File name:

hamachi.msi

Full analysis: https://app.any.run/tasks/8984a051-ed80-4688-8c50-29c330a97af7
Verdict: Malicious activity
Analysis date: June 14, 2025, 07:00:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Hamachi Installer, Author: LogMeIn, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install Hamachi., Template: ;1033, Number of Pages: 200, Number of Words: 2, Security: 2, Revision Number: {C15EA8DB-41DF-4C48-8704-7D4FAB7D9EBB}, Create Time/Date: Mon Mar 25 12:38:25 2024, Last Saved Time/Date: Mon Mar 25 12:38:25 2024, Name of Creating Application: Windows Installer XML v2.0.5805.0 (candle/light)
MD5:

909DB4061C32F798E94D746717782444

SHA1:

10F5FFFF17D2DD4476686A941A7BCC5F9B83B1B8

SHA256:

6EE98DB32852A2FF31A969D918BB7C730950BB15F24EA1BAF996697CEBC8B9FA

SSDEEP:

98304:KUUWX6HsM1siJtvl9XBoK0hiUB8ootGdjSwwIbZOH8DrWZi7ykNKM+8I9yGg5e+C:4opYFffMzvMaXURWgyBBsuG3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • LMIGuardianSvc.exe (PID: 5968)
      • LMIGuardianSvc.exe (PID: 6756)
      • LMIGuardianSvc.exe (PID: 6380)
      • LMIGuardianSvc.exe (PID: 1932)
      • LMIGuardianSvc.exe (PID: 6896)
      • LMIGuardianSvc.exe (PID: 3788)
      • LMIGuardianSvc.exe (PID: 4816)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 7020)
      • hamachi-2.exe (PID: 1532)
      • LMIGuardianSvc.exe (PID: 6896)
      • hamachi-2.exe (PID: 2276)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 6224)
      • hamachi-2.exe (PID: 3608)
      • drvinst.exe (PID: 1964)

    • Executable content was dropped or overwritten

      • drvinst.exe (PID: 1964)
      • hamachi-2.exe (PID: 3608)
      • drvinst.exe (PID: 416)

    • Suspicious use of NETSH.EXE

      • hamachi-2.exe (PID: 3608)
      • hamachi-2.exe (PID: 2276)

    • Windows service management via SC.EXE

      • sc.exe (PID: 4888)
      • sc.exe (PID: 3572)

    • Connects to unusual port

      • hamachi-2.exe (PID: 2276)

  • INFO

    • Checks proxy server information

      • msiexec.exe (PID: 3752)

    • The sample compiled with english language support

      • msiexec.exe (PID: 3752)
      • msiexec.exe (PID: 6224)

    • Checks supported languages

      • msiexec.exe (PID: 1564)
      • msiexec.exe (PID: 6224)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 3752)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3752)

    • Reads the computer name

      • msiexec.exe (PID: 1564)
      • msiexec.exe (PID: 6224)

    • Create files in a temporary directory

      • msiexec.exe (PID: 1564)

    • Manages system restore points

      • SrTasks.exe (PID: 7060)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3752)
      • msiexec.exe (PID: 6224)

    • Reads the software policy settings

      • msiexec.exe (PID: 3752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Hamachi Installer
Author: LogMeIn, Inc.
Keywords: Installer
Comments: This installer database contains the logic and data required to install Hamachi.
Template: ;1033
Pages: 200
Words: 2
Security: Read-only recommended
RevisionNumber: {C15EA8DB-41DF-4C48-8704-7D4FAB7D9EBB}
CreateDate: 2024:03:25 12:38:25
ModifyDate: 2024:03:25 12:38:25
Software: Windows Installer XML v2.0.5805.0 (candle/light)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
190
Monitored processes
47
Malicious processes
5
Suspicious processes
7

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs hamachi-2.exe conhost.exe no specs lmiguardiansvc.exe no specs drvinst.exe drvinst.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs hamachi-2.exe no specs conhost.exe no specs lmiguardiansvc.exe no specs sc.exe no specs conhost.exe no specs lmiguardiansvc.exe no specs hamachi-2.exe no specs lmiguardiansvc.exe no specs lmiguardiansvc.exe no specs sc.exe no specs conhost.exe no specs hamachi-2.exe lmiguardiansvc.exe no specs netsh.exe no specs conhost.exe no specs hamachi-2-ui.exe lmiguardiansvc.exe no specs slui.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
416DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\WINDOWS\INF\oem1.inf" "oem1.inf:db04a16c4ff220c2:Hamachi.ndi:15.28.40.464:hamachi," "42b53aaff" "00000000000001BC"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
620"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" --config Hamachi 25.0.0.1C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe—msiexec.exe
User:
SYSTEM
Company:
LogMeIn Inc.
Integrity Level:
SYSTEM
Description:
Hamachi Client Tunneling Engine
Exit code:
11
Version:
2, 3, 0, 111
Modules
Images
c:\program files (x86)\logmein hamachi\x64\hamachi-2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
1192netsh interface ipv6 add route ::/0 "24" 2620:9b::1900:1 metric=9000 publish=yesC:\Windows\System32\netsh.exe—hamachi-2.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1204C:\Windows\syswow64\MsiExec.exe -Embedding AF71BD8586078718BC12CC1E73F544ECC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1380\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1532\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1532"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s --get-configC:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe—services.exe
User:
SYSTEM
Company:
LogMeIn Inc.
Integrity Level:
SYSTEM
Description:
Hamachi Client Tunneling Engine
Exit code:
0
Version:
2, 3, 0, 111
Modules
Images
c:\program files (x86)\logmein hamachi\x64\hamachi-2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
1564C:\Windows\syswow64\MsiExec.exe -Embedding 13F0EFADE0010A06DAA00FBE283FDE0F CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1740netsh interface ipv6 add address interface="24" address=2620:9b::1905:c472 type=unicast store=persistentC:\Windows\System32\netsh.exe—hamachi-2.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
24 559
Read events
24 123
Write events
416
Delete events
20

Modification events

(PID) Process:(6224) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000049E99911FADCDB0150180000F8090000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6224) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000049E99911FADCDB0150180000F8090000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6224) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000056B3BD11FADCDB0150180000F8090000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6224) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000056B3BD11FADCDB0150180000F8090000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6224) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000056B3BD11FADCDB0150180000F8090000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6224) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000008E54C211FADCDB0150180000F8090000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6224) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(7020) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\24000001
Operation:writeName:Element
Value:
{5b970157-8568-11eb-b45c-806e6f6e6963}
(PID) Process:(7020) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\25000004
Operation:writeName:Element
Value:
0000000000000000
(PID) Process:(7020) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
48000000000000008B550012FADCDB016C1B000048120000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
36
Suspicious files
65
Text files
30
Unknown types
0

Dropped files

PID
Process
Filename
Type
6224msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6224msiexec.exeC:\Windows\Installer\17b1eb.msi —
MD5:—
SHA256:—
3752msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFAbinary
MD5:A4D179C1CB4ED4AAFB36D84405AF8FA9
SHA256:555D8884A55275EF8297AF44DC7052FCE874776A1ADF3F1F720C1C3A7B1F376D
6224msiexec.exeC:\Windows\Installer\MSIB7CC.tmp —
MD5:—
SHA256:—
3752msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI6A16.tmpexecutable
MD5:3BC82080D6356DAE779EED5135FABF66
SHA256:B076C9B888B130FB2FB5A74542C9A73322E78ED1F3F8476BE7A8209A20E56F7B
3752msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFAbinary
MD5:5CAA37CEEB0CD37B12A46CB1DC857878
SHA256:D71EA29DB3E4A9227EBF6ADFDCB9725C03A7D13886F5507B01E76FB7267AB7B5
3752msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI63EA.tmpexecutable
MD5:3BC82080D6356DAE779EED5135FABF66
SHA256:B076C9B888B130FB2FB5A74542C9A73322E78ED1F3F8476BE7A8209A20E56F7B
3752msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI711C.tmpexecutable
MD5:3BC82080D6356DAE779EED5135FABF66
SHA256:B076C9B888B130FB2FB5A74542C9A73322E78ED1F3F8476BE7A8209A20E56F7B
6224msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{07a3bce2-2e68-4047-98d8-66976d862e7f}_OnDiskSnapshotPropbinary
MD5:3FE05B79CD235AA8835406ADDD02B0E1
SHA256:D26B880F24D169F327D93B2431A175FF301BC1E812AB635BA0980A50C02C35E8
3752msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI64B6.tmpexecutable
MD5:3BC82080D6356DAE779EED5135FABF66
SHA256:B076C9B888B130FB2FB5A74542C9A73322E78ED1F3F8476BE7A8209A20E56F7B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
58
DNS requests
27
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3752
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAjegkJ27mLaGBP72%2FEoqPs%3D
unknown
—
—
whitelisted
3752
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
2708
hamachi-2-ui.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
3752
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
436
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6172
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6172
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2708
hamachi-2-ui.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6404
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3752
msiexec.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
436
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
436
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.1
  • 40.126.31.0
  • 40.126.31.128
  • 20.190.159.64
  • 20.190.159.75
  • 40.126.31.131
  • 20.190.159.4
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hamachi.msi