File name:

WhatsappWeb.msi

Full analysis: https://app.any.run/tasks/4b2c76ff-b1ee-4ecf-8914-01261305198f
Verdict: Malicious activity
Analysis date: November 19, 2024, 18:02:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
rust
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: PDQConnectAgent, Author: PDQ.com, Keywords: Installer, Comments: This installer database contains the logic and data required to install PDQConnectAgent., Template: x64;1033, Revision Number: {85C6D84F-37EC-4D4B-94DE-DB23DEF61F1F}, Create Time/Date: Wed Nov 6 23:53:40 2024, Last Saved Time/Date: Wed Nov 6 23:53:40 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: WiX Toolset (5.0.0.0), Security: 2
MD5:

82F3F74379C6DBDBCA3A64C5717C2FAA

SHA1:

BA5562E233C1F83D6929DB8DD03860A99BF58FA4

SHA256:

6696D790EE119B0DE93919050A642D3DCA502A2AE1864700B6B06FA2B955EC9D

SSDEEP:

98304:g3Q8NTtWfTSdT8sMAxt9QdQ80K6/ySxzgvb41t70DaPe/0sVHhD2xGKxkFA8g//E:BLb6K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6996)
      • powershell.exe (PID: 5896)
      • powershell.exe (PID: 6872)
      • powershell.exe (PID: 5380)
      • powershell.exe (PID: 5544)
      • powershell.exe (PID: 6740)
      • powershell.exe (PID: 6904)
      • powershell.exe (PID: 1488)
      • powershell.exe (PID: 6840)
      • powershell.exe (PID: 6440)
      • powershell.exe (PID: 6972)
      • powershell.exe (PID: 7060)
      • powershell.exe (PID: 5208)
      • powershell.exe (PID: 7052)
      • powershell.exe (PID: 6820)
      • powershell.exe (PID: 7652)
      • powershell.exe (PID: 7548)
      • powershell.exe (PID: 7556)
      • powershell.exe (PID: 7572)
      • powershell.exe (PID: 7592)
      • powershell.exe (PID: 7612)
      • powershell.exe (PID: 7632)
      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 7820)
      • powershell.exe (PID: 7692)
      • powershell.exe (PID: 7712)
      • powershell.exe (PID: 5308)

    • Changes powershell execution policy (Bypass)

      • pdq-connect-agent.exe (PID: 7076)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 5528)
      • pdq-connect-agent.exe (PID: 7076)
      • pdq-connect-updater.exe (PID: 6760)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 6644)
      • rundll32.exe (PID: 6704)
      • rundll32.exe (PID: 6940)
      • rundll32.exe (PID: 6840)
      • rundll32.exe (PID: 6992)
      • pdq-connect-agent.exe (PID: 7076)
      • rundll32.exe (PID: 6532)
      • rundll32.exe (PID: 6680)
      • csc.exe (PID: 8784)
      • powershell.exe (PID: 7060)
      • csc.exe (PID: 7308)
      • powershell.exe (PID: 7572)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 6600)
      • msiexec.exe (PID: 6800)
      • msiexec.exe (PID: 6508)

    • Starts SC.EXE for service management

      • rundll32.exe (PID: 6992)

    • PDQConnect is probably used for system patching and software deployment

      • sc.exe (PID: 7024)

    • Starts POWERSHELL.EXE for commands execution

      • pdq-connect-agent.exe (PID: 7076)
      • powershell.exe (PID: 7820)
      • powershell.exe (PID: 7184)
      • powershell.exe (PID: 648)
      • powershell.exe (PID: 6820)
      • powershell.exe (PID: 8608)
      • powershell.exe (PID: 7236)
      • powershell.exe (PID: 2536)
      • powershell.exe (PID: 4140)
      • powershell.exe (PID: 7380)
      • powershell.exe (PID: 9128)
      • powershell.exe (PID: 7428)
      • powershell.exe (PID: 4576)
      • powershell.exe (PID: 8236)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 8932)
      • powershell.exe (PID: 8868)
      • powershell.exe (PID: 6016)
      • powershell.exe (PID: 2332)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 9132)
      • powershell.exe (PID: 8344)
      • powershell.exe (PID: 8748)
      • powershell.exe (PID: 7840)
      • powershell.exe (PID: 7444)

    • The process hides Powershell's copyright startup banner

      • pdq-connect-agent.exe (PID: 7076)
      • powershell.exe (PID: 7820)
      • powershell.exe (PID: 6820)
      • powershell.exe (PID: 7184)
      • powershell.exe (PID: 648)
      • powershell.exe (PID: 7236)
      • powershell.exe (PID: 8608)
      • powershell.exe (PID: 2536)
      • powershell.exe (PID: 9128)
      • powershell.exe (PID: 4140)
      • powershell.exe (PID: 4576)
      • powershell.exe (PID: 7380)
      • powershell.exe (PID: 8236)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 7428)
      • powershell.exe (PID: 8932)
      • powershell.exe (PID: 8868)
      • powershell.exe (PID: 6016)
      • powershell.exe (PID: 2332)
      • powershell.exe (PID: 9132)
      • powershell.exe (PID: 7840)
      • powershell.exe (PID: 8748)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 8344)
      • powershell.exe (PID: 7444)

    • The process hide an interactive prompt from the user

      • pdq-connect-agent.exe (PID: 7076)

    • The process bypasses the loading of PowerShell profile settings

      • pdq-connect-agent.exe (PID: 7076)
      • powershell.exe (PID: 7820)
      • powershell.exe (PID: 648)
      • powershell.exe (PID: 6820)
      • powershell.exe (PID: 7184)
      • powershell.exe (PID: 7236)
      • powershell.exe (PID: 2536)
      • powershell.exe (PID: 8608)
      • powershell.exe (PID: 9128)
      • powershell.exe (PID: 4140)
      • powershell.exe (PID: 7380)
      • powershell.exe (PID: 4576)
      • powershell.exe (PID: 8236)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 8932)
      • powershell.exe (PID: 8868)
      • powershell.exe (PID: 2332)
      • powershell.exe (PID: 7428)
      • powershell.exe (PID: 6016)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 8344)
      • powershell.exe (PID: 8748)
      • powershell.exe (PID: 7840)
      • powershell.exe (PID: 9132)
      • powershell.exe (PID: 7444)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7308)
      • csc.exe (PID: 8784)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 7060)
      • powershell.exe (PID: 7572)

    • Application launched itself

      • powershell.exe (PID: 7820)
      • powershell.exe (PID: 6820)
      • powershell.exe (PID: 7184)
      • powershell.exe (PID: 648)
      • powershell.exe (PID: 8608)
      • powershell.exe (PID: 2536)
      • powershell.exe (PID: 4140)
      • powershell.exe (PID: 7236)
      • powershell.exe (PID: 9128)
      • powershell.exe (PID: 4576)
      • powershell.exe (PID: 7380)
      • powershell.exe (PID: 8236)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 7428)
      • powershell.exe (PID: 8932)
      • powershell.exe (PID: 8868)
      • powershell.exe (PID: 2332)
      • powershell.exe (PID: 6016)
      • powershell.exe (PID: 8344)
      • powershell.exe (PID: 8748)
      • powershell.exe (PID: 7840)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 9132)
      • powershell.exe (PID: 7444)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 6520)
      • DismHost.exe (PID: 7304)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 488)

    • Reads the software policy settings

      • msiexec.exe (PID: 488)

    • An automatically generated document

      • msiexec.exe (PID: 488)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 488)

    • Manages system restore points

      • SrTasks.exe (PID: 6452)

    • Application launched itself

      • msiexec.exe (PID: 5316)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5316)

    • Application based on Rust

      • pdq-connect-agent.exe (PID: 7076)
      • pdq-connect-updater.exe (PID: 6760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: PDQConnectAgent
Author: PDQ.com
Keywords: Installer
Comments: This installer database contains the logic and data required to install PDQConnectAgent.
Template: x64;1033
RevisionNumber: {85C6D84F-37EC-4D4B-94DE-DB23DEF61F1F}
CreateDate: 2024:11:06 23:53:40
ModifyDate: 2024:11:06 23:53:40
Pages: 200
Words: 2
Software: WiX Toolset (5.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
302
Monitored processes
171
Malicious processes
7
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe sc.exe no specs conhost.exe no specs pdq-connect-agent.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe pdq-connect-updater.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs dsregcmd.exe no specs tiworker.exe no specs dsregcmd.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs dismhost.exe no specs dismhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
488"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\Desktop\WhatsappWeb.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
520"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
648"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
904C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\WINDOWS\TEMP\RES9EB7.tmp" "c:\Windows\Temp\uoz3gixg\CSC6B591C828ABB4A39B5E15C1520F96017.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
1140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1488"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1596\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1708\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1732\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
1760\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
4 619
Read events
4 585
Write events
25
Delete events
9

Modification events

(PID) Process:(5316) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000334C2A45AD3ADB01C41400000C0B0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5316) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000334C2A45AD3ADB01C41400000C0B0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5316) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000031836345AD3ADB01C41400000C0B0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5316) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000031836345AD3ADB01C41400000C0B0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5316) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000079E76545AD3ADB01C41400000C0B0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5316) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000008A4A6845AD3ADB01C41400000C0B0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5316) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(5316) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000A35ED845AD3ADB01C41400000C0B0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5316) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000026C2DA45AD3ADB01C4140000BC150000E8030000010000000000000000000000B1D18873897FB640B096A79A746DE48900000000000000000000000000000000
(PID) Process:(5528) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000003F40E445AD3ADB019815000074090000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
141
Suspicious files
50
Text files
194
Unknown types
9

Dropped files

PID
Process
Filename
Type
5316msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
5316msiexec.exeC:\Windows\Installer\ed30b.msi —
MD5:—
SHA256:—
488msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:A10D87FAF0F0E848CA0107057ACD4530
SHA256:6812B15401F7623A3ACE5C34FDF53226E50C4FB6CDE09C12C7977340B6B60388
5316msiexec.exeC:\Windows\Installer\MSID6F3.tmpexecutable
MD5:45E153EF2E0AA13C55CD25FAFA3BCE90
SHA256:2104D3C13E6B624A7D628534FCDF900730752F9FF389B0F4FE1DE77C33D8D4C1
6704rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA043547043142D2CA141999110D4542C3\WixSharp.dllexecutable
MD5:EBED2675D27B9383EE8E58BDEDDD5DA4
SHA256:CAA9DA1C55E33446EAEB783957E990847369423C7DD652F07A5C93BF1D786A66
6644rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCAA97201CFB9488C1BDB40DFA604F1FDCB\pdqconnectagent-setup.exeexecutable
MD5:75F16349CAFAE8F37BD1E207E2EC83D2
SHA256:F3BB2B9230B8A6066DFEEB172AD32AE3EA31D2D49C76BDCC8A1E2531FA61F5B7
6644rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCAA97201CFB9488C1BDB40DFA604F1FDCB\WixSharp.dllexecutable
MD5:EBED2675D27B9383EE8E58BDEDDD5DA4
SHA256:CAA9DA1C55E33446EAEB783957E990847369423C7DD652F07A5C93BF1D786A66
5316msiexec.exeC:\Windows\Installer\MSID9F2.tmpexecutable
MD5:E8DC682F2C486075C6ABA658971A62CC
SHA256:7AACD4C18710E9BC4FF2034895A0A0C8F80F21809FB177D520E93F7688216E6D
6644rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCAA97201CFB9488C1BDB40DFA604F1FDCB\WixToolset.Dtf.WindowsInstaller.dllexecutable
MD5:B82B13D16E7F3D3607026F61B7295224
SHA256:BCC548E72B190D8F39DCB19538444E2576617A21CABA6ADCB4116511E1D2DDEE
6644rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCAA97201CFB9488C1BDB40DFA604F1FDCB\CustomAction.configxml
MD5:C9C40AF1656F8531EAA647CACEB1E436
SHA256:1A67F60962CA1CBF19873B62A8518EFE8C701A09CD609AF4C50ECC7F0B468BB8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
44
DNS requests
23
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.24.77.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhtVltVOu8OqBzmsd%2B%2FeFfks3xTQQUvGsiZZ2MaObmHgXx2HIl1LjgSMACEAvcoEuhCK%2FAlHGPdKmo6gs%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEA5NZ%2FZDFskqO3oXzEaXao8%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
184.24.77.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4932
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5996
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
488
msiexec.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.178:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 184.24.77.12
  • 184.24.77.37
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
google.com
  • 142.250.184.238
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
www.bing.com
  • 104.126.37.178
  • 104.126.37.162
  • 104.126.37.170
  • 104.126.37.171
  • 104.126.37.186
  • 104.126.37.160
  • 104.126.37.161
  • 104.126.37.179
  • 104.126.37.163
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
app.pdq.com
  • 104.16.77.47
  • 104.16.78.47
whitelisted
pdqinstallers.e9d69694c3d8f7465fd531512c22bd0f.r2.cloudflarestorage.com
  • 162.159.140.238
  • 172.66.0.236
unknown

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WhatsappWeb.msi