File name:

kerio-control-vpnclient-9.4.5-8629-win64.msi

Full analysis: https://app.any.run/tasks/fe548697-8c9d-484d-be50-4884a066e73e
Verdict: Malicious activity
Analysis date: May 18, 2025, 08:04:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: Setup of Kerio Control VPN Client, Keywords: Installer,MSI,Database,Kerio,VPN,Client, Subject: Kerio Control VPN Client, Author: Kerio Technologies Inc., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Professional Edition 22, Last Saved Time/Date: Mon Jan 27 16:37:41 2025, Create Time/Date: Mon Jan 27 16:37:41 2025, Last Printed: Mon Jan 27 16:37:41 2025, Revision Number: {B89E1422-50DB-447C-A407-30879A66B7A2}, Code page: 0, Template: AMD64;0,1033,1031,2052,1034,2070,1029,1040,1041,1043,1045,1049,1050,1053,1036,1038
MD5:

18CA5D4DC97B4089F67146D5A86ABCF1

SHA1:

4B502E4DA406A4A1608017CFC69521C9BC153B42

SHA256:

5FA24E50ED5CE119A798503F593920E91A2159F0C1CE2EC705AC255812B01B38

SSDEEP:

98304:EFyOc6ZkGzxwJDEwWcQj/95B58/YuaEiRFJdMVO6i8M/XZa13Efv1g1VeAeC5izm:cPMJDlmqPBC+wHLTM1G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • MSIB9ED.tmp (PID: 7648)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 7468)
      • msiexec.exe (PID: 7548)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 7468)
      • msiexec.exe (PID: 2564)

    • Application launched itself

      • msiexec.exe (PID: 7468)
      • msiexec.exe (PID: 7548)

    • Reads security settings of Internet Explorer

      • MSIB9ED.tmp (PID: 7648)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7548)

    • Searches for installed software

      • msiexec.exe (PID: 7468)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4400)
      • kvpncsvc.exe (PID: 2984)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 7548)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 7548)
      • drvinst.exe (PID: 3300)
      • drvinst.exe (PID: 4040)

    • Executable content was dropped or overwritten

      • drvinst.exe (PID: 3300)
      • drvinst.exe (PID: 4040)

    • Suspicious use of NETSH.EXE

      • msiexec.exe (PID: 6872)

  • INFO

    • Create files in a temporary directory

      • msiexec.exe (PID: 7468)
      • msiexec.exe (PID: 7588)
      • msiexec.exe (PID: 8176)

    • The sample compiled with english language support

      • msiexec.exe (PID: 7468)
      • msiexec.exe (PID: 7548)
      • msiexec.exe (PID: 7676)
      • drvinst.exe (PID: 3300)
      • drvinst.exe (PID: 4040)

    • Reads the computer name

      • msiexec.exe (PID: 7548)
      • msiexec.exe (PID: 7588)
      • MSIB9ED.tmp (PID: 7648)
      • msiexec.exe (PID: 7232)

    • Checks supported languages

      • msiexec.exe (PID: 7588)
      • MSIB9ED.tmp (PID: 7648)
      • msiexec.exe (PID: 7548)
      • msiexec.exe (PID: 7232)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7468)
      • msiexec.exe (PID: 7588)
      • msiexec.exe (PID: 7548)
      • msiexec.exe (PID: 7676)

    • Process checks computer location settings

      • MSIB9ED.tmp (PID: 7648)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 7548)

    • Reads the software policy settings

      • msiexec.exe (PID: 7548)

    • Manages system restore points

      • SrTasks.exe (PID: 7884)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (78)
.mst | Windows SDK Setup Transform Script (8.8)
.msp | Windows Installer Patch (7.2)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Characters: -
LastModifiedBy: InstallShield
Words: -
Title: Installation Database
Comments: Setup of Kerio Control VPN Client
Keywords: Installer,MSI,Database,Kerio,VPN,Client
Subject: Kerio Control VPN Client
Author: Kerio Technologies Inc.
Security: Password protected
Pages: 200
Software: InstallShield? 2015 - Professional Edition 22
ModifyDate: 2025:01:27 16:37:41
CreateDate: 2025:01:27 16:37:41
LastPrinted: 2025:01:27 16:37:41
RevisionNumber: {B89E1422-50DB-447C-A407-30879A66B7A2}
CodePage: Unknown (0)
Template: AMD64;0,1033,1031,2052,1034,2070,1029,1040,1041,1043,1045,1049,1050,1053,1036,1038
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
170
Monitored processes
40
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe msib9ed.tmp no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs sppextcomobj.exe no specs slui.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs msiexec.exe no specs msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs wac318d.tmp no specs wac318d.tmp no specs kvpncadm.exe no specs msiexec.exe no specs drvinst.exe drvinst.exe netsh.exe no specs conhost.exe no specs kvpncsvc.exe no specs msi5549.tmp no specs kvpncgui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2152"C:\Program Files (x86)\Kerio\VPN Client\kvpncadm.exe" /regserverC:\Program Files (x86)\Kerio\VPN Client\kvpncadm.exe—msiexec.exe
User:
SYSTEM
Company:
Kerio Technologies Inc.
Integrity Level:
SYSTEM
Description:
Kerio Control VPN Client Admin Config
Exit code:
0
Version:
9.4.5.8629 T0
Modules
Images
c:\program files (x86)\kerio\vpn client\kvpncadm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2564C:\Windows\syswow64\MsiExec.exe -Embedding E9AFF62C86A26329532A8370217E812F E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2908"C:\Program Files (x86)\Kerio\VPN Client\kvpncgui.exe" C:\Program Files (x86)\Kerio\VPN Client\kvpncgui.exe—MSI5549.tmp
User:
admin
Company:
Kerio Technologies Inc.
Integrity Level:
MEDIUM
Description:
Kerio Control VPN Client
Version:
9.4.5.8629 T0
Modules
Images
c:\program files (x86)\kerio\vpn client\kvpncgui.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
2984"C:\Program Files (x86)\Kerio\VPN Client\kvpncsvc.exe"C:\Program Files (x86)\Kerio\VPN Client\kvpncsvc.exe—services.exe
User:
SYSTEM
Company:
Kerio Technologies Inc.
Integrity Level:
SYSTEM
Description:
Kerio Control VPN Client Service
Version:
9.4.5.8629 T0
Modules
Images
c:\program files (x86)\kerio\vpn client\kvpncsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3300DrvInst.exe "4" "1" "c:\program files (x86)\kerio\vpn client\vpndriver\kvnet.inf" "9" "41a6d8d87" "00000000000001C8" "WinSta0\Default" "00000000000001D0" "208" "c:\program files (x86)\kerio\vpn client\vpndriver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
4040DrvInst.exe "2" "211" "ROOT\KVNETID\0000" "C:\WINDOWS\INF\oem1.inf" "oem1.inf:fc9f1aa232f7f37d:kvnet.ndi:9.3.6.5716:kvnetid," "41a6d8d87" "00000000000001C8"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
4300C:\Users\admin\AppData\Local\Temp\wac318D.tmp {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3D0CE359-B06E-400A-9370-448799D80C96}C:\Users\admin\AppData\Local\Temp\wac318D.tmp—msiexec.exe
User:
SYSTEM
Company:
Flexera Software LLC
Integrity Level:
SYSTEM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
22.0.330
Modules
Images
c:\users\admin\appdata\local\temp\wac318d.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
4400C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5548C:\Windows\System32\MsiExec.exe -Embedding EE8C1620D5003553EE5249AB09D4C365C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6388"C:\Windows\System32\netsh.exe" interface set interface name="Ethernet" newname="Kerio Virtual Network"C:\Windows\System32\netsh.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
17 360
Read events
17 001
Write events
330
Delete events
29

Modification events

(PID) Process:(7548) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
7C1D00009734EF78CBC7DB01
(PID) Process:(7548) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
A8D830581AF749A20F8796AF674406910EE54D5AA8531BBA28E27B26EB133B60
(PID) Process:(7548) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(7548) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(7548) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\10cb14.rbs
Value:
31180747
(PID) Process:(7548) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\10cb14.rbsLow
Value:
(PID) Process:(7548) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:delete valueName:C:\Config.Msi\10cb14.rbs
Value:
쟋Ǜ
(PID) Process:(7548) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:delete valueName:C:\Config.Msi\10cb14.rbsLow
Value:
籄
(PID) Process:(7548) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001_Classes\Local Settings\MuiCache\3c\52C64B7E
Operation:delete keyName:(default)
Value:
(PID) Process:(7548) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001_Classes\Local Settings\MuiCache\3c
Operation:delete keyName:(default)
Value:
Executable files
90
Suspicious files
63
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7468msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIB894.tmpexecutable
MD5:480ED917D4711AA9E3FEB9EF3C1C468F
SHA256:482FFC4F87B78C3C7073983CF65B593D9F13F0A3D6DC54B4A3F616F79838F3CE
7548msiexec.exeC:\Windows\Installer\10cb12.msiexecutable
MD5:31C6E41867FD566534AFC8BA32077329
SHA256:F8F64808C822A8DCECC03B3A084F785B199C528EE32A62F0656818A628E87553
7548msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_C6F6AD193A5BB132667C3FC1E5AFF1F4binary
MD5:5BFA51F3A417B98E7443ECA90FC94703
SHA256:BEBE2853A3485D1C2E5C5BE4249183E0DDAFF9F87DE71652371700A89D937128
7548msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5binary
MD5:5F758BA4ED3CF2A82209D718687BAC65
SHA256:4D58DC0BD8FFDACCDDA37F15B5427C685F3302E14B307EFA434826C47CA27EF9
7548msiexec.exeC:\Windows\Temp\~DFB883E39150895282.TMPbinary
MD5:E6AC26415EE405CF717B46747D4874B7
SHA256:ECC245CC51D4ADA7B37624CF450BF973C8FEFE01AB317F33D524D12C55881E97
7548msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C3948BE6E525B8A8CEE9FAC91C9E392_C6F6AD193A5BB132667C3FC1E5AFF1F4binary
MD5:6F497DBEF830B06F4CBF5D9CB78E16D1
SHA256:CB2A26ABC131B844E70DE4FD82EFEC55DB16636C7A9658F7120722040FCF7E95
7548msiexec.exeC:\Config.Msi\10cb14.rbsbinary
MD5:792E7CDA7213AB5CC0393701868708BB
SHA256:6628E291E74AEC0523BDD9EF762271F3B74A3707EFFFCB4DC26366E2315B3230
7468msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIB9ED.tmpexecutable
MD5:A0324B11652ED4ACC7D09CA17607AAD6
SHA256:9007F7BB4F0E3D93FF42602185DA9253C5631392E50DEABE393CE34CA929E424
7468msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIB960.tmpexecutable
MD5:A6AAB6D2DC3E9FFAF35DB0D9C05828BE
SHA256:5EAC4454E9B58F3914B3D265F1752C6EC8CEBC435FAAF94AA2EBD5788814F37D
7548msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
28
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.41:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7548
msiexec.exe
GET
200
2.17.189.192:80
http://crl.verisign.com/pca3.crl
unknown
—
—
whitelisted
7548
msiexec.exe
GET
200
2.17.189.192:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCECj52c24aW1r3NfQlRJcKuI%3D
unknown
—
—
whitelisted
7548
msiexec.exe
GET
200
2.17.189.192:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCECj52c24aW1r3NfQlRJcKuI%3D
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8052
SIHClient.exe
GET
200
92.123.22.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8052
SIHClient.exe
GET
200
92.123.22.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.41:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7548
msiexec.exe
2.17.189.192:80
crl.verisign.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.41
  • 23.216.77.36
  • 23.216.77.35
  • 23.216.77.42
  • 23.216.77.22
  • 23.216.77.39
  • 23.216.77.8
  • 23.216.77.37
  • 23.216.77.25
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 92.123.22.101
whitelisted
google.com
  • 142.250.74.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
crl.verisign.com
  • 2.17.189.192
whitelisted
ocsp.verisign.com
  • 2.17.189.192
whitelisted
csc3-2004-crl.verisign.com
  • —
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.4
  • 40.126.32.138
  • 20.190.160.65
  • 20.190.160.14
  • 20.190.160.64
  • 40.126.32.74
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
kerio-control-vpnclient-9.4.5-8629-win64.msi