File name:

Ver_0129321974_qj2dlsdue9n.msi

Full analysis: https://app.any.run/tasks/7ec75a58-8779-423a-ac63-50440099fe5b
Verdict: Malicious activity
Analysis date: April 16, 2025, 14:20:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
pdqconnect
rmm-tool
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: PDQConnectAgent, Author: PDQ.com, Keywords: Installer, Comments: This installer database contains the logic and data required to install PDQConnectAgent., Template: x64;1033, Revision Number: {5AC594AF-F3CE-44D8-98F8-EB039715F9B8}, Create Time/Date: Tue Apr 1 18:41:10 2025, Last Saved Time/Date: Tue Apr 1 18:41:10 2025, Number of Pages: 200, Number of Words: 2, Name of Creating Application: WiX Toolset (5.0.0.0), Security: 2
MD5:

23D94AC6610A77AA5034154ABD570234

SHA1:

9A8C508BF76580A6C47443FB9E538BB13CE1F792

SHA256:

2A7659590B8DE21C61FC9674E0C354C4C88A604BF8490B6816249BA24DF90106

SSDEEP:

98304:x+MRJ7OuQwr7GDjGwzqE0NXTJTLFkt6oOEIre4gSSUiQHuK021LlJx6DZkrU65zm:wTf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7572)
      • powershell.exe (PID: 8152)
      • powershell.exe (PID: 7612)
      • powershell.exe (PID: 2560)

    • Changes powershell execution policy (Bypass)

      • pdq-connect-agent.exe (PID: 2552)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 7220)
      • pdq-connect-agent.exe (PID: 2552)
      • pdq-connect-updater.exe (PID: 6824)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7148)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 4120)
      • rundll32.exe (PID: 5376)
      • rundll32.exe (PID: 7216)
      • rundll32.exe (PID: 2240)
      • rundll32.exe (PID: 7528)
      • pdq-connect-agent.exe (PID: 2552)
      • rundll32.exe (PID: 516)
      • rundll32.exe (PID: 7704)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 8188)
      • msiexec.exe (PID: 3896)
      • msiexec.exe (PID: 7672)

    • Application launched itself

      • msiexec.exe (PID: 7148)

    • PDQConnect is probably used for system patching and software deployment

      • sc.exe (PID: 5400)

    • Windows service management via SC.EXE

      • sc.exe (PID: 5400)

    • Starts SC.EXE for service management

      • rundll32.exe (PID: 2240)

    • The process hide an interactive prompt from the user

      • pdq-connect-agent.exe (PID: 2552)

    • Starts POWERSHELL.EXE for commands execution

      • pdq-connect-agent.exe (PID: 2552)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 8152)

    • The process hides Powershell's copyright startup banner

      • pdq-connect-agent.exe (PID: 2552)

    • The process bypasses the loading of PowerShell profile settings

      • pdq-connect-agent.exe (PID: 2552)

  • INFO

    • An automatically generated document

      • msiexec.exe (PID: 2340)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2340)

    • Reads the computer name

      • msiexec.exe (PID: 7148)
      • msiexec.exe (PID: 8188)
      • msiexec.exe (PID: 3896)
      • pdq-connect-updater.exe (PID: 6824)

    • Reads the software policy settings

      • msiexec.exe (PID: 2340)
      • msiexec.exe (PID: 7148)
      • pdq-connect-agent.exe (PID: 2552)
      • pdq-connect-updater.exe (PID: 6824)

    • Checks supported languages

      • msiexec.exe (PID: 7148)
      • msiexec.exe (PID: 8188)
      • pdq-connect-agent.exe (PID: 2552)
      • msiexec.exe (PID: 3896)
      • pdq-connect-updater.exe (PID: 6824)

    • Manages system restore points

      • SrTasks.exe (PID: 8052)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 7148)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7148)

    • Create files in a temporary directory

      • rundll32.exe (PID: 5376)

    • The sample compiled with english language support

      • msiexec.exe (PID: 7148)

    • PDQCONNECT has been detected

      • msiexec.exe (PID: 3896)
      • rundll32.exe (PID: 2240)
      • pdq-connect-agent.exe (PID: 2552)

    • Creates files in the program directory

      • pdq-connect-agent.exe (PID: 2552)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 8152)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: PDQConnectAgent
Author: PDQ.com
Keywords: Installer
Comments: This installer database contains the logic and data required to install PDQConnectAgent.
Template: x64;1033
RevisionNumber: {5AC594AF-F3CE-44D8-98F8-EB039715F9B8}
CreateDate: 2025:04:01 18:41:10
ModifyDate: 2025:04:01 18:41:10
Pages: 200
Words: 2
Software: WiX Toolset (5.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
161
Monitored processes
30
Malicious processes
3
Suspicious processes
4

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs sppextcomobj.exe no specs slui.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe sc.exe no specs conhost.exe no specs pdq-connect-agent.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe pdq-connect-updater.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516rundll32.exe "C:\WINDOWS\Installer\MSI3377.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1127390 38 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CreateEventSourceC:\Windows\System32\rundll32.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2240rundll32.exe "C:\WINDOWS\Installer\MSI400C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1130578 50 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.StartServiceC:\Windows\System32\rundll32.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2340"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\Ver_0129321974_qj2dlsdue9n.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2552"C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe" --serviceC:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
PDQ Connect Agent
Version:
5.6.25
Modules
Images
c:\program files\pdq\pdqconnectagent\pdq-connect-agent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2560"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3896C:\Windows\System32\MsiExec.exe -Embedding 7C8B60D59C4878C08AFDD8B6929464A9 E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4120rundll32.exe "C:\WINDOWS\Installer\MSI2A39.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1125031 2 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_ActionC:\Windows\System32\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5260\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5376rundll32.exe "C:\WINDOWS\Installer\MSI2EB1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1126125 16 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_ActionC:\Windows\System32\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5400"C:\WINDOWS\system32\sc.exe" start "PDQConnectAgent"C:\Windows\System32\sc.exe—rundll32.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
29 755
Read events
29 388
Write events
342
Delete events
25

Modification events

(PID) Process:(7148) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000108897B1DAAEDB01EC1B0000241C0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7148) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000108897B1DAAEDB01EC1B0000241C0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7148) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000020DFE3B1DAAEDB01EC1B0000241C0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7148) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000020DFE3B1DAAEDB01EC1B0000241C0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7148) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000006A94E8B1DAAEDB01EC1B0000241C0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7148) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000068F8EAB1DAAEDB01EC1B0000241C0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7148) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(7148) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000D91F6EB2DAAEDB01EC1B0000241C0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7148) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000CBE972B2DAAEDB01EC1B0000901C0000E8030000010000000000000000000000756E471EBBB56D4D998C3E7B7756CA9400000000000000000000000000000000
(PID) Process:(7220) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000489283B2DAAEDB01341C0000501C0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
39
Suspicious files
50
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
7148msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
7148msiexec.exeC:\Windows\Installer\1124da.msi —
MD5:—
SHA256:—
4120rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCAA025E2F2B94DDF5B24A764D21BAB8788\WixSharp.dllexecutable
MD5:EBED2675D27B9383EE8E58BDEDDD5DA4
SHA256:CAA9DA1C55E33446EAEB783957E990847369423C7DD652F07A5C93BF1D786A66
2340msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4binary
MD5:9FE613ED0B99018D77954ADADA262A68
SHA256:457361CD03B39D5D3E3B8C482CDAC10F2E54C5F4DF66E5AB7C770A817C74F515
2340msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:4EDFCF54091F5F092269CF643DD3946D
SHA256:8A351392C867EEE4DB82D3C42B10AB5850352FADE338C9ECF9D89CECAF167112
2340msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D9CB7DFFEEA63BAB482BD2705E7E24AB_D64C5BFAB2C28B4652E4AC7169A0D3DBbinary
MD5:17DF28CA1388B947130FA29C4F65A2D0
SHA256:4E75064812186D5682C8128304AF2A96F75A73015F3503DBCE37B105AD1B5231
5376rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA52C85D25F940EFABE13B8E3387C7FC79\WixSharp.dllexecutable
MD5:EBED2675D27B9383EE8E58BDEDDD5DA4
SHA256:CAA9DA1C55E33446EAEB783957E990847369423C7DD652F07A5C93BF1D786A66
7148msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:6959F3437A7295844612B91CFD74728E
SHA256:D31E5AFD24BB092BB7393E35E7607AF811FA6771B05E0779A8F0AB3C0EEDB428
7148msiexec.exeC:\Windows\Installer\MSI32AA.tmpexecutable
MD5:44E75952B658FFE4869CD40DB1299C8F
SHA256:50BBF22DB97433456A4307211B99641740F20A6421BCEE32216FA888FEAA7B2C
7148msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{1e476e75-b5bb-4d6d-998c-3e7b7756ca94}_OnDiskSnapshotPropbinary
MD5:6959F3437A7295844612B91CFD74728E
SHA256:D31E5AFD24BB092BB7393E35E7607AF811FA6771B05E0779A8F0AB3C0EEDB428
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
40
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.151:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2340
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
2340
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEA5NZ%2FZDFskqO3oXzEaXao8%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2340
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhtVltVOu8OqBzmsd%2B%2FeFfks3xTQQUvGsiZZ2MaObmHgXx2HIl1LjgSMACEAvcoEuhCK%2FAlHGPdKmo6gs%3D
unknown
—
—
whitelisted
5728
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5728
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.151:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2340
msiexec.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7896
svchost.exe
2.19.106.8:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.151
  • 23.48.23.154
  • 23.48.23.153
  • 23.48.23.155
  • 23.48.23.141
  • 23.48.23.144
  • 23.48.23.140
  • 23.48.23.149
  • 23.48.23.142
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
login.live.com
  • 20.190.160.130
  • 20.190.160.5
  • 20.190.160.66
  • 40.126.32.74
  • 20.190.160.131
  • 40.126.32.68
  • 20.190.160.67
  • 20.190.160.17
whitelisted
go.microsoft.com
  • 2.19.106.8
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ver_0129321974_qj2dlsdue9n.msi