Connectify
Value:
Executable files
80
Suspicious files
54
Text files
48
Unknown types
0

Dropped files

PID
Process
Filename
Type
6616ConnectifyInstaller.exeC:\Users\admin\AppData\Local\Temp\nsh5C7D.tmp\modern-header.bmpimage
MD5:F50B6CEE1BE90D50AF582E57528C7000
SHA256:E83DC2CA1239E62D979C02CA8A8B394573BF50C650AAF4D38799E97D618FECA4
6824ConnectifyInstaller.exeC:\Users\admin\AppData\Local\Temp\nst5FC9.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
6824ConnectifyInstaller.exeC:\Users\admin\AppData\Local\Temp\Connectify\f8df1d88c6b54709f6e35ca62e7265d0\ConnectifyGopher.exe.configxml
MD5:2E8F098A4B39479ABDB3EDB8AFAFEE69
SHA256:70DC1E46CAE7122C8D6013B2CA798A76AA713B517DB2AFB01C162F0491E155B6
6824ConnectifyInstaller.exeC:\Users\admin\AppData\Local\Temp\Connectify\f8df1d88c6b54709f6e35ca62e7265d0\ConnectifyStartup.exe.configxml
MD5:5AE4200CAC6C4D2328D1792F18C80836
SHA256:352DD8D23456D42B9C69955CDFF1ED42064B30C203B4C965E41D32A32BC77C9C
6824ConnectifyInstaller.exeC:\Users\admin\AppData\Local\Temp\nst5FC9.tmp\modern-header.bmpimage
MD5:F50B6CEE1BE90D50AF582E57528C7000
SHA256:E83DC2CA1239E62D979C02CA8A8B394573BF50C650AAF4D38799E97D618FECA4
6616ConnectifyInstaller.exeC:\Users\admin\AppData\Local\Temp\nsh5C7D.tmp\modern-wizard.bmpimage
MD5:AE43624C14859150EDFB54B4024AFF46
SHA256:D5B56046F10941E6659277D46FFD4A0D327DB24BE3174D6A8E7AE0660DA874E9
6616ConnectifyInstaller.exeC:\Users\admin\AppData\Local\Temp\nsh5C7D.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
6616ConnectifyInstaller.exeC:\Users\admin\AppData\Local\Temp\nsh5C7D.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
6824ConnectifyInstaller.exeC:\Users\admin\AppData\Local\Temp\nst5FC9.tmp\md5dll.dllexecutable
MD5:7059F133EA2316B9E7E39094A52A8C34
SHA256:32C3D36F38E7E8A8BAFD4A53663203EF24A10431BDA16AF9E353C7D5D108610F
6824ConnectifyInstaller.exeC:\Users\admin\AppData\Local\Temp\nst5FC9.tmp\modern-wizard.bmpimage
MD5:AE43624C14859150EDFB54B4024AFF46
SHA256:D5B56046F10941E6659277D46FFD4A0D327DB24BE3174D6A8E7AE0660DA874E9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
33
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
DE
binary
313 b
whitelisted
5404
ConnectifySupportCenter.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEA%2B4p0C5FY0DUUO8WdnwQCk%3D
DE
binary
314 b
whitelisted
5404
ConnectifySupportCenter.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSE67Nbq3jfQQg8yXEpbmqLTNn7XwQUm1%2BwNrqdBq4ZJ73AoCLAi4s4d%2B0CEAk0ptKUFMa%2B78vnwiYNf%2Fs%3D
DE
binary
312 b
whitelisted
6424
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
DE
binary
471 b
whitelisted
5548
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
5548
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
104.126.37.144:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.bing.com
  • 104.126.37.144
  • 104.126.37.136
  • 104.126.37.123
  • 104.126.37.139
  • 104.126.37.129
  • 104.126.37.130
  • 104.126.37.154
  • 104.126.37.176
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.68
  • 20.190.160.64
  • 40.126.32.134
  • 40.126.32.136
  • 20.190.160.2
  • 20.190.160.22
  • 20.190.160.67
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ConnectifyInstaller.exe