File name:

Panda Endpoint Agent.msi

Full analysis: https://app.any.run/tasks/9edf722a-9ef4-45c0-a2e2-40466ad24a8f
Verdict: Malicious activity
Analysis date: October 13, 2021, 01:58:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Endpoint Agent, Subject: Endpoint Agent, Author: Panda Security S.L.U., Keywords: Installer,MSI,Database, Comments: Endpoint Agent, Create Time/Date: Wed Jun 9 16:40:08 2021, Name of Creating Application: InstallShield 2011 - Professional Edition 17, Security: 1, Template: ;0,1033,1035,1036,1031,1038,1040,1041,2070,1049,1034,1053, Last Saved By: ;0, Revision Number: {CFF58A12-D4A0-46A4-8B7D-862EEEA73392}2.14.00;{CFF58A12-D4A0-46A4-8B7D-862EEEA73392}2.14.00;{899BEE88-7F2E-4798-B509-DCDBA79705A4}, Number of Pages: 200, Number of Characters: 1
MD5:

7B62A1E550BA595B76531F83DC937A45

SHA1:

61BF965D0FC8FCAE877FD0D2B5AFD771FA27767A

SHA256:

2D1BE27F5824985FB1CFE8750EECF7ACE059DB50776DE7635DF16AA0D0684F0F

SSDEEP:

393216:4rNYgilS5qaO5aQl/pbS2zetfHOlRKyEnH3EPh3p8KV:4rW/xmyetfHOlQXn0PRD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • MsiExec.exe (PID: 3204)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3204)
      • MsiExec.exe (PID: 2596)
      • MsiExec.exe (PID: 3428)
      • AgentSvc.exe (PID: 4052)
      • AgentSvc.exe (PID: 2236)
      • UserInteraction.exe (PID: 884)
      • UserInteraction.exe (PID: 4048)
      • MsiExec.exe (PID: 1876)

    • Application was dropped or rewritten from another process

      • PsMsiExe.exe (PID: 2112)
      • tracelog.exe (PID: 3780)
      • PsMsiExe.exe (PID: 984)
      • tracelog.exe (PID: 580)
      • AgentSvc.exe (PID: 4052)
      • AgentSvc.exe (PID: 2236)
      • UserInteraction.exe (PID: 884)
      • tracelog.exe (PID: 1292)
      • tracelog.exe (PID: 2420)
      • UserInteraction.exe (PID: 4048)
      • tracelog.exe (PID: 3088)
      • PsMsiExe.exe (PID: 2376)
      • tracelog.exe (PID: 388)

    • Adds new firewall rule via NETSH.EXE

      • AgentSvc.exe (PID: 2236)

    • Changes settings of System certificates

      • AgentSvc.exe (PID: 2236)

  • SUSPICIOUS

    • Executed as Windows Service

      • msiexec.exe (PID: 1104)
      • vssvc.exe (PID: 1320)
      • AgentSvc.exe (PID: 2236)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 3876)
      • msiexec.exe (PID: 1104)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 3876)
      • msiexec.exe (PID: 1104)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3876)
      • MsiExec.exe (PID: 3204)
      • MsiExec.exe (PID: 3428)
      • msiexec.exe (PID: 1104)

    • Application launched itself

      • msiexec.exe (PID: 1104)

    • Drops a file that was compiled in debug mode

      • MsiExec.exe (PID: 3204)
      • msiexec.exe (PID: 3876)
      • msiexec.exe (PID: 1104)

    • Drops a file with too old compile date

      • MsiExec.exe (PID: 3204)

    • Reads Environment values

      • MsiExec.exe (PID: 3204)
      • PsMsiExe.exe (PID: 2112)
      • vssvc.exe (PID: 1320)
      • MsiExec.exe (PID: 2596)
      • PsMsiExe.exe (PID: 984)
      • MsiExec.exe (PID: 3428)
      • netsh.exe (PID: 1232)
      • netsh.exe (PID: 3620)
      • netsh.exe (PID: 564)
      • UserInteraction.exe (PID: 884)
      • AgentSvc.exe (PID: 2236)
      • MsiExec.exe (PID: 1876)
      • PsMsiExe.exe (PID: 2376)

    • Checks supported languages

      • PsMsiExe.exe (PID: 2112)
      • tracelog.exe (PID: 3780)
      • PsMsiExe.exe (PID: 984)
      • tracelog.exe (PID: 580)
      • AgentSvc.exe (PID: 4052)
      • AgentSvc.exe (PID: 2236)
      • UserInteraction.exe (PID: 884)
      • tracelog.exe (PID: 1292)
      • tracelog.exe (PID: 2420)
      • UserInteraction.exe (PID: 4048)
      • tracelog.exe (PID: 3088)
      • tracelog.exe (PID: 388)
      • PsMsiExe.exe (PID: 2376)

    • Creates files in the program directory

      • PsMsiExe.exe (PID: 2112)
      • MsiExec.exe (PID: 3428)
      • MsiExec.exe (PID: 3204)
      • msiexec.exe (PID: 1104)
      • tracelog.exe (PID: 580)
      • UserInteraction.exe (PID: 884)
      • UserInteraction.exe (PID: 4048)
      • AgentSvc.exe (PID: 2236)
      • MsiExec.exe (PID: 1876)
      • tracelog.exe (PID: 3088)

    • Creates a directory in Program Files

      • MsiExec.exe (PID: 3204)
      • msiexec.exe (PID: 1104)

    • Searches for installed software

      • msiexec.exe (PID: 1104)
      • UserInteraction.exe (PID: 884)
      • AgentSvc.exe (PID: 2236)
      • MsiExec.exe (PID: 1876)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1104)
      • MsiExec.exe (PID: 1876)

    • Reads the computer name

      • AgentSvc.exe (PID: 2236)
      • AgentSvc.exe (PID: 4052)
      • UserInteraction.exe (PID: 884)
      • UserInteraction.exe (PID: 4048)

    • Uses NETSH.EXE for network configuration

      • AgentSvc.exe (PID: 2236)

    • Removes files from Windows directory

      • AgentSvc.exe (PID: 2236)
      • MsiExec.exe (PID: 1876)

    • Creates files in the Windows directory

      • AgentSvc.exe (PID: 2236)
      • MsiExec.exe (PID: 1876)
      • PsMsiExe.exe (PID: 2376)
      • msiexec.exe (PID: 1104)

    • Adds / modifies Windows certificates

      • AgentSvc.exe (PID: 2236)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 3876)
      • msiexec.exe (PID: 1104)
      • MsiExec.exe (PID: 3204)
      • vssvc.exe (PID: 1320)
      • MsiExec.exe (PID: 2596)
      • MsiExec.exe (PID: 3428)
      • netsh.exe (PID: 1232)
      • netsh.exe (PID: 3620)
      • netsh.exe (PID: 564)
      • MsiExec.exe (PID: 1876)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3876)
      • MsiExec.exe (PID: 3204)
      • msiexec.exe (PID: 1104)
      • MsiExec.exe (PID: 2596)
      • UserInteraction.exe (PID: 884)
      • MsiExec.exe (PID: 1876)

    • Reads settings of System Certificates

      • msiexec.exe (PID: 3876)
      • MsiExec.exe (PID: 3204)
      • msiexec.exe (PID: 1104)
      • MsiExec.exe (PID: 2596)
      • UserInteraction.exe (PID: 884)
      • AgentSvc.exe (PID: 2236)
      • MsiExec.exe (PID: 1876)

    • Reads the computer name

      • msiexec.exe (PID: 3876)
      • msiexec.exe (PID: 1104)
      • MsiExec.exe (PID: 3204)
      • vssvc.exe (PID: 1320)
      • MsiExec.exe (PID: 2596)
      • MsiExec.exe (PID: 3428)
      • netsh.exe (PID: 564)
      • netsh.exe (PID: 3620)
      • netsh.exe (PID: 1232)
      • MsiExec.exe (PID: 1876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (78)
.mst | Windows SDK Setup Transform Script (8.8)
.msp | Windows Installer Patch (7.2)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Characters: -
LastModifiedBy: InstallShield
Words: -
Title: Endpoint Agent
Keywords: Installer,MSI,Database
Subject: Endpoint Agent
Author: Panda Security S.L.U.
Security: Password protected
Pages: 200
Software: InstallShield? 2011 - Professional Edition 17
ModifyDate: 2021:06:09 15:40:08
CreateDate: 2021:06:09 15:40:08
LastPrinted: 2021:06:09 15:40:08
CodePage: Unknown (0)
Template: ;1033,1031,1034,1035,1036,1038,1040,1041,1049,1053,2070
Comments: 1.18.00.0000
RevisionNumber: {1DDB3DA0-1A2B-489B-BB71-0A11C98FE621}
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
23
Malicious processes
11
Suspicious processes
6

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start msiexec.exe msiexec.exe msiexec.exe tracelog.exe no specs psmsiexe.exe no specs vssvc.exe no specs msiexec.exe no specs psmsiexe.exe no specs msiexec.exe tracelog.exe no specs agentsvc.exe no specs agentsvc.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs userinteraction.exe no specs tracelog.exe no specs tracelog.exe no specs userinteraction.exe no specs msiexec.exe no specs tracelog.exe no specs psmsiexe.exe no specs tracelog.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
388"C:\Windows\TEMP\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe" -stop "InstAppLog_2480.etl"C:\Windows\TEMP\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe—MsiExec.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\temp\{509151ac-c664-40d8-91f9-55b9fe101f9d}\tracelog.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
564"netsh.exe" advfirewall firewall delete rule name="Panda Endpoint Agent"C:\Windows\system32\netsh.exe—AgentSvc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
580"C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe" -start "InstAppLog_A963.etl" -rt -guid "C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\GUIDs.txt" -f "C:\ProgramData\Panda Security\PSLogs\InstAppLog_A963.etl" -level 5 -flags 255 -UseCPUCycle -gs -seq 5C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe—MsiExec.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{509151ac-c664-40d8-91f9-55b9fe101f9d}\tracelog.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
884"C:\Program Files\Panda Security\Panda Aether Agent\Additional files\UserInteraction.exe" /MsgType:3 /Language:1 /CustomId:0C:\Program Files\Panda Security\Panda Aether Agent\Additional files\UserInteraction.exe—AgentSvc.exe
User:
admin
Company:
Panda Security S.L.
Integrity Level:
MEDIUM
Description:
User Interaction
Exit code:
0
Version:
1.18.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\panda security\panda aether agent\additional files\userinteraction.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
984"C:\Users\admin\AppData\Local\Temp\{50915~1\PsMsiExe.exe" /GetSO:"C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\SoFile.ini"C:\Users\admin\AppData\Local\Temp\{50915~1\PsMsiExe.exe—MsiExec.exe
User:
admin
Company:
Panda Security, S.L.
Integrity Level:
MEDIUM
Description:
PSMSI
Exit code:
0
Version:
9.0.21.0
Modules
Images
c:\users\admin\appdata\local\temp\{509151ac-c664-40d8-91f9-55b9fe101f9d}\psmsiexe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1104C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1232"netsh.exe" advfirewall firewall add rule name="Panda Endpoint Agent" dir=in program="C:\Program Files\Panda Security\Panda Aether Agent\AgentSvc.exe" action=allow profile=any protocol=tcpC:\Windows\system32\netsh.exe—AgentSvc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\credui.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1292"C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe" -stop "InstAppLog_A963.etl"C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe—MsiExec.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{509151ac-c664-40d8-91f9-55b9fe101f9d}\tracelog.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1320C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft� Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1876C:\Windows\system32\MsiExec.exe -Embedding 60A79F6F27C382F315A3FA59FD445ECB E Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
49 692
Read events
47 985
Write events
1 674
Delete events
33

Modification events

(PID) Process:(3876) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3204) MsiExec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1104) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000009A1A93EED5BFD70150040000140A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1104) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000009A1A93EED5BFD70150040000140A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1104) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
67
(PID) Process:(1104) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
400000000000000064B5CEEED5BFD70150040000140A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1104) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000064B5CEEED5BFD70150040000A80B0000E8030000010000000000000000000000CFA043FA5DA15B449A38B838446D7A9C0000000000000000
(PID) Process:(1320) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000026A1DAEED5BFD7012805000020040000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1320) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000026A1DAEED5BFD70128050000BC0E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1320) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000026A1DAEED5BFD701280500008C0C0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
210
Suspicious files
73
Text files
169
Unknown types
10

Dropped files

PID
Process
Filename
Type
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\MsiZap.Exeexecutable
MD5:684BD9B14B0AA1F2DDA3EECD344197F2
SHA256:43E6671FF12F07B2795FF448EBBF83DE6E0D6ACC465478E97DB83DFBCCDEB5E4
3876msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5E70.tmpexecutable
MD5:E514C184FD59569180F9E29648481F64
SHA256:E886026008391AEC859DB251FFF4C9A55A45C50C227E4063D336835073F25745
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\psUniqueExecution.initext
MD5:—
SHA256:—
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\66FD.tmp\Data1.cab —
MD5:—
SHA256:—
3876msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI6362.tmpexecutable
MD5:—
SHA256:—
3876msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI6392.tmpexecutable
MD5:—
SHA256:—
3876msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI6410.tmpexecutable
MD5:—
SHA256:—
3876msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI6569.tmpexecutable
MD5:—
SHA256:—
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\PsMsiExe.exeexecutable
MD5:—
SHA256:—
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\psLogAnalyzer.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
25
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2236
AgentSvc.exe
GET
200
92.123.225.57:80
http://proinfo.pandasecurity.com/connectiontest.html
unknown
binary
1 b
suspicious
2236
AgentSvc.exe
GET
200
92.123.225.57:80
http://proinfo.pandasecurity.com/connectiontest.html
unknown
binary
1 b
suspicious
2236
AgentSvc.exe
GET
200
92.123.225.57:80
http://proinfo.pandasecurity.com/connectiontest.html
unknown
binary
1 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
Microsoft Corporation
GB
whitelisted
1936
svchost.exe
51.124.78.146:443
—
Microsoft Corporation
GB
whitelisted
2236
AgentSvc.exe
13.74.59.223:443
endpointpws.aether.pandasecurity.com
Microsoft Corporation
IE
unknown
2236
AgentSvc.exe
137.135.229.184:443
commandhubws.aether.pandasecurity.com
Microsoft Corporation
IE
unknown
2236
AgentSvc.exe
92.123.225.57:80
proinfo.pandasecurity.com
Akamai International B.V.
—
whitelisted
2236
AgentSvc.exe
40.113.9.184:443
endpointws.aether.pandasecurity.com
Microsoft Corporation
IE
unknown
2236
AgentSvc.exe
104.89.38.190:443
repository.pandasecurity.com
Akamai Technologies, Inc.
NL
unknown
2236
AgentSvc.exe
104.111.243.23:443
repository.pandasecurity.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
endpointpws.aether.pandasecurity.com
  • 13.74.59.223
unknown
commandhubws.aether.pandasecurity.com
  • 137.135.229.184
unknown
proinfo.pandasecurity.com
  • 92.123.225.57
  • 92.123.225.40
suspicious
endpointws.aether.pandasecurity.com
  • 40.113.9.184
unknown
repository.pandasecurity.com
  • 104.89.38.190
  • 104.111.243.23
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Panda Endpoint Agent.msi