File name:

CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe

Full analysis: https://app.any.run/tasks/f9e6af33-08de-46d5-b79b-8682e111bb3d
Verdict: Malicious activity
Analysis date: June 25, 2025, 20:54:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
screenconnect
rmm-tool
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

C33D01C9C638DFB030270FB15BEBB493

SHA1:

4A824010554F5C6ABFF3E7A6BAC5C483AFA3B88D

SHA256:

54EB8C8D76135A6757B1D0116DDED9C8031020A49F1DDC364A8BD0FB5C647E55

SSDEEP:

98304:uahxA3yFBPR3ipsn6lev+KNCOytH9awXB0DXe3S+5OmxlGwP3AW5JTGG0DR/WziV:TwDAYqhtuM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 5876)
      • ScreenConnect.ClientService.exe (PID: 5060)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe (PID: 2512)
      • ScreenConnect.ClientService.exe (PID: 5876)
      • ScreenConnect.WindowsClient.exe (PID: 4708)
      • ScreenConnect.ClientService.exe (PID: 5060)
      • ScreenConnect.WindowsClient.exe (PID: 2348)
      • ScreenConnect.WindowsClient.exe (PID: 4060)
      • ScreenConnect.WindowsClient.exe (PID: 6772)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 7092)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 7092)

    • Screenconnect has been detected

      • msiexec.exe (PID: 7092)
      • ScreenConnect.ClientService.exe (PID: 5876)
      • ScreenConnect.ClientService.exe (PID: 5876)
      • rundll32.exe (PID: 1208)
      • ScreenConnect.ClientService.exe (PID: 5060)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 5104)
      • rundll32.exe (PID: 1208)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2520)
      • ScreenConnect.ClientService.exe (PID: 5876)
      • ScreenConnect.ClientService.exe (PID: 5060)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7092)

    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 5876)

    • SCREENCONNECT mutex has been found

      • ScreenConnect.ClientService.exe (PID: 5876)
      • ScreenConnect.ClientService.exe (PID: 5060)

    • Potential Corporate Privacy Violation

      • ScreenConnect.ClientService.exe (PID: 5876)
      • ScreenConnect.ClientService.exe (PID: 5060)

  • INFO

    • Reads the machine GUID from the registry

      • CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe (PID: 2512)
      • ScreenConnect.ClientService.exe (PID: 5876)
      • ScreenConnect.WindowsClient.exe (PID: 4708)
      • ScreenConnect.WindowsClient.exe (PID: 2348)
      • ScreenConnect.ClientService.exe (PID: 5060)
      • ScreenConnect.WindowsClient.exe (PID: 4060)
      • SearchApp.exe (PID: 5328)
      • ScreenConnect.WindowsClient.exe (PID: 6772)

    • Reads the computer name

      • CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe (PID: 2512)
      • msiexec.exe (PID: 7092)
      • msiexec.exe (PID: 1688)
      • msiexec.exe (PID: 4960)
      • msiexec.exe (PID: 5416)
      • ScreenConnect.WindowsClient.exe (PID: 4708)
      • ScreenConnect.WindowsClient.exe (PID: 2348)
      • ScreenConnect.ClientService.exe (PID: 5876)
      • msiexec.exe (PID: 1984)
      • ScreenConnect.ClientService.exe (PID: 5060)
      • ScreenConnect.WindowsClient.exe (PID: 6772)
      • ScreenConnect.WindowsClient.exe (PID: 4060)

    • Checks supported languages

      • CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe (PID: 2512)
      • msiexec.exe (PID: 4960)
      • msiexec.exe (PID: 1688)
      • msiexec.exe (PID: 7092)
      • msiexec.exe (PID: 5416)
      • ScreenConnect.WindowsClient.exe (PID: 4708)
      • ScreenConnect.WindowsClient.exe (PID: 2348)
      • ScreenConnect.ClientService.exe (PID: 5876)
      • msiexec.exe (PID: 1984)
      • ScreenConnect.WindowsClient.exe (PID: 6772)
      • ScreenConnect.ClientService.exe (PID: 5060)
      • ScreenConnect.WindowsClient.exe (PID: 4060)
      • SearchApp.exe (PID: 5328)

    • Create files in a temporary directory

      • CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe (PID: 2512)
      • rundll32.exe (PID: 5104)

    • Process checks computer location settings

      • CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe (PID: 2512)
      • SearchApp.exe (PID: 5328)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6512)
      • msiexec.exe (PID: 7092)

    • CONNECTWISE has been detected

      • msiexec.exe (PID: 6512)
      • msiexec.exe (PID: 7092)
      • ScreenConnect.WindowsClient.exe (PID: 4708)
      • ScreenConnect.ClientService.exe (PID: 5876)
      • ScreenConnect.WindowsClient.exe (PID: 2348)
      • ScreenConnect.ClientService.exe (PID: 5060)
      • msiexec.exe (PID: 3964)
      • ScreenConnect.WindowsClient.exe (PID: 4060)
      • ScreenConnect.WindowsClient.exe (PID: 6772)

    • SCREENCONNECT has been detected

      • msiexec.exe (PID: 7092)
      • ScreenConnect.ClientService.exe (PID: 5876)
      • rundll32.exe (PID: 1208)

    • Manages system restore points

      • SrTasks.exe (PID: 6508)

    • Reads CPU info

      • ScreenConnect.WindowsClient.exe (PID: 2348)
      • ScreenConnect.WindowsClient.exe (PID: 6772)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7092)

    • Reads the software policy settings

      • SearchApp.exe (PID: 5328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:11:18 20:10:20+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 45568
InitializedDataSize: 5500928
UninitializedDataSize: -
EntryPoint: 0x14ad
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
22
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cfd4f349fbcab12498b03c1f7e91f6d4b9e54109.exe msiexec.exe msiexec.exe msiexec.exe no specs rundll32.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs screenconnect.windowsclient.exe no specs msiexec.exe no specs msiexec.exe no specs rundll32.exe #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs screenconnect.windowsclient.exe no specs slui.exe no specs cfd4f349fbcab12498b03c1f7e91f6d4b9e54109.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
1208rundll32.exe "C:\WINDOWS\Installer\MSID573.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1562046 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1688C:\Windows\syswow64\MsiExec.exe -Embedding EDD43D373B9386AA95E6C67F5482F2FD E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1984C:\Windows\syswow64\MsiExec.exe -Embedding 2C0BF60747894AA1F6DE35AA5C5F6529 E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2348"C:\Program Files (x86)\ScreenConnect Client (5e9ccb427ee6bbdf)\ScreenConnect.WindowsClient.exe" "RunRole" "882318f1-b115-408a-b79c-ae817f878a7f" "System"C:\Program Files (x86)\ScreenConnect Client (5e9ccb427ee6bbdf)\ScreenConnect.WindowsClient.exe—ScreenConnect.ClientService.exe
User:
SYSTEM
Company:
ScreenConnect Software
Integrity Level:
SYSTEM
Description:
ScreenConnect Client
Exit code:
0
Version:
25.2.4.9229
Modules
Images
c:\program files (x86)\screenconnect client (5e9ccb427ee6bbdf)\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2512"C:\Users\admin\AppData\Local\Temp\CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe" C:\Users\admin\AppData\Local\Temp\CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\cfd4f349fbcab12498b03c1f7e91f6d4b9e54109.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2520C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2848\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3400"C:\Users\admin\AppData\Local\Temp\CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe" C:\Users\admin\AppData\Local\Temp\CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\cfd4f349fbcab12498b03c1f7e91f6d4b9e54109.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3964"C:\WINDOWS\System32\msiexec.exe" /i "C:\WINDOWS\SystemTemp\ScreenConnect\25.2.4.9229\ScreenConnect.ClientSetup.msi" C:\Windows\SysWOW64\msiexec.exe—ScreenConnect.ClientService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4060"C:\Program Files (x86)\ScreenConnect Client (5e9ccb427ee6bbdf)\ScreenConnect.WindowsClient.exe" "RunRole" "22845b3f-5cbd-4ab3-a0c1-060805cf2d87" "User"C:\Program Files (x86)\ScreenConnect Client (5e9ccb427ee6bbdf)\ScreenConnect.WindowsClient.exe—ScreenConnect.ClientService.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Version:
25.4.16.9293
Modules
Images
c:\program files (x86)\screenconnect client (5e9ccb427ee6bbdf)\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
11 088
Read events
10 538
Write events
387
Delete events
163

Modification events

(PID) Process:(7092) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000002785006B13E6DB01B41B000014090000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7092) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000002785006B13E6DB01B41B000014090000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7092) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000CD602B6B13E6DB01B41B000014090000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7092) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000CD602B6B13E6DB01B41B000014090000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7092) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000CD602B6B13E6DB01B41B000014090000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7092) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000006E27306B13E6DB01B41B000014090000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7092) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000005BDF5F6B13E6DB01B41B000014090000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7092) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B242626B13E6DB01B41B0000780A0000E8030000010000000000000000000000A2C15B425FB367409BE97C1CD62A4C6000000000000000000000000000000000
(PID) Process:(7092) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(2520) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000D3236E6B13E6DB01D8090000CC0F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
49
Suspicious files
39
Text files
20
Unknown types
19

Dropped files

PID
Process
Filename
Type
2512CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exeC:\Users\admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\5e9ccb427ee6bbdf\ScreenConnect.ClientSetup.msi —
MD5:—
SHA256:—
7092msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
7092msiexec.exeC:\Windows\Installer\1783d6.msi —
MD5:—
SHA256:—
5104rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI55D0.tmp-\CustomAction.configxml
MD5:6F52EBEA639FD7CEFCA18D9E5272463E
SHA256:7027B69AB6EBC9F3F7D2F6C800793FDE2A057B76010D8CFD831CF440371B2B23
5104rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI55D0.tmp-\Microsoft.Deployment.WindowsInstaller.dllexecutable
MD5:5EF88919012E4A3D8A1E2955DC8C8D81
SHA256:3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
7092msiexec.exeC:\Windows\Installer\MSI858C.tmpexecutable
MD5:BA84DD4E0C1408828CCC1DE09F585EDA
SHA256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
5104rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI55D0.tmp-\ScreenConnect.InstallerActions.dllexecutable
MD5:454B489378D49D17021B3E85F86AE843
SHA256:6E24635E275204B7A308517C46DF2250F3B35D92745F13A32E28C382662B527D
7092msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:DC4972743E03D8313A48E80E0AB19180
SHA256:F17CF87F9D4EE199C8F4B2102FD7898B2BA0C05BADC526CF09A0B8017347E2C6
6512msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI55D0.tmpexecutable
MD5:81F945DABC576CA389348A4E7147463F
SHA256:A45BA86C5D13AA8E814E4CB0860B5B2A39CE9677B0D980947F6FE31676051CB2
7092msiexec.exeC:\Windows\Temp\~DF0505CD0D9EA5FB2F.TMPbinary
MD5:DC4972743E03D8313A48E80E0AB19180
SHA256:F17CF87F9D4EE199C8F4B2102FD7898B2BA0C05BADC526CF09A0B8017347E2C6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
38
DNS requests
23
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.48.23.191:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2428
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4164
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4164
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5328
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5328
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4088
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.48.23.191:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2428
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2428
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.191
  • 23.48.23.183
  • 23.48.23.194
  • 23.48.23.138
  • 23.48.23.140
  • 23.48.23.146
  • 23.48.23.188
  • 23.48.23.192
  • 23.48.23.147
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.160.64
  • 40.126.32.138
  • 20.190.160.20
  • 20.190.160.5
  • 40.126.32.76
  • 40.126.32.68
  • 20.190.160.130
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
instance-lvcjf1-relay.screenconnect.com
  • 145.40.106.128
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.30
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2200
svchost.exe
Misc activity
ET REMOTE_ACCESS Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
5876
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
5060
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CFD4F349FBCAB12498B03C1F7E91F6D4B9E54109.exe