File name:

Panda Endpoint Agent.msi

Full analysis: https://app.any.run/tasks/9edf722a-9ef4-45c0-a2e2-40466ad24a8f
Verdict: Malicious activity
Analysis date: October 13, 2021, 01:58:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Endpoint Agent, Subject: Endpoint Agent, Author: Panda Security S.L.U., Keywords: Installer,MSI,Database, Comments: Endpoint Agent, Create Time/Date: Wed Jun 9 16:40:08 2021, Name of Creating Application: InstallShield 2011 - Professional Edition 17, Security: 1, Template: ;0,1033,1035,1036,1031,1038,1040,1041,2070,1049,1034,1053, Last Saved By: ;0, Revision Number: {CFF58A12-D4A0-46A4-8B7D-862EEEA73392}2.14.00;{CFF58A12-D4A0-46A4-8B7D-862EEEA73392}2.14.00;{899BEE88-7F2E-4798-B509-DCDBA79705A4}, Number of Pages: 200, Number of Characters: 1
MD5:

7B62A1E550BA595B76531F83DC937A45

SHA1:

61BF965D0FC8FCAE877FD0D2B5AFD771FA27767A

SHA256:

2D1BE27F5824985FB1CFE8750EECF7ACE059DB50776DE7635DF16AA0D0684F0F

SSDEEP:

393216:4rNYgilS5qaO5aQl/pbS2zetfHOlRKyEnH3EPh3p8KV:4rW/xmyetfHOlQXn0PRD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • MsiExec.exe (PID: 3204)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3204)
      • MsiExec.exe (PID: 2596)
      • MsiExec.exe (PID: 3428)
      • AgentSvc.exe (PID: 4052)
      • AgentSvc.exe (PID: 2236)
      • UserInteraction.exe (PID: 884)
      • UserInteraction.exe (PID: 4048)
      • MsiExec.exe (PID: 1876)

    • Application was dropped or rewritten from another process

      • PsMsiExe.exe (PID: 2112)
      • tracelog.exe (PID: 3780)
      • PsMsiExe.exe (PID: 984)
      • AgentSvc.exe (PID: 4052)
      • tracelog.exe (PID: 580)
      • AgentSvc.exe (PID: 2236)
      • UserInteraction.exe (PID: 884)
      • tracelog.exe (PID: 2420)
      • tracelog.exe (PID: 1292)
      • UserInteraction.exe (PID: 4048)
      • PsMsiExe.exe (PID: 2376)
      • tracelog.exe (PID: 3088)
      • tracelog.exe (PID: 388)

    • Adds new firewall rule via NETSH.EXE

      • AgentSvc.exe (PID: 2236)

    • Changes settings of System certificates

      • AgentSvc.exe (PID: 2236)

  • SUSPICIOUS

    • Executed as Windows Service

      • msiexec.exe (PID: 1104)
      • vssvc.exe (PID: 1320)
      • AgentSvc.exe (PID: 2236)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 3876)
      • msiexec.exe (PID: 1104)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 3876)
      • msiexec.exe (PID: 1104)

    • Application launched itself

      • msiexec.exe (PID: 1104)

    • Drops a file that was compiled in debug mode

      • MsiExec.exe (PID: 3204)
      • msiexec.exe (PID: 3876)
      • msiexec.exe (PID: 1104)

    • Drops a file with too old compile date

      • MsiExec.exe (PID: 3204)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3876)
      • MsiExec.exe (PID: 3204)
      • MsiExec.exe (PID: 3428)
      • msiexec.exe (PID: 1104)

    • Reads Environment values

      • MsiExec.exe (PID: 3204)
      • PsMsiExe.exe (PID: 2112)
      • vssvc.exe (PID: 1320)
      • MsiExec.exe (PID: 2596)
      • PsMsiExe.exe (PID: 984)
      • MsiExec.exe (PID: 3428)
      • netsh.exe (PID: 564)
      • AgentSvc.exe (PID: 2236)
      • netsh.exe (PID: 3620)
      • netsh.exe (PID: 1232)
      • UserInteraction.exe (PID: 884)
      • MsiExec.exe (PID: 1876)
      • PsMsiExe.exe (PID: 2376)

    • Checks supported languages

      • tracelog.exe (PID: 3780)
      • PsMsiExe.exe (PID: 2112)
      • PsMsiExe.exe (PID: 984)
      • tracelog.exe (PID: 580)
      • AgentSvc.exe (PID: 4052)
      • AgentSvc.exe (PID: 2236)
      • UserInteraction.exe (PID: 884)
      • tracelog.exe (PID: 1292)
      • tracelog.exe (PID: 2420)
      • UserInteraction.exe (PID: 4048)
      • PsMsiExe.exe (PID: 2376)
      • tracelog.exe (PID: 3088)
      • tracelog.exe (PID: 388)

    • Creates files in the program directory

      • PsMsiExe.exe (PID: 2112)
      • tracelog.exe (PID: 580)
      • msiexec.exe (PID: 1104)
      • MsiExec.exe (PID: 3428)
      • MsiExec.exe (PID: 3204)
      • AgentSvc.exe (PID: 2236)
      • UserInteraction.exe (PID: 884)
      • UserInteraction.exe (PID: 4048)
      • MsiExec.exe (PID: 1876)
      • tracelog.exe (PID: 3088)

    • Creates a directory in Program Files

      • MsiExec.exe (PID: 3204)
      • msiexec.exe (PID: 1104)

    • Reads the computer name

      • AgentSvc.exe (PID: 4052)
      • AgentSvc.exe (PID: 2236)
      • UserInteraction.exe (PID: 884)
      • UserInteraction.exe (PID: 4048)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1104)
      • MsiExec.exe (PID: 1876)

    • Uses NETSH.EXE for network configuration

      • AgentSvc.exe (PID: 2236)

    • Searches for installed software

      • UserInteraction.exe (PID: 884)
      • msiexec.exe (PID: 1104)
      • AgentSvc.exe (PID: 2236)
      • MsiExec.exe (PID: 1876)

    • Adds / modifies Windows certificates

      • AgentSvc.exe (PID: 2236)

    • Creates files in the Windows directory

      • MsiExec.exe (PID: 1876)
      • AgentSvc.exe (PID: 2236)
      • PsMsiExe.exe (PID: 2376)
      • msiexec.exe (PID: 1104)

    • Removes files from Windows directory

      • AgentSvc.exe (PID: 2236)
      • MsiExec.exe (PID: 1876)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 3876)
      • msiexec.exe (PID: 1104)
      • MsiExec.exe (PID: 3204)
      • vssvc.exe (PID: 1320)
      • MsiExec.exe (PID: 2596)
      • MsiExec.exe (PID: 3428)
      • netsh.exe (PID: 564)
      • netsh.exe (PID: 1232)
      • netsh.exe (PID: 3620)
      • MsiExec.exe (PID: 1876)

    • Reads the computer name

      • msiexec.exe (PID: 3876)
      • msiexec.exe (PID: 1104)
      • MsiExec.exe (PID: 3204)
      • vssvc.exe (PID: 1320)
      • MsiExec.exe (PID: 2596)
      • MsiExec.exe (PID: 3428)
      • netsh.exe (PID: 564)
      • netsh.exe (PID: 3620)
      • netsh.exe (PID: 1232)
      • MsiExec.exe (PID: 1876)

    • Reads settings of System Certificates

      • msiexec.exe (PID: 3876)
      • MsiExec.exe (PID: 3204)
      • MsiExec.exe (PID: 2596)
      • msiexec.exe (PID: 1104)
      • AgentSvc.exe (PID: 2236)
      • UserInteraction.exe (PID: 884)
      • MsiExec.exe (PID: 1876)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3876)
      • MsiExec.exe (PID: 3204)
      • MsiExec.exe (PID: 2596)
      • msiexec.exe (PID: 1104)
      • UserInteraction.exe (PID: 884)
      • MsiExec.exe (PID: 1876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (78)
.mst | Windows SDK Setup Transform Script (8.8)
.msp | Windows Installer Patch (7.2)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Characters: -
LastModifiedBy: InstallShield
Words: -
Title: Endpoint Agent
Keywords: Installer,MSI,Database
Subject: Endpoint Agent
Author: Panda Security S.L.U.
Security: Password protected
Pages: 200
Software: InstallShield? 2011 - Professional Edition 17
ModifyDate: 2021:06:09 15:40:08
CreateDate: 2021:06:09 15:40:08
LastPrinted: 2021:06:09 15:40:08
CodePage: Unknown (0)
Template: ;1033,1031,1034,1035,1036,1038,1040,1041,1049,1053,2070
Comments: 1.18.00.0000
RevisionNumber: {1DDB3DA0-1A2B-489B-BB71-0A11C98FE621}
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
23
Malicious processes
11
Suspicious processes
6

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start msiexec.exe msiexec.exe msiexec.exe tracelog.exe no specs psmsiexe.exe no specs vssvc.exe no specs msiexec.exe no specs psmsiexe.exe no specs msiexec.exe tracelog.exe no specs agentsvc.exe no specs agentsvc.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs userinteraction.exe no specs tracelog.exe no specs tracelog.exe no specs userinteraction.exe no specs msiexec.exe no specs tracelog.exe no specs psmsiexe.exe no specs tracelog.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
388"C:\Windows\TEMP\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe" -stop "InstAppLog_2480.etl"C:\Windows\TEMP\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe—MsiExec.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\temp\{509151ac-c664-40d8-91f9-55b9fe101f9d}\tracelog.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
564"netsh.exe" advfirewall firewall delete rule name="Panda Endpoint Agent"C:\Windows\system32\netsh.exe—AgentSvc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
580"C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe" -start "InstAppLog_A963.etl" -rt -guid "C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\GUIDs.txt" -f "C:\ProgramData\Panda Security\PSLogs\InstAppLog_A963.etl" -level 5 -flags 255 -UseCPUCycle -gs -seq 5C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe—MsiExec.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{509151ac-c664-40d8-91f9-55b9fe101f9d}\tracelog.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
884"C:\Program Files\Panda Security\Panda Aether Agent\Additional files\UserInteraction.exe" /MsgType:3 /Language:1 /CustomId:0C:\Program Files\Panda Security\Panda Aether Agent\Additional files\UserInteraction.exe—AgentSvc.exe
User:
admin
Company:
Panda Security S.L.
Integrity Level:
MEDIUM
Description:
User Interaction
Exit code:
0
Version:
1.18.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\panda security\panda aether agent\additional files\userinteraction.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
984"C:\Users\admin\AppData\Local\Temp\{50915~1\PsMsiExe.exe" /GetSO:"C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\SoFile.ini"C:\Users\admin\AppData\Local\Temp\{50915~1\PsMsiExe.exe—MsiExec.exe
User:
admin
Company:
Panda Security, S.L.
Integrity Level:
MEDIUM
Description:
PSMSI
Exit code:
0
Version:
9.0.21.0
Modules
Images
c:\users\admin\appdata\local\temp\{509151ac-c664-40d8-91f9-55b9fe101f9d}\psmsiexe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1104C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1232"netsh.exe" advfirewall firewall add rule name="Panda Endpoint Agent" dir=in program="C:\Program Files\Panda Security\Panda Aether Agent\AgentSvc.exe" action=allow profile=any protocol=tcpC:\Windows\system32\netsh.exe—AgentSvc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\credui.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1292"C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe" -stop "InstAppLog_A963.etl"C:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\tracelog.exe—MsiExec.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{509151ac-c664-40d8-91f9-55b9fe101f9d}\tracelog.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1320C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft� Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1876C:\Windows\system32\MsiExec.exe -Embedding 60A79F6F27C382F315A3FA59FD445ECB E Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
49 692
Read events
47 985
Write events
1 674
Delete events
33

Modification events

(PID) Process:(3876) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3204) MsiExec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1104) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000009A1A93EED5BFD70150040000140A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1104) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000009A1A93EED5BFD70150040000140A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1104) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
67
(PID) Process:(1104) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
400000000000000064B5CEEED5BFD70150040000140A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1104) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000064B5CEEED5BFD70150040000A80B0000E8030000010000000000000000000000CFA043FA5DA15B449A38B838446D7A9C0000000000000000
(PID) Process:(1320) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000026A1DAEED5BFD7012805000020040000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1320) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000026A1DAEED5BFD70128050000BC0E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1320) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000026A1DAEED5BFD701280500008C0C0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
210
Suspicious files
73
Text files
169
Unknown types
10

Dropped files

PID
Process
Filename
Type
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\PsMsiExe.exeexecutable
MD5:—
SHA256:—
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\MainIcon.icoimage
MD5:99DFB32EC704E39FC35725F96ECA0693
SHA256:275F24256783FF46C57B968557776EB438B094F15AC7A5164A015C825B87AE08
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\MsiZap.Exe.manifestxml
MD5:B4E2C5FB782AB4605E503D8383EF6203
SHA256:F9D9405FDEE16CB40C654D89071B026284AD4E93D09AF5FA158281A407BFAF55
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\66FD.tmp\Data1.cab —
MD5:—
SHA256:—
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\MsiZap.Exeexecutable
MD5:684BD9B14B0AA1F2DDA3EECD344197F2
SHA256:43E6671FF12F07B2795FF448EBBF83DE6E0D6ACC465478E97DB83DFBCCDEB5E4
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\psLogAnalyzer.dllexecutable
MD5:—
SHA256:—
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\UpgHlp.exeexecutable
MD5:—
SHA256:—
3876msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI6362.tmpexecutable
MD5:—
SHA256:—
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\GUIDs.txttext
MD5:48A93DC113D57C270F782CB5932EFF57
SHA256:18593E9DD2AF6E1BA8F18C7613B6AB3C865E5861B0F369B6FF5A439D5CCAB903
3204MsiExec.exeC:\Users\admin\AppData\Local\Temp\{509151AC-C664-40D8-91F9-55B9FE101F9D}\psUniqueExecution.initext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
25
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2236
AgentSvc.exe
GET
200
92.123.225.57:80
http://proinfo.pandasecurity.com/connectiontest.html
unknown
binary
1 b
suspicious
2236
AgentSvc.exe
GET
200
92.123.225.57:80
http://proinfo.pandasecurity.com/connectiontest.html
unknown
binary
1 b
suspicious
2236
AgentSvc.exe
GET
200
92.123.225.57:80
http://proinfo.pandasecurity.com/connectiontest.html
unknown
binary
1 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
Microsoft Corporation
GB
whitelisted
1936
svchost.exe
51.124.78.146:443
—
Microsoft Corporation
GB
whitelisted
2236
AgentSvc.exe
13.74.59.223:443
endpointpws.aether.pandasecurity.com
Microsoft Corporation
IE
unknown
2236
AgentSvc.exe
137.135.229.184:443
commandhubws.aether.pandasecurity.com
Microsoft Corporation
IE
unknown
2236
AgentSvc.exe
92.123.225.57:80
proinfo.pandasecurity.com
Akamai International B.V.
—
whitelisted
2236
AgentSvc.exe
40.113.9.184:443
endpointws.aether.pandasecurity.com
Microsoft Corporation
IE
unknown
2236
AgentSvc.exe
104.89.38.190:443
repository.pandasecurity.com
Akamai Technologies, Inc.
NL
unknown
2236
AgentSvc.exe
104.111.243.23:443
repository.pandasecurity.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
endpointpws.aether.pandasecurity.com
  • 13.74.59.223
unknown
commandhubws.aether.pandasecurity.com
  • 137.135.229.184
unknown
proinfo.pandasecurity.com
  • 92.123.225.57
  • 92.123.225.40
suspicious
endpointws.aether.pandasecurity.com
  • 40.113.9.184
unknown
repository.pandasecurity.com
  • 104.89.38.190
  • 104.111.243.23
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Panda Endpoint Agent.msi