File name:

Microsoft_Excel.msi

Full analysis: https://app.any.run/tasks/8ecc866c-4be0-478d-9d89-064ab029ee8d
Verdict: Malicious activity
Analysis date: October 03, 2025, 17:18:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
screenconnect
rmm-tool
remote
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {63F222AA-0C09-8B28-5ABB-E7221BC1F823}, Create Time/Date: Wed Dec 18 21:40:44 2024, Last Saved Time/Date: Wed Dec 18 21:40:44 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
MD5:

11DD50D77AE2C24C8331D15F6ABE97D6

SHA1:

D5B2B79DF6158F66DAEDF570E5762A2359296FD1

SHA256:

1FD040C91B03F71D5A120F3C6B696DA441D8424BA6F874991F5E7F1B014BEB65

SSDEEP:

196608:mlpHh8xBXNw0lpHhKlpHh9lpHh1lpHh3lpHhKklpHhKYylpHhKY:WB8xcIBaBVBtBLBlB6B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 8476)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 7568)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3196)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 3196)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 3196)

    • Screenconnect has been detected

      • msiexec.exe (PID: 3196)
      • ScreenConnect.ClientService.exe (PID: 8476)
      • ScreenConnect.ClientService.exe (PID: 8476)

    • Executes as Windows Service

      • ScreenConnect.ClientService.exe (PID: 8476)

    • SCREENCONNECT mutex has been found

      • ScreenConnect.ClientService.exe (PID: 8476)

    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 8476)

    • Reads security settings of Internet Explorer

      • ScreenConnect.ClientService.exe (PID: 8476)
      • ScreenConnect.WindowsClient.exe (PID: 8536)
      • ScreenConnect.WindowsClient.exe (PID: 8696)

    • Connects to unusual port

      • ScreenConnect.ClientService.exe (PID: 8476)

    • Potential Corporate Privacy Violation

      • ScreenConnect.ClientService.exe (PID: 8476)

  • INFO

    • An automatically generated document

      • msiexec.exe (PID: 1924)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1924)
      • BackgroundTransferHost.exe (PID: 9100)
      • BackgroundTransferHost.exe (PID: 8304)
      • BackgroundTransferHost.exe (PID: 8912)
      • BackgroundTransferHost.exe (PID: 9192)
      • BackgroundTransferHost.exe (PID: 4288)

    • Checks proxy server information

      • msiexec.exe (PID: 1924)
      • BackgroundTransferHost.exe (PID: 8304)
      • slui.exe (PID: 8388)

    • Reads the software policy settings

      • msiexec.exe (PID: 1924)
      • msiexec.exe (PID: 3196)
      • BackgroundTransferHost.exe (PID: 8304)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 1924)
      • BackgroundTransferHost.exe (PID: 8304)

    • Checks supported languages

      • msiexec.exe (PID: 5256)
      • msiexec.exe (PID: 3196)
      • msiexec.exe (PID: 8388)
      • msiexec.exe (PID: 8444)
      • ScreenConnect.ClientService.exe (PID: 8476)
      • ScreenConnect.WindowsClient.exe (PID: 8536)
      • ScreenConnect.WindowsClient.exe (PID: 8696)

    • Reads the computer name

      • msiexec.exe (PID: 3196)
      • msiexec.exe (PID: 8388)
      • msiexec.exe (PID: 5256)
      • msiexec.exe (PID: 8444)
      • ScreenConnect.ClientService.exe (PID: 8476)
      • ScreenConnect.WindowsClient.exe (PID: 8536)
      • ScreenConnect.WindowsClient.exe (PID: 8696)

    • Manages system restore points

      • SrTasks.exe (PID: 8224)

    • Create files in a temporary directory

      • rundll32.exe (PID: 7568)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3196)
      • ScreenConnect.ClientService.exe (PID: 8476)
      • ScreenConnect.WindowsClient.exe (PID: 8536)
      • ScreenConnect.WindowsClient.exe (PID: 8696)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3196)
      • msiexec.exe (PID: 1924)

    • CONNECTWISE has been detected

      • msiexec.exe (PID: 3196)
      • ScreenConnect.ClientService.exe (PID: 8476)
      • ScreenConnect.WindowsClient.exe (PID: 8536)
      • msiexec.exe (PID: 1924)
      • ScreenConnect.WindowsClient.exe (PID: 8696)

    • SCREENCONNECT has been detected

      • msiexec.exe (PID: 3196)
      • ScreenConnect.ClientService.exe (PID: 8476)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3196)

    • Reads CPU info

      • ScreenConnect.WindowsClient.exe (PID: 8696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Default
Author: ScreenConnect Software
Keywords: Default
Comments: Default
Template: Intel;1033
RevisionNumber: {63F222AA-0C09-8B28-5ABB-E7221BC1F823}
CreateDate: 2024:12:18 21:40:44
ModifyDate: 2024:12:18 21:40:44
Pages: 200
Words: 2
Software: Windows Installer XML Toolset (3.11.0.1701)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
190
Monitored processes
18
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs rundll32.exe srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs svchost.exe screenconnect.windowsclient.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1924"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\Microsoft_Excel.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2428C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3196C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4288"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5256C:\Windows\syswow64\MsiExec.exe -Embedding 316A66C65C4DB6ABE02F15AD906BC4D8 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7568rundll32.exe "C:\Users\admin\AppData\Local\Temp\MSI186A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1513718 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
8224C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:14C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
8236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8304"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
8388C:\Windows\syswow64\MsiExec.exe -Embedding E58EAA946776856ABAE3B1C2715AECC5C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
14 327
Read events
14 169
Write events
150
Delete events
8

Modification events

(PID) Process:(3196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000E5A7EBCD8934DC017C0C0000B0020000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000E5A7EBCD8934DC017C0C0000B0020000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000E5A7EBCD8934DC017C0C0000B0020000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000836CF0CD8934DC017C0C0000B0020000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000B045E9CD8934DC017C0C0000B0020000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000B045E9CD8934DC017C0C0000B0020000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000006B0AEECD8934DC017C0C0000B0020000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
14
(PID) Process:(3196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000E7CEF2CD8934DC017C0C000098060000E80300000100000000000000000000003D04159BF5E13147840FC0680F7EE23C00000000000000000000000000000000
(PID) Process:(3196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Leave)
Value:
4800000000000000CBDAA0CE8934DC017C0C000098060000E80300000000000000000000000000003D04159BF5E13147840FC0680F7EE23C00000000000000000000000000000000
Executable files
19
Suspicious files
30
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
3196msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3196msiexec.exeC:\Windows\Installer\1743bf.msi —
MD5:—
SHA256:—
7568rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI186A.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllexecutable
MD5:A921A2B83B98F02D003D9139FA6BA3D8
SHA256:548C551F6EBC5D829158A1E9AD1948D301D7C921906C3D8D6B6D69925FC624A1
7568rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI186A.tmp-\ScreenConnect.InstallerActions.dll —
MD5:7572B9AE2ECF5946645863A828678B5A
SHA256:BE89FE3C59FD927B3B45FEBD183FDDC1D990994D4B64D689EB04A40D8964F493
7568rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI186A.tmp-\Microsoft.Deployment.Compression.dllexecutable
MD5:4717BCC62EB45D12FFBED3A35BA20E25
SHA256:E04DE7988A2A39931831977FA22D2A4C39CF3F70211B77B618CAE9243170F1A7
7568rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI186A.tmp-\ScreenConnect.Windows.dllexecutable
MD5:7099C67FE850D902106C03D07BFB773B
SHA256:2659F660691D65628D2FCC3BFC334686CD053F162CDB73BF7A0DA0AC6449DB92
7568rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI186A.tmp-\Microsoft.Deployment.Compression.Cab.dllexecutable
MD5:77BE59B3DDEF06F08CAA53F0911608A5
SHA256:9D32032109FFC217B7DC49390BD01A067A49883843459356EBFB4D29BA696BF8
3196msiexec.exeC:\Windows\Installer\MSI4603.tmpexecutable
MD5:BA84DD4E0C1408828CCC1DE09F585EDA
SHA256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
7568rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI186A.tmp-\CustomAction.configxml
MD5:6F52EBEA639FD7CEFCA18D9E5272463E
SHA256:7027B69AB6EBC9F3F7D2F6C800793FDE2A057B76010D8CFD831CF440371B2B23
3196msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:EFC8B4BC12691AF8D7451EFE08E053B8
SHA256:4F4D0C199E560506BDE6DB112CC0E07F14446CA1DE7FFADDCCCDD6941982BEF1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
38
DNS requests
22
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1924
msiexec.exe
GET
200
18.173.205.57:80
http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQg3SSkKA74hABkhmlBtJTz8w3hlAQU%2BWC71OPVNPa49QaAJadz20ZpqJ4CEEJLalPOx2YUHCpjsaUcQQQ%3D
unknown
—
—
whitelisted
8180
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4620
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4620
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1924
msiexec.exe
GET
200
18.173.205.57:80
http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSoEwb5tith0jIBy9frSyNGB1lsAAQUNr1J%2FzEs669qQP6ZwBbtuvxI3V8CEHMBvXddPk3GU5sheiw8sTc%3D
unknown
—
—
whitelisted
8304
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7804
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
8044
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3432
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6016
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5224
SearchApp.exe
92.123.104.58:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1924
msiexec.exe
18.173.205.57:80
ocsps.ssl.com
—
US
whitelisted
4620
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4620
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3464
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
8180
backgroundTaskHost.exe
92.123.104.58:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
www.bing.com
  • 92.123.104.58
  • 92.123.104.52
  • 92.123.104.66
  • 92.123.104.63
  • 92.123.104.65
  • 92.123.104.53
  • 92.123.104.50
  • 92.123.104.64
  • 92.123.104.62
  • 2.16.241.201
  • 2.16.241.218
  • 2.16.241.205
whitelisted
google.com
  • 142.250.185.206
whitelisted
ocsps.ssl.com
  • 18.173.205.57
  • 18.173.205.113
  • 18.173.205.43
  • 18.173.205.76
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.130
  • 40.126.31.73
  • 20.190.159.64
  • 40.126.31.2
  • 40.126.31.71
  • 20.190.159.131
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
  • 20.199.58.43
whitelisted
listen.onyxaquarius.top
  • 194.102.105.26
unknown

Threats

PID
Process
Class
Message
2428
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2428
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (onyxaquarius .top)
8476
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Microsoft_Excel.msi