File name:

WifiAutoInstallSetup.exe

Full analysis: https://app.any.run/tasks/362c45c3-7833-439c-8d47-a31d2bfe0427
Verdict: Malicious activity
Analysis date: April 21, 2025, 21:50:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

F37FD4DEBC960836126654C92F2BF92B

SHA1:

A226BF88E5B213E2E74DF4C6F2DF3F90AD76901B

SHA256:

1A9D49813D5629EB1A9C0333ACD528A54922D812340EAE6431145C7E21C1AF08

SSDEEP:

98304:9WRhTW/9nEPtPDzWMEP/ulm2sJTp9wgJ5rrCASmiLOlw7Tbga/VyXybQlZ8jBmvQ:iUaZSejoEh9wCHPqfOGm3D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WifiAutoInstallSetup.exe (PID: 6032)
      • WifiAutoInstallSetup.exe (PID: 7144)
      • WifiAutoInstallSetup.tmp (PID: 4920)
      • WifiAutoInstallDriver.exe (PID: 2516)
      • drvinst.exe (PID: 5228)

    • Reads security settings of Internet Explorer

      • WifiAutoInstallSetup.tmp (PID: 6808)

    • Reads the Windows owner or organization settings

      • WifiAutoInstallSetup.tmp (PID: 4920)

    • Drops a system driver (possible attempt to evade defenses)

      • WifiAutoInstallSetup.tmp (PID: 4920)
      • WifiAutoInstallDriver.exe (PID: 2516)
      • drvinst.exe (PID: 5228)

    • Process drops legitimate windows executable

      • WifiAutoInstallSetup.tmp (PID: 4920)

    • Creates files in the driver directory

      • drvinst.exe (PID: 5228)

    • Executes as Windows Service

      • WifiAutoInstallSrv.exe (PID: 5776)

  • INFO

    • Reads the computer name

      • WifiAutoInstallSetup.tmp (PID: 6808)
      • WifiAutoInstallSetup.tmp (PID: 4920)
      • WifiAutoInstallDriver.exe (PID: 2516)
      • WifiAutoInstallSrv.exe (PID: 5776)
      • drvinst.exe (PID: 5228)
      • WifiAutoInstallSrv.exe (PID: 5256)

    • Create files in a temporary directory

      • WifiAutoInstallSetup.exe (PID: 6032)
      • WifiAutoInstallSetup.exe (PID: 7144)
      • WifiAutoInstallSetup.tmp (PID: 4920)
      • WifiAutoInstallDriver.exe (PID: 2516)

    • Process checks computer location settings

      • WifiAutoInstallSetup.tmp (PID: 6808)

    • Checks supported languages

      • WifiAutoInstallSetup.exe (PID: 6032)
      • WifiAutoInstallSetup.tmp (PID: 6808)
      • WifiAutoInstallSetup.exe (PID: 7144)
      • WifiAutoInstallSetup.tmp (PID: 4920)
      • WifiAutoInstallDriver.exe (PID: 2516)
      • drvinst.exe (PID: 5228)
      • WifiAutoInstallSrv.exe (PID: 5256)
      • WifiAutoInstallSrv.exe (PID: 5776)

    • Detects InnoSetup installer (YARA)

      • WifiAutoInstallSetup.exe (PID: 6032)
      • WifiAutoInstallSetup.tmp (PID: 6808)
      • WifiAutoInstallSetup.exe (PID: 7144)
      • WifiAutoInstallSetup.tmp (PID: 4920)

    • Compiled with Borland Delphi (YARA)

      • WifiAutoInstallSetup.tmp (PID: 6808)
      • WifiAutoInstallSetup.tmp (PID: 4920)

    • The sample compiled with chinese language support

      • WifiAutoInstallSetup.tmp (PID: 4920)

    • Creates files in the program directory

      • WifiAutoInstallSetup.tmp (PID: 4920)

    • The sample compiled with english language support

      • WifiAutoInstallSetup.tmp (PID: 4920)
      • WifiAutoInstallDriver.exe (PID: 2516)
      • drvinst.exe (PID: 5228)

    • Creates a software uninstall entry

      • WifiAutoInstallSetup.tmp (PID: 4920)

    • Reads the software policy settings

      • drvinst.exe (PID: 5228)

    • Reads the machine GUID from the registry

      • drvinst.exe (PID: 5228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 41984
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0xaad0
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.9
ProductVersionNumber: 2.0.0.9
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Realtek, Inc.
FileDescription: WifiAutoInstallSetup
FileVersion: 2.0.0.9
LegalCopyright: Copyright © 2004-2017 Realtek Semiconductor Corp. All rights reserved.
ProductName: WifiAutoInstall
ProductVersion: 2.0.0.9
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
12
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start wifiautoinstallsetup.exe wifiautoinstallsetup.tmp no specs wifiautoinstallsetup.exe wifiautoinstallsetup.tmp sppextcomobj.exe no specs slui.exe no specs wifiautoinstalldriver.exe conhost.exe no specs drvinst.exe wifiautoinstallsrv.exe no specs conhost.exe no specs wifiautoinstallsrv.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1132C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2516"C:\Program Files\Realtek\WifiAutoInstall\WifiAutoInstallDriver.exe" /iC:\Program Files\Realtek\WifiAutoInstall\WifiAutoInstallDriver.exe
WifiAutoInstallSetup.tmp
User:
admin
Company:
Realtek
Integrity Level:
HIGH
Description:
WifiAutoInstall
Exit code:
1
Version:
2.0.0.9
Modules
Images
c:\program files\realtek\wifiautoinstall\wifiautoinstalldriver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\difxapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4776"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4920"C:\Users\admin\AppData\Local\Temp\is-CC596.tmp\WifiAutoInstallSetup.tmp" /SL5="$90296,9459011,58368,C:\Users\admin\AppData\Local\Temp\WifiAutoInstallSetup.exe" /SPAWNWND=$40352 /NOTIFYWND=$60304 C:\Users\admin\AppData\Local\Temp\is-CC596.tmp\WifiAutoInstallSetup.tmp
WifiAutoInstallSetup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-cc596.tmp\wifiautoinstallsetup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5228DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{1bb334bd-54fb-1444-9062-9c446b3f1396}\netrtwlanu.inf" "9" "45c92be57" "00000000000001BC" "WinSta0\Default" "00000000000001D4" "208" "C:\Program Files\Realtek\WifiAutoInstall\Driver\Win10X64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
5256"C:\Program Files\Realtek\WifiAutoInstall\WifiAutoInstallSrv.exe" /iC:\Program Files\Realtek\WifiAutoInstall\WifiAutoInstallSrv.exe—WifiAutoInstallSetup.tmp
User:
admin
Company:
Realtek
Integrity Level:
HIGH
Description:
WifiAutoInstall
Exit code:
1
Version:
2.0.0.9
Modules
Images
c:\program files\realtek\wifiautoinstall\wifiautoinstallsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\setupapi.dll
5400\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WifiAutoInstallDriver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5776"C:\Program Files\Realtek\WifiAutoInstall\WifiAutoInstallSrv.exe"C:\Program Files\Realtek\WifiAutoInstall\WifiAutoInstallSrv.exe—services.exe
User:
SYSTEM
Company:
Realtek
Integrity Level:
SYSTEM
Description:
WifiAutoInstall
Version:
2.0.0.9
Modules
Images
c:\program files\realtek\wifiautoinstall\wifiautoinstallsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\setupapi.dll
c:\windows\syswow64\msvcrt.dll
6032"C:\Users\admin\AppData\Local\Temp\WifiAutoInstallSetup.exe" C:\Users\admin\AppData\Local\Temp\WifiAutoInstallSetup.exe
explorer.exe
User:
admin
Company:
Realtek, Inc.
Integrity Level:
MEDIUM
Description:
WifiAutoInstallSetup
Exit code:
0
Version:
2.0.0.9
Modules
Images
c:\users\admin\appdata\local\temp\wifiautoinstallsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WifiAutoInstallSrv.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 648
Read events
3 625
Write events
23
Delete events
0

Modification events

(PID) Process:(4920) WifiAutoInstallSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBADB2D6-0408-42D0-AAF8-B79D3E8B994C}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.6.1 (a)
(PID) Process:(4920) WifiAutoInstallSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBADB2D6-0408-42D0-AAF8-B79D3E8B994C}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Realtek\WifiAutoInstall
(PID) Process:(4920) WifiAutoInstallSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBADB2D6-0408-42D0-AAF8-B79D3E8B994C}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Realtek\WifiAutoInstall\
(PID) Process:(4920) WifiAutoInstallSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBADB2D6-0408-42D0-AAF8-B79D3E8B994C}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
WifiAutoInstall
(PID) Process:(4920) WifiAutoInstallSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBADB2D6-0408-42D0-AAF8-B79D3E8B994C}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(4920) WifiAutoInstallSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBADB2D6-0408-42D0-AAF8-B79D3E8B994C}_is1
Operation:writeName:Inno Setup: Language
Value:
english
(PID) Process:(4920) WifiAutoInstallSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBADB2D6-0408-42D0-AAF8-B79D3E8B994C}_is1
Operation:writeName:DisplayName
Value:
Wifi Driver Install
(PID) Process:(4920) WifiAutoInstallSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBADB2D6-0408-42D0-AAF8-B79D3E8B994C}_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files\Realtek\WifiAutoInstall\unins000.exe"
(PID) Process:(4920) WifiAutoInstallSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBADB2D6-0408-42D0-AAF8-B79D3E8B994C}_is1
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files\Realtek\WifiAutoInstall\unins000.exe" /SILENT
(PID) Process:(4920) WifiAutoInstallSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBADB2D6-0408-42D0-AAF8-B79D3E8B994C}_is1
Operation:writeName:DisplayVersion
Value:
2.0.0.9
Executable files
114
Suspicious files
58
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
4920WifiAutoInstallSetup.tmpC:\Program Files\Realtek\WifiAutoInstall\is-SS68R.tmpexecutable
MD5:4C21E6F7981C81A2E7846E3185A1E843
SHA256:AFE966CE72744D2E87E042A54BB4AE8876C9FAADCC2B1052BD840225248A5863
4920WifiAutoInstallSetup.tmpC:\Program Files\Realtek\WifiAutoInstall\is-PQ17E.tmptext
MD5:05D273DA73E2BCC4557E32996331B91E
SHA256:B3BB40B97F8A266DD6FB1EBADE45EDADA40E2CE6FE2D2C4013C903079E8CF155
6032WifiAutoInstallSetup.exeC:\Users\admin\AppData\Local\Temp\is-GCO9N.tmp\WifiAutoInstallSetup.tmpexecutable
MD5:1AFBD25DB5C9A90FE05309F7C4FBCF09
SHA256:3BB0EE5569FE5453C6B3FA25AA517B925D4F8D1F7BA3475E58FA09C46290658C
4920WifiAutoInstallSetup.tmpC:\Program Files\Realtek\WifiAutoInstall\Driver\VistaX64\netrtwlanu_Vista.infbinary
MD5:5A6A5BA42BEE62C04F622DE5012B8449
SHA256:F7CC04B03EB8A37B3561605EB2BF50EC8437E4664B3DB1C75558CA26767BA4ED
4920WifiAutoInstallSetup.tmpC:\Program Files\Realtek\WifiAutoInstall\WifiAutoInstall.initext
MD5:05D273DA73E2BCC4557E32996331B91E
SHA256:B3BB40B97F8A266DD6FB1EBADE45EDADA40E2CE6FE2D2C4013C903079E8CF155
4920WifiAutoInstallSetup.tmpC:\Program Files\Realtek\WifiAutoInstall\unins000.exeexecutable
MD5:4C21E6F7981C81A2E7846E3185A1E843
SHA256:AFE966CE72744D2E87E042A54BB4AE8876C9FAADCC2B1052BD840225248A5863
4920WifiAutoInstallSetup.tmpC:\Program Files\Realtek\WifiAutoInstall\Driver\VistaX64\netrtwlanu.catbinary
MD5:60A9D5001E3A8AFCF8F112BC247A5799
SHA256:87EA34BAF7A269A50930E5B8E2DC5CC49A9878326A363907C3F20156DF8B02B6
4920WifiAutoInstallSetup.tmpC:\Program Files\Realtek\WifiAutoInstall\WifiAutoInstallSrv.exeexecutable
MD5:386B47F3AB1FDE28BE48F00E83D8463D
SHA256:351DC02A7C301B4F2034AEAD723621D8A67789F64C749CD26269407078A2095F
7144WifiAutoInstallSetup.exeC:\Users\admin\AppData\Local\Temp\is-CC596.tmp\WifiAutoInstallSetup.tmpexecutable
MD5:1AFBD25DB5C9A90FE05309F7C4FBCF09
SHA256:3BB0EE5569FE5453C6B3FA25AA517B925D4F8D1F7BA3475E58FA09C46290658C
4920WifiAutoInstallSetup.tmpC:\Program Files\Realtek\WifiAutoInstall\Driver\VistaX64\rtlCoInst.dllexecutable
MD5:C608104DFFE685581E858439B1F1C875
SHA256:A06C2F4C2EC1C5719B01F7A95F9D238A7444F88BB0B575237E1CF4410C7447F7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4652
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4652
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.5:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
google.com
  • 172.217.18.14
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.5
  • 20.190.160.64
  • 20.190.160.66
  • 40.126.32.76
  • 20.190.160.132
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WifiAutoInstallSetup.exe