File name:

installer.msi

Full analysis: https://app.any.run/tasks/dd334329-4c52-4dc7-a7f0-6a800eeed7ce
Verdict: Malicious activity
Analysis date: May 10, 2025, 03:32:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
delphi
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: XKCul, Author: nmweYOYspv, Keywords: Installer, Comments: This installer database contains the logic and data required to install XKCul., Template: Intel;1033, Revision Number: {5EF3F2C7-20CC-4C6B-9383-256B027B0519}, Create Time/Date: Thu May 8 12:53:08 2025, Last Saved Time/Date: Thu May 8 12:53:08 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

C9F15A59C155B934A6A59802F8FF6AE7

SHA1:

FFA38CF8F2EB664241A39A78CEBE55075F8D734B

SHA256:

4C7A463B08571D7329206265BB1583250FBFC2D3EC9CF69B120C91F3049DB7E3

SSDEEP:

196608:QXFimfDj/fzO6FOXxRVF3A1xEv2dOip/ZkTko:QsUDjXS6FOXxRvA1J/ZkIo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 4200)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2344)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 3768)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 4200)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 4200)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 4200)

    • Executes application which crashes

      • ASCTray.exe (PID: 6632)

    • There is functionality for taking screenshot (YARA)

      • ASCTray.exe (PID: 6632)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 2264)
      • SecureBootEncodeUEFI.exe (PID: 4180)

  • INFO

    • The sample compiled with english language support

      • msiexec.exe (PID: 6744)
      • msiexec.exe (PID: 4200)

    • Reads the computer name

      • msiexec.exe (PID: 4200)

    • Checks supported languages

      • msiexec.exe (PID: 4200)

    • Manages system restore points

      • SrTasks.exe (PID: 3332)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4200)

    • Compiled with Borland Delphi (YARA)

      • ASCTray.exe (PID: 6632)

    • Manual execution by a user

      • control.exe (PID: 6624)

    • Encodes the UEFI Secure Boot certificates

      • SecureBootEncodeUEFI.exe (PID: 4180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: XKCul
Author: nmweYOYspv
Keywords: Installer
Comments: This installer database contains the logic and data required to install XKCul.
Template: Intel;1033
RevisionNumber: {5EF3F2C7-20CC-4C6B-9383-256B027B0519}
CreateDate: 2025:05:08 12:53:08
ModifyDate: 2025:05:08 12:53:08
Pages: 200
Words: 10
Software: Windows Installer XML Toolset (3.11.2.4516)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
445
Monitored processes
16
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs asctray.exe diskdefrag_16933.exe no specs asctray.exe no specs werfault.exe no specs slui.exe control.exe no specs plugscheduler.exe no specs securebootencodeuefi.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1180"C:\ProgramData\Obit-3091\DiskDefrag_16933.exe" C:\ProgramData\Obit-3091\DiskDefrag_16933.exe—powershell.exe
User:
admin
Company:
IObit
Integrity Level:
MEDIUM
Description:
Advanced SystemCare Disk Defrag
Exit code:
0
Version:
1.0.0.11
Modules
Images
c:\programdata\obit-3091\diskdefrag_16933.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SecureBootEncodeUEFI.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2240"C:\ProgramData\Obit-3091\ASCTray.exe" /diskdefragC:\ProgramData\Obit-3091\ASCTray.exe—DiskDefrag_16933.exe
User:
admin
Company:
IObit
Integrity Level:
MEDIUM
Description:
Advanced SystemCare Tray
Exit code:
0
Version:
18.0.0.1034
Modules
Images
c:\programdata\obit-3091\asctray.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
2264"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2344powershell.exe -NoProfile -ExecutionPolicy Bypass -File ".\run_hidden.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3024C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3332C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3768C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3956C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6632 -s 1148C:\Windows\SysWOW64\WerFault.exe—ASCTray.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4180"C:\WINDOWS\system32\SecureBootEncodeUEFI.exe"C:\Windows\System32\SecureBootEncodeUEFI.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Secure Boot UEFI Encoder
Exit code:
3221225728
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\securebootencodeuefi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
13 553
Read events
13 255
Write events
280
Delete events
18

Modification events

(PID) Process:(4200) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000514ABB3B5CC1DB016810000004170000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4200) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000514ABB3B5CC1DB016810000004170000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4200) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000931F113C5CC1DB016810000004170000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4200) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000931F113C5CC1DB016810000004170000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4200) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000074AE1A3C5CC1DB016810000004170000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4200) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000E5611F3C5CC1DB016810000004170000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4200) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(4200) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000F054A73C5CC1DB016810000004170000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4200) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000002C1BAC3C5CC1DB0168100000A8120000E80300000100000000000000000000001A8A99984B365E48AF9C7DD09FC3D66A00000000000000000000000000000000
(PID) Process:(3768) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000085FFB73C5CC1DB01B80E0000001A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
13
Suspicious files
68
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
4200msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
4200msiexec.exeC:\Windows\Installer\112b14.msi —
MD5:—
SHA256:—
4200msiexec.exeC:\ProgramData\Obit-3091\asas.dmp —
MD5:—
SHA256:—
4200msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:0A432208C992CFEA514CC557968D6062
SHA256:4CB309CE2631FB2AAA3A73D8C16BC9FD26D08D4C72C0E626775F71C1EF591860
4200msiexec.exeC:\ProgramData\Obit-3091\sk4d.dllexecutable
MD5:3155BB41C5175902BABA7BF100E10D70
SHA256:38C1D2F4888852B23C540FFDFF38BE2AB24CB14C4BED86AE762F532377772319
4200msiexec.exeC:\Windows\Installer\112b16.msi —
MD5:—
SHA256:—
4200msiexec.exeC:\Windows\Installer\MSI2D76.tmpbinary
MD5:1E2D66D3E59EA47F1137EFE3687BC312
SHA256:4E908FD9B77E38999A8D2E9F3E7DC3989E63D599D32569395AB9F835746F48B1
4200msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:FCDC1AB1792FBFDDBE142C426C6853B6
SHA256:952D5B4125F7DB1DF9983D5AE7859B06584F6B4113324DF45AD75E7147E9B0D3
4200msiexec.exeC:\Windows\Temp\~DF95068F8595813EC3.TMPbinary
MD5:0A432208C992CFEA514CC557968D6062
SHA256:4CB309CE2631FB2AAA3A73D8C16BC9FD26D08D4C72C0E626775F71C1EF591860
4200msiexec.exeC:\ProgramData\Obit-3091\datastate.dllexecutable
MD5:03747F3976FDC72A164BF39F5B913219
SHA256:DBA68477E74D419AE02BA257CCBFFC62AA6BEED4C2F2688DD37FA0F805394311
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
251
TCP/UDP connections
204
DNS requests
55
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
856
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.216.77.29:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
856
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
40.69.42.241:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
856
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
856
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
POST
403
184.30.21.171:443
https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409
unknown
html
386 b
whitelisted
—
—
POST
200
20.190.160.4:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2028
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
23.216.77.29:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
856
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
crl.microsoft.com
  • 23.216.77.29
  • 23.216.77.7
  • 23.216.77.31
  • 23.216.77.21
  • 23.216.77.42
  • 23.216.77.5
  • 23.216.77.11
  • 23.216.77.13
  • 23.216.77.20
  • 23.216.77.24
  • 23.216.77.40
  • 23.216.77.39
  • 23.216.77.32
  • 23.216.77.22
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.20
  • 20.190.160.3
  • 20.190.160.67
  • 20.190.160.65
  • 40.126.32.140
  • 20.190.160.66
  • 40.126.32.76
  • 40.126.32.138
  • 20.190.160.17
  • 40.126.32.68
  • 20.190.160.4
  • 20.190.160.14
  • 40.126.31.3
  • 40.126.31.1
  • 40.126.31.131
  • 20.190.159.2
  • 20.190.159.75
  • 40.126.31.129
  • 20.190.159.23
  • 40.126.31.2
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
go.microsoft.com
  • 184.30.18.9
  • 2.19.106.8
  • 95.100.186.9
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 20.73.194.208
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
installer.msi