File name:

DuoDesktop-6.12.0 1.msi

Full analysis: https://app.any.run/tasks/1aeaf1e0-3b32-4109-b266-d1eba10dc5ae
Verdict: Malicious activity
Analysis date: August 28, 2024, 09:14:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Duo Desktop, Author: Duo Security, Keywords: Installer, Comments: This installer database contains the logic and data required to install Duo Desktop., Create Time/Date: Mon Aug 5 18:30:12 2024, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2, Template: Intel;1033,1031,3082,1036,1041, Last Saved By: Intel;1033,1031,3082,1036,1041, Revision Number: {F3A2ECB6-6124-4C37-A01B-C9776A04BCF8}6.12.0.0;{154D09B5-6F98-46F1-80EF-DCC64C25538E}6.12.0.0;{2C72DB34-23A1-4768-9BCB-23A6E036AA72}, Number of Pages: 500, Number of Characters: 0
MD5:

407AA6786BBAB96695BD2A913E7DEC02

SHA1:

6094BA336A6087A0B0B1BB9C55DA9B769F038411

SHA256:

5EA976E358BCCBB62327AEACBFB73672B75FCB08CB60E428F52096CD4205EC7A

SSDEEP:

98304:TXYoc2PHAWfBX75Ap9tZgzT0WaxQKExtpylINpSFdKp7jME/Tgr8ClijSgL+DfCt:8Yli+6cADt2pXov+ZwAL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 7052)
      • rundll32.exe (PID: 7048)
      • msiexec.exe (PID: 5264)
      • rundll32.exe (PID: 5072)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 7052)
      • msiexec.exe (PID: 5264)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5544)
      • TrustedPeerMessageBrokerService.exe (PID: 6012)
      • AutoUpdateService.exe (PID: 5944)
      • CryptoService.exe (PID: 2572)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 788)
      • rundll32.exe (PID: 2128)
      • rundll32.exe (PID: 7048)
      • rundll32.exe (PID: 7084)
      • rundll32.exe (PID: 5072)
      • rundll32.exe (PID: 4004)

    • Starts CMD.EXE for commands execution

      • rundll32.exe (PID: 4004)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 4404)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7052)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7052)

    • Checks proxy server information

      • msiexec.exe (PID: 7052)

    • Checks supported languages

      • msiexec.exe (PID: 5264)

    • Reads the software policy settings

      • msiexec.exe (PID: 7052)

    • Reads the computer name

      • msiexec.exe (PID: 5264)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Duo Desktop
Author: Duo Security
Keywords: Installer
Comments: This installer database contains the logic and data required to install Duo Desktop.
Template: Intel;1033,1031,3082,1036,1041
RevisionNumber: {C39A088C-2B8D-410A-8D08-45BB77E851E6}
CreateDate: 2024:08:05 18:30:06
ModifyDate: 2024:08:05 18:30:06
Pages: 500
Words: 2
Software: Windows Installer XML Toolset (3.11.1.2318)
Security: Read-only recommended
LastModifiedBy: Intel;1033,1031,3082,1036,1041
Characters: -
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
176
Monitored processes
47
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe msiexec.exe no specs rundll32.exe rundll32.exe sppextcomobj.exe no specs slui.exe no specs rundll32.exe checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs rundll32.exe cmd.exe no specs conhost.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs autoupdateservice.exe no specs cryptoservice.exe no specs trustedpeermessagebrokerservice.exe no specs rundll32.exe duo desktop.exe

Process information

PID
CMD
Path
Indicators
Parent process
236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CheckNetIsolation.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
788rundll32.exe "C:\WINDOWS\Installer\MSI246.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1246078 2 CreateCertificatesCA!CreateCertificatesCA.CustomActions.DetectWindowsVersionC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1288"C:\WINDOWS\system32\CheckNetIsolation.exe" LoopbackExempt -sC:\Windows\SysWOW64\CheckNetIsolation.exe—rundll32.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
AppContainer Network Isolation Diagnostic Tool
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\checknetisolation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
1356C:\WINDOWS\system32\netsh http delete sslcert ipport=127.0.0.1:53101 C:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1372\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1744C:\WINDOWS\system32\netsh http delete sslcert ipport=127.0.0.1:53102 C:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1748\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1764C:\WINDOWS\system32\netsh http add sslcert ipport=127.0.0.1:53100 appid={60A3DA37-55DD-43D4-9DCB-4B1D27357245} certhash=EB4511D50689EA8F478AC0CA08606A33B94367A6 C:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1812"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2008\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
44 745
Read events
44 354
Write events
360
Delete events
31

Modification events

(PID) Process:(5264) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000007C4B83B52AF9DA019014000004140000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5264) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000007C4B83B52AF9DA019014000004140000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5264) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000259CCFB52AF9DA019014000004140000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5264) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000259CCFB52AF9DA019014000004140000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5264) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000001D65D4B52AF9DA019014000004140000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5264) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000B8B5D6B52AF9DA019014000004140000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5264) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(5264) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
480000000000000029994BB62AF9DA019014000004140000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5264) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000080FC4DB62AF9DA01901400000C130000E8030000010000000000000000000000A6FF816F08245349843AF2FA1436F44700000000000000000000000000000000
(PID) Process:(5544) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000987757B62AF9DA01A8150000E8180000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
118
Suspicious files
30
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
5264msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
5264msiexec.exeC:\Windows\Installer\12fb6f.msi —
MD5:—
SHA256:—
7052msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_85D4035F812A73DE33119CC981D729A2der
MD5:62F86208368E1F49CEC869903874966D
SHA256:308CFEED59D8AB987982EDC620B193B6736054367614C625FB16EBC9E323F3B4
5264msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{6f81ffa6-2408-4953-843a-f2fa1436f447}_OnDiskSnapshotPropbinary
MD5:065DE57ED7F95F86C926CFDBE903A0C2
SHA256:CBF960C55A6DDEE31D2EDBA016E8EF7A13F2D69AEC08FFFA6C05AFE4F9B15CAF
5264msiexec.exeC:\Windows\Installer\MSI15B.tmpbinary
MD5:F3CF98931AB230AFC4AC1392BBC0F3C5
SHA256:68DB14A686BD9D87BD8B26893650262CB95BFF15C14DE5D2FA720C3624AEFCE6
5264msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:065DE57ED7F95F86C926CFDBE903A0C2
SHA256:CBF960C55A6DDEE31D2EDBA016E8EF7A13F2D69AEC08FFFA6C05AFE4F9B15CAF
7052msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_85D4035F812A73DE33119CC981D729A2binary
MD5:23C2119A71E76C5C15557EFC5F913D89
SHA256:8C7A81196DED8061FFB3F3D6EF4BFF07A6F1F2DB90CFF8BE9E4E37825EB22C32
5264msiexec.exeC:\Windows\Temp\~DF43D4301B35A15592.TMPbinary
MD5:A7BA1FE118CA03F02581EAFECB38698D
SHA256:B71DC3A50EED6661E88A5D74A17E9619250768C17BDFCCF8178086612487A092
5264msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:A7BA1FE118CA03F02581EAFECB38698D
SHA256:B71DC3A50EED6661E88A5D74A17E9619250768C17BDFCCF8178086612487A092
5264msiexec.exeC:\Windows\Temp\~DFAB6A0EFDCC781FB0.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
32
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7052
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
7052
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAuaoG9ZqTY4lYojhO9jYhM%3D
unknown
—
—
whitelisted
8
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6424
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6424
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6652
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
6224
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7052
msiexec.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
8
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
8
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2080
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
6424
SIHClient.exe
40.127.169.103:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.142
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.76
  • 40.126.32.72
  • 40.126.32.133
  • 40.126.32.134
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
Process
Message
Duo Desktop.exe
TbsHandle:0
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DuoDesktop-6.12.0 1.msi