File name:

Site24x7WindowsAgent.msi

Full analysis: https://app.any.run/tasks/fcedf83d-5f98-4be8-83c0-e04ee46f2aa7
Verdict: Malicious activity
Analysis date: May 27, 2025, 21:43:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Create Time/Date: Mon Jun 21 07:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {226A9476-09FD-4981-B29F-493FA27A0059}, Title: Site24x7 Windows Agent, Author: support@site24x7.com, Keywords: 20.9.0, Number of Words: 2, Last Saved Time/Date: Thu Mar 27 04:47:23 2025, Last Printed: Thu Mar 27 04:47:23 2025
MD5:

B65275ABA23808B1FDCFEC340EA8CA28

SHA1:

0F28EE36D42BC736064115EAA2910C210538AF70

SHA256:

583594B043AD1E3AAE3C65CC8AC3017D86DE0041881584BD100B287FC40E73C4

SSDEEP:

98304:G/9TJ+Aq8PyZyvxwsirLtT7oOteCRqzOj2xhYJ+1KGjX3w6Jh03AIL4n7xKcwmk8:fwvtTFnNyfou5Pmy0B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes as Windows Service

      • MonitoringAgent.exe (PID: 1188)
      • MonitoringAgent.exe (PID: 1676)
      • MEAgentHelper.exe (PID: 1228)
      • VSSVC.exe (PID: 7836)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 6728)
      • MonitoringAgent.exe (PID: 1188)
      • MonitoringAgent.exe (PID: 1676)

    • Executing commands from a ".bat" file

      • msiexec.exe (PID: 6728)

    • The process executes VB scripts

      • cmd.exe (PID: 7268)
      • cmd.exe (PID: 4180)
      • cmd.exe (PID: 6476)

    • Executable content was dropped or overwritten

      • MonitoringAgent.exe (PID: 1188)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 2284)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2852)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2852)

    • Checks proxy server information

      • msiexec.exe (PID: 2852)

    • Reads the software policy settings

      • msiexec.exe (PID: 2852)

    • Checks supported languages

      • msiexec.exe (PID: 7464)
      • msiexec.exe (PID: 2284)

    • Reads the computer name

      • msiexec.exe (PID: 2284)
      • msiexec.exe (PID: 7464)

    • Manages system restore points

      • SrTasks.exe (PID: 8176)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2284)

    • The sample compiled with english language support

      • msiexec.exe (PID: 2284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CreateDate: 1999:06:21 07:00:00
Software: Windows Installer
Security: Password protected
CodePage: Windows Latin 1 (Western European)
Template: Intel;1033
Pages: 200
RevisionNumber: {226A9476-09FD-4981-B29F-493FA27A0059}
Title: Site24x7 Windows Agent
Subject: -
Author: support@site24x7.com
Keywords: 20.9.0
Comments: -
Words: 2
ModifyDate: 2025:03:27 04:47:23
LastPrinted: 2025:03:27 04:47:23
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
33
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msiexec.exe sppextcomobj.exe no specs msiexec.exe slui.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs meagenthelper.exe no specs monitoringagent.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs site24x7windowsagenttrayicon.exe no specs site24x7windowsagenttrayicon.exe no specs cscript.exe cscript.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs site24x7bulkinstallform.exe no specs slui.exe cmd.exe no specs conhost.exe no specs cscript.exe monitoringagent.exe cmd.exe no specs conhost.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1188"C:\Program Files (x86)\Site24x7\WinAgent\monitoring\bin\MonitoringAgent.exe"C:\Program Files (x86)\Site24x7\WinAgent\monitoring\bin\MonitoringAgent.exe
services.exe
User:
SYSTEM
Company:
Zoho Corporation
Integrity Level:
SYSTEM
Description:
Site24x7 Windows Agent
Exit code:
0
Version:
20.9.7.0
Modules
Images
c:\program files (x86)\site24x7\winagent\monitoring\bin\monitoringagent.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1228"C:\Program Files (x86)\Site24x7\WinAgent\monitoring\bin\MEAgentHelper.exe"C:\Program Files (x86)\Site24x7\WinAgent\monitoring\bin\MEAgentHelper.exe—services.exe
User:
SYSTEM
Company:
Zoho Corporation
Integrity Level:
SYSTEM
Description:
Site24x7 Windows Agent
Version:
20.9.7.0
Modules
Images
c:\program files (x86)\site24x7\winagent\monitoring\bin\meagenthelper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1276C:\Windows\Sysnative\cmd.exe /C Site24x7BulkInstallForm.exeC:\Windows\System32\cmd.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1676"C:\Program Files (x86)\Site24x7\WinAgent\monitoring\bin\MonitoringAgent.exe"C:\Program Files (x86)\Site24x7\WinAgent\monitoring\bin\MonitoringAgent.exe
services.exe
User:
SYSTEM
Company:
Zoho Corporation
Integrity Level:
SYSTEM
Description:
Site24x7 Windows Agent
Exit code:
0
Version:
20.9.7.0
Modules
Images
c:\program files (x86)\site24x7\winagent\monitoring\bin\monitoringagent.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\advapi32.dll
1852C:\Windows\Sysnative\cmd.exe /C Site24x7WindowsAgentTrayIcon.exeC:\Windows\System32\cmd.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2136"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2284C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2568C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
38 352
Read events
37 559
Write events
759
Delete events
34

Modification events

(PID) Process:(7464) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings
Operation:writeName:JITDebug
Value:
0
(PID) Process:(2284) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000017F79E8750CFDB01EC080000901E0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2284) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000017F79E8750CFDB01EC080000901E0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2284) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000011B9C28750CFDB01EC080000901E0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2284) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(2284) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000063A40C8850CFDB01EC080000F41E0000E803000001000000000000000000000036F79A1687EF5A48B4F16D938593818200000000000000000000000000000000
(PID) Process:(7836) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B783188850CFDB019C1E0000B81E0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7836) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B783188850CFDB019C1E0000181F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7836) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B783188850CFDB019C1E0000101F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7836) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B783188850CFDB019C1E0000BC1E0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
29
Suspicious files
1 124
Text files
143
Unknown types
0

Dropped files

PID
Process
Filename
Type
2284msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2284msiexec.exeC:\Windows\Installer\115f15.msi —
MD5:—
SHA256:—
2852msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164binary
MD5:55FCF65DD7F1185A60D8E3737F533A49
SHA256:EAACA4672B1771170FB186BE7A6E6EEE01DD46B9D34BCE9B63085364AAD5FC1B
2284msiexec.exeC:\Windows\Temp\~DF5F7FE6D1996D1A44.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
2852msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_6CD0CDD427B136BCA5F897A8F1A20D0Cbinary
MD5:4EA50C65D6CC040A9C2CFA55A1F5FCC7
SHA256:1BC88EC93F6D6B4261221385E9A2409F85139768B407926A07988213F42F164F
2284msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:C7F2B0284F5CCCF90299525B52257429
SHA256:BB31C6561D5491091A1BB824042632ADD51701A147AED02AC09567A55F5037F4
2852msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_6CD0CDD427B136BCA5F897A8F1A20D0Cbinary
MD5:8983910B6FB60ADC3DBCDA433303758E
SHA256:B1EAE208E3DD950B57A1A721FA45585B046E0CE21736FC388E00AF042C893B5A
2284msiexec.exeC:\Windows\Installer\MSI628F.tmpbinary
MD5:FED9F2F77BA3EBAD4C9DAA46A79987F3
SHA256:CF092A440819A5113399917AFAA46E9CB3D7F8EBF321A722C13A4F9B5C5C0D96
2852msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41Cbinary
MD5:E2DCD25EECB10D1EC0463511656708C2
SHA256:9662AD6443D2DBA871D9EE0DE3C08B338D0A5EB8C1435436E1E616DE9D31F261
2284msiexec.exeC:\Program Files (x86)\Site24x7\WinAgent\monitoring\conf\do\WindowsServiceMonitors.confbinary
MD5:68B329DA9893E34099C7D8AD5CB9C940
SHA256:01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
34
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2852
msiexec.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgOhtwj4VKsGchDZBEc%3D
unknown
—
—
whitelisted
2852
msiexec.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2852
msiexec.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHgDGEJFcIpBz28BuO60qVQ%3D
unknown
—
—
whitelisted
2852
msiexec.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsgccr45codesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLuA3ygnKW%2F7xuSx%2F09F%2BhHVuEUQQU2rONwCSQo2t30wygWd0hZ2R2C3gCDFEyr5DMVR5oWxtrqw%3D%3D
unknown
—
—
whitelisted
7312
cscript.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7604
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7604
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1600
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5796
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2852
msiexec.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.0
  • 40.126.31.131
  • 20.190.159.73
  • 20.190.159.71
  • 40.126.31.3
  • 20.190.159.64
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Site24x7WindowsAgent.msi