File name:

SQL2022-SSEI-Dev.exe

Full analysis: https://app.any.run/tasks/8dd9caa4-5f50-4daa-9a9d-1f84e9266fb5
Verdict: Malicious activity
Analysis date: May 30, 2025, 08:08:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

9CF37E0194C8A1211B3581A4D553C52E

SHA1:

E3D3B5EE51C15FEAEC2AB3144C2D3085604D57AC

SHA256:

5D9D277DCCEF80F2395F915664BD8E63FE7496B7B9C005C2F0C78A3C70D03813

SSDEEP:

49152:oYliwMwWVdDjoxzCm5BOjP7EGyZbY4qtOtdGAhTuD2/Y+gXO:IoQX0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • SQL2022-SSEI-Dev.exe (PID: 7180)
      • SQLRules_x64_ENU.exe (PID: 7844)
      • SQLServer2022-DEV-x64-ENU.exe (PID: 7464)

    • Starts a Microsoft application from unusual location

      • SQL2022-SSEI-Dev.exe (PID: 2148)
      • SQL2022-SSEI-Dev.exe (PID: 7180)

    • Executable content was dropped or overwritten

      • SQL2022-SSEI-Dev.exe (PID: 7180)
      • SQLRules_x64_ENU.exe (PID: 7844)
      • SQLServer2022-DEV-x64-ENU.exe (PID: 7464)

    • The process drops C-runtime libraries

      • SQLRules_x64_ENU.exe (PID: 7844)
      • SQLServer2022-DEV-x64-ENU.exe (PID: 7464)

    • Reads security settings of Internet Explorer

      • SETUP.EXE (PID: 7924)
      • SQL2022-SSEI-Dev.exe (PID: 7180)
      • SCENARIOENGINE.EXE (PID: 7980)
      • SETUP.EXE (PID: 7556)
      • SCENARIOENGINE.EXE (PID: 7472)

    • The process creates files with name similar to system file names

      • SQLRules_x64_ENU.exe (PID: 7844)
      • SQLServer2022-DEV-x64-ENU.exe (PID: 7464)

    • Creates file in the systems drive root

      • SQL2022-SSEI-Dev.exe (PID: 7180)

  • INFO

    • Reads the machine GUID from the registry

      • SQL2022-SSEI-Dev.exe (PID: 7180)
      • SETUP.EXE (PID: 7924)
      • SCENARIOENGINE.EXE (PID: 7980)
      • SQLServer2022-DEV-x64-ENU.exe (PID: 7464)
      • FIXSQLREGISTRYKEY_X64.EXE (PID: 7540)
      • FIXSQLREGISTRYKEY_X86.EXE (PID: 1532)
      • FIXSQLREGISTRYKEY_X64.EXE (PID: 2980)
      • FIXSQLREGISTRYKEY_X86.EXE (PID: 5384)
      • SCENARIOENGINE.EXE (PID: 7472)
      • SETUP.EXE (PID: 7556)

    • Checks supported languages

      • SQLRules_x64_ENU.exe (PID: 7844)
      • SETUP.EXE (PID: 7924)
      • SCENARIOENGINE.EXE (PID: 7980)
      • SQLServer2022-DEV-x64-ENU.exe (PID: 7464)
      • SETUP.EXE (PID: 7556)
      • SCENARIOENGINE.EXE (PID: 7472)
      • FIXSQLREGISTRYKEY_X64.EXE (PID: 7540)
      • FIXSQLREGISTRYKEY_X86.EXE (PID: 1532)
      • FIXSQLREGISTRYKEY_X64.EXE (PID: 2980)
      • FIXSQLREGISTRYKEY_X86.EXE (PID: 5384)

    • The sample compiled with english language support

      • SQLRules_x64_ENU.exe (PID: 7844)
      • SQL2022-SSEI-Dev.exe (PID: 7180)
      • SQLServer2022-DEV-x64-ENU.exe (PID: 7464)

    • Create files in a temporary directory

      • SQLRules_x64_ENU.exe (PID: 7844)
      • SETUP.EXE (PID: 7924)
      • SQLServer2022-DEV-x64-ENU.exe (PID: 7464)
      • SETUP.EXE (PID: 7556)

    • Reads the computer name

      • SQLRules_x64_ENU.exe (PID: 7844)
      • SETUP.EXE (PID: 7924)
      • SCENARIOENGINE.EXE (PID: 7980)
      • SQLServer2022-DEV-x64-ENU.exe (PID: 7464)
      • FIXSQLREGISTRYKEY_X64.EXE (PID: 7540)
      • SETUP.EXE (PID: 7556)
      • FIXSQLREGISTRYKEY_X86.EXE (PID: 1532)
      • FIXSQLREGISTRYKEY_X64.EXE (PID: 2980)
      • SCENARIOENGINE.EXE (PID: 7472)
      • FIXSQLREGISTRYKEY_X86.EXE (PID: 5384)

    • Creates files in the program directory

      • SCENARIOENGINE.EXE (PID: 7980)
      • SCENARIOENGINE.EXE (PID: 7472)
      • SQL2022-SSEI-Dev.exe (PID: 7180)

    • Reads the software policy settings

      • slui.exe (PID: 7388)
      • SQL2022-SSEI-Dev.exe (PID: 7180)

    • Process checks Powershell version

      • SCENARIOENGINE.EXE (PID: 7472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2086:03:07 01:36:02+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 4265984
InitializedDataSize: 14336
UninitializedDataSize: -
EntryPoint: 0x41373e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 16.2211.5693.3
ProductVersionNumber: 16.2211.5693.3
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: SQL Server Installer for Developer Edition
FileVersion: 16.2211.5693.3
InternalName: SQL2022-SSEI-Dev.exe
LegalCopyright: Copyright (c) Microsoft Corporation. All rights reserved.
LegalTrademarks: Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the U.S. and/or other countries.
OriginalFileName: SQL2022-SSEI-Dev.exe
ProductName: Microsoft Sql Server Installer
ProductVersion: 16.2211.5693.3
AssemblyVersion: 16.2211.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sql2022-ssei-dev.exe sppextcomobj.exe no specs slui.exe sqlrules_x64_enu.exe setup.exe no specs conhost.exe no specs scenarioengine.exe no specs slui.exe no specs sqlserver2022-dev-x64-enu.exe setup.exe no specs conhost.exe no specs scenarioengine.exe no specs fixsqlregistrykey_x64.exe no specs fixsqlregistrykey_x86.exe no specs fixsqlregistrykey_x64.exe no specs fixsqlregistrykey_x86.exe no specs sql2022-ssei-dev.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1532"C:\SQL2022\Developer_ENU\x64\FixSqlRegistryKey_x86.exe" /fixC:\SQL2022\Developer_ENU\x64\FIXSQLREGISTRYKEY_X86.EXE—SCENARIOENGINE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
FixSqlRegistryKey
Exit code:
0
Version:
16.0.1000.6
Modules
Images
c:\sql2022\developer_enu\x64\fixsqlregistrykey_x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2148"C:\Users\admin\AppData\Local\Temp\SQL2022-SSEI-Dev.exe" C:\Users\admin\AppData\Local\Temp\SQL2022-SSEI-Dev.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
SQL Server Installer for Developer Edition
Exit code:
3221226540
Version:
16.2211.5693.3
Modules
Images
c:\users\admin\appdata\local\temp\sql2022-ssei-dev.exe
c:\windows\system32\ntdll.dll
2980"C:\SQL2022\Developer_ENU\x64\FixSqlRegistryKey_x64.exe" /fixC:\SQL2022\Developer_ENU\x64\FIXSQLREGISTRYKEY_X64.EXE—SCENARIOENGINE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
FixSqlRegistryKey
Exit code:
0
Version:
16.0.1000.6
Modules
Images
c:\sql2022\developer_enu\x64\fixsqlregistrykey_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5384"C:\SQL2022\Developer_ENU\x64\FixSqlRegistryKey_x86.exe" /fixC:\SQL2022\Developer_ENU\x64\FIXSQLREGISTRYKEY_X86.EXE—SCENARIOENGINE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
FixSqlRegistryKey
Exit code:
0
Version:
16.0.1000.6
Modules
Images
c:\sql2022\developer_enu\x64\fixsqlregistrykey_x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7180"C:\Users\admin\AppData\Local\Temp\SQL2022-SSEI-Dev.exe" C:\Users\admin\AppData\Local\Temp\SQL2022-SSEI-Dev.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
SQL Server Installer for Developer Edition
Version:
16.2211.5693.3
Modules
Images
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\schannel.dll
c:\windows\system32\mskeyprotect.dll
c:\windows\system32\ntasn1.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\ncryptsslp.dll
c:\windows\assembly\nativeimages_v4.0.30319_64\system.runteb92aa12#\042690c25471a5ed946e527220825153\system.runtime.serialization.ni.dll
c:\windows\microsoft.net\framework64\v4.0.30319\webengine4.dll
c:\windows\system32\riched20.dll
7356C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
7388"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msxml6.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\ondemandconnroutehelper.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\webio.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winnsi.dll
7464"C:\SQL2022\SQLServer2022-DEV-x64-ENU.exe" /q /x:"C:\SQL2022\Developer_ENU"C:\SQL2022\SQLServer2022-DEV-x64-ENU.exe
SQL2022-SSEI-Dev.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft SQL Server 2022
Exit code:
0
Version:
16.0.1000.6
Modules
Images
c:\sql2022\sqlserver2022-dev-x64-enu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll
7472"C:\SQL2022\Developer_ENU\x64\ScenarioEngine.exe" /WORKFLOW=Install /TIMESTAMP=20250530_081013 /LOGMARKER= /MEDIASOURCE="C:\SQL2022\Developer_ENU\\" /INSTALLMEDIAPATH="C:\SQL2022\Developer_ENU\x64\setup\\" /ENU /MEDIALAYOUT="Full" /ConfigurationFile="C:\SQL2022\Developer_ENU\SqlServerInstallConfig.ini" /IAcceptSQLServerLicenseTerms /ACTION=Install /INSTANCENAME=MSSQLSERVER /QUIET=True /SKIPRULES=FusionRebootCheck /INSTANCEINSTALLID=64ae7810-0aeb-4538-a372-ce38d720b261 /TIMESTAMP=20250530_081013 /INDICATEPROGRESS=True /SESSIONID="8e876400-7386-4364-8447-acdec77ac304" /ENU /ACTION=InstallC:\SQL2022\Developer_ENU\x64\SCENARIOENGINE.EXE—SETUP.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Version:
16.0.1000.6
Modules
Images
c:\sql2022\developer_enu\x64\scenarioengine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7540"C:\SQL2022\Developer_ENU\x64\FixSqlRegistryKey_x64.exe" /fixC:\SQL2022\Developer_ENU\x64\FIXSQLREGISTRYKEY_X64.EXE—SCENARIOENGINE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
FixSqlRegistryKey
Exit code:
0
Version:
16.0.1000.6
Modules
Images
c:\sql2022\developer_enu\x64\fixsqlregistrykey_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
6 215
Read events
6 211
Write events
4
Delete events
0

Modification events

(PID) Process:(7980) SCENARIOENGINE.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\160
Operation:writeName:CustomerFeedback
Value:
1
(PID) Process:(7980) SCENARIOENGINE.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Microsoft SQL Server\160
Operation:writeName:CustomerFeedback
Value:
1
(PID) Process:(7980) SCENARIOENGINE.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\160
Operation:writeName:EnableErrorReporting
Value:
1
(PID) Process:(7980) SCENARIOENGINE.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Microsoft SQL Server\160
Operation:writeName:EnableErrorReporting
Value:
1
Executable files
286
Suspicious files
3
Text files
241
Unknown types
0

Dropped files

PID
Process
Filename
Type
7844SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\resources\1033\SETUP.RLLexecutable
MD5:E75BE70CD86818CC151D1E31C1226BEF
SHA256:60186A7355B3785618049AF90C17ADD0D3CE79350912450463DA9D83115B34DC
7844SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\COMPLETECLUSTERWIZARD.XMLxml
MD5:9A5A8E7F5DC3D761EC94912F7469F6B8
SHA256:83EDCE5FB15FE3C89FC12DCA75E8ECD2846A363C924E7A6D1C804CA9A0A71EF9
7844SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\SETUP.EXE.CONFIGxml
MD5:31E956ACE5473F21A11E81166912C9A5
SHA256:D713884D3C5307892633E0DDF9348A4C37D855447A79936F64307CF804D3E3A3
7844SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\ADDNODE.XMLxml
MD5:C76A09067E578D90303D43FCA059DCC7
SHA256:A7E1F3CFDA360B2FCBDB9905DB6B743C1A69A50A54914A5F4D00FE2E4FB29A08
7844SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\EDITIONUPGRADEWIZARD.XMLxml
MD5:DC7C9F32CEDA3865AAFCA07FFE5ADC89
SHA256:090AB8E6603D077E73D480DC568A192900E55CE369D0B38AA34AC5365386B381
7844SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\SQLSETUPBOOTSTRAPPER.DLLexecutable
MD5:FCBDE14AF779CAB7A8A0461026C2523A
SHA256:4C8AAB261E0E9499D8CAAD167F75F21AEFDD4A3FEF5EA701B046C07E994215BD
7844SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\FIXSQLREGISTRYKEY_X64.EXE.CONFIGxml
MD5:31E956ACE5473F21A11E81166912C9A5
SHA256:D713884D3C5307892633E0DDF9348A4C37D855447A79936F64307CF804D3E3A3
7844SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\FIXSQLREGISTRYKEY_X64.EXEexecutable
MD5:3884A80C46A305C4CDBA351BD0F7BD2A
SHA256:E441BC728D819FD9DB9F771C87DCE04EDA7E3DB08D62B5EB3B39828AA72917B6
7844SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\INSTALLCLUSTERWIZARD.XMLxml
MD5:511FC1A24D4A30AB8691009FB9CC6BF0
SHA256:2BEBCD763AC895761A23A406F06989293067A9ECD07A937F235044183F5408FE
7844SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\COMPONENTUPDATE.XMLxml
MD5:2A1502B573EEBAE807D59431D21F96F8
SHA256:7FF8A38903C41DC8A6E66CF4F673830D72DFA6A557ABE36A79B2A921B18961F9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
29
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7176
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7176
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5496
MoUsoCoreWorker.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7180
SQL2022-SSEI-Dev.exe
95.100.186.9:443
go.microsoft.com
AKAMAI-AS
FR
whitelisted
7180
SQL2022-SSEI-Dev.exe
23.58.110.83:443
download.microsoft.com
AKAMAI-AS
IN
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 2.23.181.156
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted
download.microsoft.com
  • 23.58.110.83
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.64
  • 40.126.32.68
  • 40.126.32.133
  • 20.190.160.3
  • 20.190.160.2
  • 40.126.32.140
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SQL2022-SSEI-Dev.exe