File name:

TGR_pendientededevolucion.msi

Full analysis: https://app.any.run/tasks/3a2ece3f-3c93-4e92-b1c5-d96ee1ce2143
Verdict: Malicious activity
Analysis date: December 05, 2024, 15:35:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: PDQConnectAgent, Author: PDQ.com, Keywords: Installer, Comments: This installer database contains the logic and data required to install PDQConnectAgent., Template: x64;1033, Revision Number: {85C6D84F-37EC-4D4B-94DE-DB23DEF61F1F}, Create Time/Date: Wed Nov 6 23:53:40 2024, Last Saved Time/Date: Wed Nov 6 23:53:40 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: WiX Toolset (5.0.0.0), Security: 2
MD5:

C04A74521B81E48DEE6548CB537FB625

SHA1:

43CABE3059C61DFD2C1668DFBEA7F9AFEC6305C8

SHA256:

5CB2AEFEAE32550FE5AB5BF339E45FB752FDA5C0657D35BC39C21124DE9A99EF

SSDEEP:

98304:h3Q8NTtWfTSdT8sMAxt9QdQ80K6/ySxzgvb41t70DaPe/0sVHhD2xGKxkFA8g//m:YLb6s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • pdq-connect-agent.exe (PID: 2548)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 6396)
      • powershell.exe (PID: 4264)
      • powershell.exe (PID: 4144)
      • powershell.exe (PID: 6972)
      • powershell.exe (PID: 520)
      • powershell.exe (PID: 6980)
      • powershell.exe (PID: 768)
      • powershell.exe (PID: 2572)
      • powershell.exe (PID: 1856)
      • powershell.exe (PID: 4444)
      • powershell.exe (PID: 5080)
      • powershell.exe (PID: 1588)
      • powershell.exe (PID: 6932)
      • powershell.exe (PID: 3288)
      • powershell.exe (PID: 7448)
      • powershell.exe (PID: 7528)
      • powershell.exe (PID: 7456)
      • powershell.exe (PID: 7472)
      • powershell.exe (PID: 7464)
      • powershell.exe (PID: 7488)
      • powershell.exe (PID: 7508)
      • powershell.exe (PID: 7548)
      • powershell.exe (PID: 7568)
      • powershell.exe (PID: 7588)
      • powershell.exe (PID: 7440)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6608)
      • pdq-connect-updater.exe (PID: 4392)
      • pdq-connect-agent.exe (PID: 2548)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 4944)
      • msiexec.exe (PID: 2356)
      • msiexec.exe (PID: 5032)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 4716)
      • rundll32.exe (PID: 3928)
      • rundll32.exe (PID: 6432)
      • rundll32.exe (PID: 4136)
      • rundll32.exe (PID: 3532)
      • pdq-connect-agent.exe (PID: 2548)
      • rundll32.exe (PID: 6712)
      • rundll32.exe (PID: 5096)

    • PDQConnect is probably used for system patching and software deployment

      • sc.exe (PID: 2996)

    • Starts SC.EXE for service management

      • rundll32.exe (PID: 3532)

    • Starts POWERSHELL.EXE for commands execution

      • pdq-connect-agent.exe (PID: 2548)

    • The process hides Powershell's copyright startup banner

      • pdq-connect-agent.exe (PID: 2548)

    • The process bypasses the loading of PowerShell profile settings

      • pdq-connect-agent.exe (PID: 2548)

    • The process hide an interactive prompt from the user

      • pdq-connect-agent.exe (PID: 2548)

  • INFO

    • Reads the software policy settings

      • msiexec.exe (PID: 6288)

    • Manages system restore points

      • SrTasks.exe (PID: 5432)

    • Application launched itself

      • msiexec.exe (PID: 6440)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6440)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6288)

    • An automatically generated document

      • msiexec.exe (PID: 6288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: PDQConnectAgent
Author: PDQ.com
Keywords: Installer
Comments: This installer database contains the logic and data required to install PDQConnectAgent.
Template: x64;1033
RevisionNumber: {85C6D84F-37EC-4D4B-94DE-DB23DEF61F1F}
CreateDate: 2024:11:06 23:53:40
ModifyDate: 2024:11:06 23:53:40
Pages: 200
Words: 2
Software: WiX Toolset (5.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
200
Monitored processes
74
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe sc.exe no specs conhost.exe no specs pdq-connect-agent.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe pdq-connect-updater.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs tiworker.exe no specs dsregcmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
520"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
524"msiexec" /i C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectUpdater-0.3.0.msi /quiet /qn /norestart /L*V C:\ProgramData\PDQ\PDQConnectAgent\Updates\updater_install.logC:\Windows\System32\msiexec.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
768"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
1588"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
1856"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
2280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
2356C:\Windows\System32\MsiExec.exe -Embedding 147F819DDA8C26687D23D890DAA53EDC E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2548"C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe" --serviceC:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
PDQ Connect Agent
Version:
5.6.6
Modules
Images
c:\program files\pdq\pdqconnectagent\pdq-connect-agent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2572"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
2600\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
29 144
Read events
28 777
Write events
342
Delete events
25

Modification events

(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000055701D682B47DB0128190000C0190000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000055701D682B47DB0128190000C0190000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000A53260682B47DB0128190000C0190000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000A53260682B47DB0128190000C0190000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000E85C67682B47DB0128190000C0190000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000056AD69682B47DB0128190000C0190000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000009B89DE682B47DB0128190000C0190000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000001051E3682B47DB0128190000381A0000E80300000100000000000000000000007CD06BD8CDE95047BF0E003382F83B7500000000000000000000000000000000
(PID) Process:(6608) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000034E0EC682B47DB01D0190000501A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
39
Suspicious files
54
Text files
83
Unknown types
0

Dropped files

PID
Process
Filename
Type
6440msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6440msiexec.exeC:\Windows\Installer\139abc.msi —
MD5:—
SHA256:—
5096rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCAD80DA43B9740C8783C7BA228A22797A5\pdqconnectagent-setup.exeexecutable
MD5:75F16349CAFAE8F37BD1E207E2EC83D2
SHA256:F3BB2B9230B8A6066DFEEB172AD32AE3EA31D2D49C76BDCC8A1E2531FA61F5B7
6440msiexec.exeC:\Windows\Installer\MSIA1A4.tmpexecutable
MD5:E8DC682F2C486075C6ABA658971A62CC
SHA256:7AACD4C18710E9BC4FF2034895A0A0C8F80F21809FB177D520E93F7688216E6D
6288msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4binary
MD5:7EA5187AE5BD860A66ED01661992E5F4
SHA256:8FFB3425FB3B9180AE2D2B195E2D7C8201ECD8E980E461A64DF505D6034128B0
6288msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4binary
MD5:EC69F4E3769E3C70374D791918A037DA
SHA256:A37BB1BDFD9E687154538C45C1B4E1F6F9CA38BFCCBFA57672C4314B2268BC00
6288msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D9CB7DFFEEA63BAB482BD2705E7E24AB_D64C5BFAB2C28B4652E4AC7169A0D3DBbinary
MD5:AE41A0B4A394F511945C2C236ADEEF11
SHA256:DDE948795E0178DDB7C47E539494F8157E772EB27D598C4D9C1164747DC3FBD3
4716rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA494F8242A246972ACE0D93EB3D6FDB5E\WixToolset.Dtf.WindowsInstaller.dllexecutable
MD5:B82B13D16E7F3D3607026F61B7295224
SHA256:BCC548E72B190D8F39DCB19538444E2576617A21CABA6ADCB4116511E1D2DDEE
4716rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA494F8242A246972ACE0D93EB3D6FDB5E\CustomAction.configxml
MD5:C9C40AF1656F8531EAA647CACEB1E436
SHA256:1A67F60962CA1CBF19873B62A8518EFE8C701A09CD609AF4C50ECC7F0B468BB8
6440msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{d86bd07c-e9cd-4750-bf0e-003382f83b75}_OnDiskSnapshotPropbinary
MD5:CF39C951D4C65A251D4F21FF5195B46D
SHA256:44A9F95B7531433BA365E4A8E925C3C347E6538C4A879C11539F5E943F8F88CE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
37
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6288
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
6288
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhtVltVOu8OqBzmsd%2B%2FeFfks3xTQQUvGsiZZ2MaObmHgXx2HIl1LjgSMACEAvcoEuhCK%2FAlHGPdKmo6gs%3D
unknown
—
—
whitelisted
6288
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEA5NZ%2FZDFskqO3oXzEaXao8%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1512
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.155:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6288
msiexec.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 172.217.23.110
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.144
  • 104.126.37.146
  • 104.126.37.153
  • 104.126.37.137
  • 104.126.37.147
  • 104.126.37.160
  • 104.126.37.139
  • 104.126.37.152
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.134
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.68
  • 20.190.160.17
  • 40.126.32.138
  • 20.190.160.22
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
app.pdq.com
  • 104.16.77.47
  • 104.16.78.47
whitelisted
pdqinstallers.e9d69694c3d8f7465fd531512c22bd0f.r2.cloudflarestorage.com
  • 162.159.140.238
  • 172.66.0.236
unknown

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TGR_pendientededevolucion.msi