File name:

AxioWorks.SQList.Install(v.8.1.1.0).msi

Full analysis: https://app.any.run/tasks/13c7f7c1-ce1a-49a4-92b6-93f032666864
Verdict: Malicious activity
Analysis date: July 03, 2024, 02:57:55
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AxioWorks SQList, Author: AxioWorks Ltd, Keywords: Installer, Comments: This installer database contains the logic and data required to install AxioWorks SQList., Template: x64;1033, Revision Number: {522218E4-3A54-4FC4-9CDB-B3C62CC1142E}, Create Time/Date: Wed Jan 31 10:09:40 2024, Last Saved Time/Date: Wed Jan 31 10:09:40 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: WiX Toolset (4.0.2.0), Security: 2
MD5:

209F22853C9EC613413914A8AC8D29DA

SHA1:

7D66D720BBC33707355F0723B28A780B54CEE8EA

SHA256:

64F2E7A73B5C4AC88F27B8FCCD961AE20C85F7C28387231DB1E1EB85D4C10B25

SSDEEP:

98304:nxmcWLoywKyS5Q2kxc6MpdN+qixXmCqWKTt4fzqcA3bH4iW/hePvet8YNZBxAxWO:LJpeUljjJy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2452)
      • msiexec.exe (PID: 1096)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 2452)
      • msiexec.exe (PID: 1096)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2860)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 1096)
      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 1096)

    • Reads security settings of Internet Explorer

      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

    • Adds/modifies Windows certificates

      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 1096)
      • TextInputHost.exe (PID: 6860)
      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

    • Reads the computer name

      • msiexec.exe (PID: 1096)
      • TextInputHost.exe (PID: 6860)
      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2452)
      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2452)

    • Checks proxy server information

      • msiexec.exe (PID: 2452)
      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

    • Reads the software policy settings

      • msiexec.exe (PID: 2452)
      • msiexec.exe (PID: 1096)
      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 1096)
      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1096)

    • Manual execution by a user

      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)
      • AxioWorks.SQList.ManagerDesktop.exe (PID: 6328)

    • Creates files in the program directory

      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

    • Create files in a temporary directory

      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

    • Reads Environment values

      • AxioWorks.SQList.ManagerDesktop.exe (PID: 1856)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: AxioWorks SQList
Author: AxioWorks Ltd
Keywords: Installer
Comments: This installer database contains the logic and data required to install AxioWorks SQList.
Template: x64;1033
RevisionNumber: {522218E4-3A54-4FC4-9CDB-B3C62CC1142E}
CreateDate: 2024:02:29 10:09:40
ModifyDate: 2024:02:29 10:09:40
Pages: 200
Words: 2
Software: WiX Toolset (4.0.2.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs textinputhost.exe no specs axioworks.sqlist.managerdesktop.exe no specs axioworks.sqlist.managerdesktop.exe

Process information

PID
CMD
Path
Indicators
Parent process
1096C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1856"C:\Program Files\AxioWorks\SQList\AxioWorks.SQList.ManagerDesktop.exe" C:\Program Files\AxioWorks\SQList\AxioWorks.SQList.ManagerDesktop.exe
explorer.exe
User:
admin
Company:
AxioWorks Ltd
Integrity Level:
HIGH
Description:
AxioWorks Ltd library
Version:
1.0.8825.18245
Modules
Images
c:\program files\axioworks\sqlist\axioworks.sqlist.managerdesktop.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2452"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\AxioWorks.SQList.Install(v.8.1.1.0).msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2860C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6192C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6328"C:\Program Files\AxioWorks\SQList\AxioWorks.SQList.ManagerDesktop.exe" C:\Program Files\AxioWorks\SQList\AxioWorks.SQList.ManagerDesktop.exe—explorer.exe
User:
admin
Company:
AxioWorks Ltd
Integrity Level:
MEDIUM
Description:
AxioWorks Ltd library
Exit code:
3221226540
Version:
1.0.8825.18245
Modules
Images
c:\program files\axioworks\sqlist\axioworks.sqlist.managerdesktop.exe
c:\windows\system32\ntdll.dll
6860"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
26 277
Read events
25 978
Write events
276
Delete events
23

Modification events

(PID) Process:(1096) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000D76184D5F4CCDA014804000040130000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1096) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000D76184D5F4CCDA014804000040130000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1096) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000007F67E6D5F4CCDA014804000040130000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1096) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000007F67E6D5F4CCDA014804000040130000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1096) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000004C92E8D5F4CCDA014804000040130000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1096) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000FAF5EAD5F4CCDA014804000040130000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1096) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(1096) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000006DA158D6F4CCDA014804000040130000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1096) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000033045BD6F4CCDA0148040000A8140000E8030000010000000000000000000000C2878E61870BB14F867AED268352A3D800000000000000000000000000000000
(PID) Process:(2860) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000084B85FD6F4CCDA012C0B0000880F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
20
Suspicious files
24
Text files
10
Unknown types
7

Dropped files

PID
Process
Filename
Type
1096msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1096msiexec.exeC:\WINDOWS\Installer\1b1faa.msi —
MD5:—
SHA256:—
1096msiexec.exeC:\WINDOWS\Installer\MSI22F5.tmpbinary
MD5:45D7E0368A83E41DACDE1C79E640A2CF
SHA256:2AD4C94FE425D598DCBA374644AC05EC5B4E998A9579A398D6B346CE2B2F135F
2452msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDBbinary
MD5:D4AED478446430401A17B91811680125
SHA256:1280CF05B05B1EA2F242EA1AEEF887645014FEAA94386D9104FCDF44D6C693F3
2452msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_C61C98AC6648FEA2C56DD5D231F2C49Abinary
MD5:83D7290A00C3F73734D5670ABA646BF8
SHA256:34BE2E25A18DBE3A912F12151F116F8491D8D92A1F33017F24503371E79F69A5
1096msiexec.exeC:\WINDOWS\TEMP\~DF58E71E6ED36EE4E6.TMPbinary
MD5:4B2DEBA61EE9E1450B43D5EC4F232DFD
SHA256:B51A9973B2CC0660EED9F2F4D0862689B6718F4674150FDC9A99AF1FEA21E4A5
1096msiexec.exeC:\WINDOWS\TEMP\~DFA031F096A2CB293A.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
2452msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225Fder
MD5:4747822651C6F86B32274586DA0FC1F1
SHA256:5F256A1025A8DE6F1185858A041B4963E0872FFDA2AFAB68F9A937AD628A6A68
2452msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_C61C98AC6648FEA2C56DD5D231F2C49Ader
MD5:903FA6077DCEE5665C92B874ACD46060
SHA256:8C4F1B78E7DA497C9413CAB4DF74AEBE166E876E8A34D589BD47202DA65503A9
1096msiexec.exeC:\Program Files\AxioWorks\SQList\EntityFramework.dllexecutable
MD5:806D33A8300E885C3C1A00C6107AF8EB
SHA256:9C20FB2AD86A760B0C6AEBD9301C9009891D02AE14720A93926C0B535B8AD09B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
68
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2452
msiexec.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVD%2BnGf79Hpedv3mhy6uKMVZkPCQQUDyrLIIcouOxvSK4rVKYpqhekzQwCEC1AgfC79yS4bkxqkoPQcX4%3D
unknown
—
—
unknown
1972
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
6632
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
6632
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
1856
AxioWorks.SQList.ManagerDesktop.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2452
msiexec.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
2452
msiexec.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
—
—
104.126.37.186:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1060
svchost.exe
184.30.17.189:443
go.microsoft.com
AKAMAI-AS
DE
unknown
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1544
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
www.bing.com
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.129
  • 104.126.37.137
  • 104.126.37.130
  • 104.126.37.123
  • 104.126.37.185
  • 104.126.37.179
  • 104.126.37.131
  • 104.126.37.161
  • 104.126.37.155
  • 104.126.37.144
  • 104.126.37.168
  • 104.126.37.136
  • 104.126.37.163
  • 104.126.37.171
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.71
  • 40.126.31.73
  • 20.190.159.75
  • 20.190.159.0
  • 20.190.159.23
  • 40.126.31.67
  • 40.126.31.71
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r.bing.com
  • 104.126.37.130
  • 104.126.37.179
  • 104.126.37.137
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.123
  • 104.126.37.129
  • 104.126.37.186
  • 104.126.37.185
whitelisted
self.events.data.microsoft.com
  • 52.168.117.174
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AxioWorks.SQList.Install(v.8.1.1.0).msi