File name:

Server_Certificate.msi

Full analysis: https://app.any.run/tasks/9ced1478-1c8d-47f9-98a2-e468641eb5a8
Verdict: Malicious activity
Analysis date: May 16, 2025, 15:00:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
exe-to-msi
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5:

C58D16762A12320418757EAF3C58789E

SHA1:

7720B07CD08C9556A466A6A076C89E85C98F3F3D

SHA256:

472E1E73419968BB61C8123E2CACE1F767942809F807AAF6D62B535399122606

SSDEEP:

98304:Re0dKWU8pMOri6pi2i2ZzXRdGeP6ywAh66PO7COgzlz3HeqjI8Lj605w/y6lZ6Ai:FrkMrt73

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Drops the ExeToMSI Application

      • msiexec.exe (PID: 6044)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6192)
      • dwagsvc.exe (PID: 7280)

    • Executable content was dropped or overwritten

      • MSIE.tmp (PID: 7700)
      • skype.exe (PID: 7964)

    • The process drops C-runtime libraries

      • MSIE.tmp (PID: 7700)
      • skype.exe (PID: 7964)

    • Process drops python dynamic module

      • MSIE.tmp (PID: 7700)
      • skype.exe (PID: 7964)

    • Process drops legitimate windows executable

      • MSIE.tmp (PID: 7700)
      • skype.exe (PID: 7964)

    • Starts CMD.EXE for commands execution

      • skype.exe (PID: 7964)

    • There is functionality for taking screenshot (YARA)

      • MSIE.tmp (PID: 7700)
      • skype.exe (PID: 5968)
      • skype.exe (PID: 7668)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 6416)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 4608)

    • Checks supported languages

      • msiexec.exe (PID: 4608)

    • Manages system restore points

      • SrTasks.exe (PID: 7568)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4608)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 4608)

    • The sample compiled with english language support

      • MSIE.tmp (PID: 7700)
      • skype.exe (PID: 7964)

    • Manual execution by a user

      • dwaglnc.exe (PID: 8028)
      • cmd.exe (PID: 6416)
      • firefox.exe (PID: 3020)

    • Application launched itself

      • firefox.exe (PID: 3020)
      • firefox.exe (PID: 7984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
LastPrinted: 2012:09:21 09:56:09
CreateDate: 2012:09:21 09:56:09
Software: Windows Installer
Title: Exe to msi converter free
Subject: -
Author: www.exetomsi.com
Keywords: -
Comments: -
Template: ;0
LastModifiedBy: devuser
RevisionNumber: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}
ModifyDate: 2013:05:21 11:56:44
Pages: 100
Words: -
Security: None
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
197
Monitored processes
57
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msie.tmp skype.exe cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs dwagsvc.exe no specs skype.exe cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs cmd.exe no specs conhost.exe no specs dwaglnc.exe no specs skype.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs slui.exe dwaglnc.exe no specs skype.exe no specs dwaglnc.exe no specs skype.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864"C:\Program Files\Skype\native\dwagsvc.exe" deleteServiceC:\Program Files\Skype\native\dwagsvc.exe—cmd.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\program files\skype\native\dwagsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
976"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3964 -childID 3 -isForBrowser -prefsHandle 3688 -prefMapHandle 5060 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1524 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d03c0d2-c3b0-4ae7-b99c-dc935b71f3bc} 7984 "\\.\pipe\gecko-crash-server-pipe.7984" 24d19036a10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
1676C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files\Skype\native\dwagsvc.exe" startService"C:\Windows\System32\cmd.exe—skype.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1852"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3140 -childID 4 -isForBrowser -prefsHandle 4896 -prefMapHandle 4868 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1524 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {586d3c26-b17f-4730-beaa-ca3ea58e14a1} 7984 "\\.\pipe\gecko-crash-server-pipe.7984" 24d19036d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2096"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5180 -childID 5 -isForBrowser -prefsHandle 5172 -prefMapHandle 3964 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1524 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {534da2c5-7de0-47e4-9b5f-352bb2a8db24} 7984 "\\.\pipe\gecko-crash-server-pipe.7984" 24d1c3c94d0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\vcruntime140.dll
2656C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files\Skype\native\dwagsvc.exe" removeShortcuts"C:\Windows\System32\cmd.exe—skype.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3020"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
3268"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 7 -isForBrowser -prefsHandle 5352 -prefMapHandle 5612 -prefsLen 31567 -prefMapSize 244583 -jsInitHandle 1524 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4d2df6e-3f27-4961-8235-204a435e1d1f} 7984 "\\.\pipe\gecko-crash-server-pipe.7984" 24d180dbf50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1.dll
Total events
18 957
Read events
18 758
Write events
181
Delete events
18

Modification events

(PID) Process:(6192) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000007C107D5173C6DB0130180000F4180000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6192) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000007C107D5173C6DB0130180000C0030000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6192) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000007C107D5173C6DB013018000080180000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6192) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000007C107D5173C6DB01301800000C180000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6192) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(6192) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4800000000000000B8D6815173C6DB01301800000C180000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6192) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(6192) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(6192) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
(PID) Process:(6192) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:delete keyName:(default)
Value:
Executable files
70
Suspicious files
1 249
Text files
112
Unknown types
0

Dropped files

PID
Process
Filename
Type
4608msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
4608msiexec.exeC:\Windows\Installer\10fabd.msi —
MD5:—
SHA256:—
4608msiexec.exeC:\Windows\Installer\MSIFF70.tmp —
MD5:—
SHA256:—
7700MSIE.tmpC:\Users\admin\AppData\Local\Temp\MSIE20250516150108\win.7z —
MD5:—
SHA256:—
4608msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:599DBBECD57CB37B43CDC756DE6D2FBE
SHA256:386F361BBEA0C98E17B4938D285F73E7DC06FEE813A63FE341B272B437D64473
4608msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{caac562c-ab75-4468-9221-067f75df10ab}_OnDiskSnapshotPropbinary
MD5:599DBBECD57CB37B43CDC756DE6D2FBE
SHA256:386F361BBEA0C98E17B4938D285F73E7DC06FEE813A63FE341B272B437D64473
7700MSIE.tmpC:\Users\admin\AppData\Local\Temp\MSIE20250516150108\runtime\bit64\DLLs\_elementtree.pydexecutable
MD5:F9D164C37E8D72E2BE240A2755FDCE53
SHA256:099F356F4E009EF551F483EB009D39516D49E924C93B365E1F759F2686A6D8A8
4608msiexec.exeC:\Windows\Temp\~DFAD0EBDCEF3250226.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
4608msiexec.exeC:\Windows\Temp\~DF7589D8CDFBD42868.TMPbinary
MD5:719611E08F097DA9FD303659B57BC4F8
SHA256:5414FB64C4B49E4CDACE420F7BED5D74CF0638E52F7AC65FB47DD0FF3EBDCD9E
7700MSIE.tmpC:\Users\admin\AppData\Local\Temp\MSIE20250516150108\runtime\bit64\DLLs\pyexpat.pydexecutable
MD5:2A69DAB6A61D6837F3F597EA44E5415B
SHA256:24B321A24C67B6AFB095F9BDC38FF1ECF74E95B59928FA36E6011C2FC37E4B96
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
44
TCP/UDP connections
132
DNS requests
141
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7812
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7812
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7984
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7984
firefox.exe
POST
200
184.24.77.71:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.110
  • 172.217.16.206
  • 2a00:1450:4001:829::200e
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.131
  • 40.126.31.3
  • 20.190.159.64
  • 40.126.31.71
  • 40.126.31.67
  • 20.190.159.131
  • 20.190.159.130
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 2.19.106.8
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Server_Certificate.msi