File name:

hamachi (1).msi

Full analysis: https://app.any.run/tasks/f6e93f7d-6cb7-4b34-bdaf-119b5a746790
Verdict: Malicious activity
Analysis date: July 15, 2024, 18:08:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Hamachi Installer, Author: LogMeIn, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install Hamachi., Template: ;1033, Number of Pages: 200, Number of Words: 2, Security: 2, Revision Number: {C15EA8DB-41DF-4C48-8704-7D4FAB7D9EBB}, Create Time/Date: Mon Mar 25 12:38:25 2024, Last Saved Time/Date: Mon Mar 25 12:38:25 2024, Name of Creating Application: Windows Installer XML v2.0.5805.0 (candle/light)
MD5:

909DB4061C32F798E94D746717782444

SHA1:

10F5FFFF17D2DD4476686A941A7BCC5F9B83B1B8

SHA256:

6EE98DB32852A2FF31A969D918BB7C730950BB15F24EA1BAF996697CEBC8B9FA

SSDEEP:

98304:KUUWX6HsM1siJtvl9XBoK0hiUB8ootGdjSwwIbZOH8DrWZi7ykNKM+8I9yGg5e+C:4opYFffMzvMaXURWgyBBsuG3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6280)
      • msiexec.exe (PID: 6520)
      • hamachi-2.exe (PID: 1164)
      • drvinst.exe (PID: 5680)
      • drvinst.exe (PID: 6420)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 6520)

    • Creates a writable file in the system directory

      • hamachi-2.exe (PID: 1164)
      • drvinst.exe (PID: 6420)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 992)
      • hamachi-2.exe (PID: 7948)
      • LMIGuardianSvc.exe (PID: 8004)
      • hamachi-2.exe (PID: 6196)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 6520)
      • hamachi-2.exe (PID: 1164)
      • drvinst.exe (PID: 6420)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6520)
      • hamachi-2.exe (PID: 1164)
      • drvinst.exe (PID: 6420)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6520)

    • Executable content was dropped or overwritten

      • hamachi-2.exe (PID: 1164)
      • drvinst.exe (PID: 6420)
      • drvinst.exe (PID: 5680)

    • Creates or modifies Windows services

      • hamachi-2.exe (PID: 1164)
      • drvinst.exe (PID: 5680)

    • Creates files in the driver directory

      • hamachi-2.exe (PID: 1164)
      • drvinst.exe (PID: 6420)

    • Reads security settings of Internet Explorer

      • hamachi-2.exe (PID: 1164)
      • hamachi-2.exe (PID: 7948)
      • hamachi-2.exe (PID: 7748)
      • hamachi-2.exe (PID: 6196)
      • hamachi-2-ui.exe (PID: 7028)

    • Suspicious use of NETSH.EXE

      • hamachi-2.exe (PID: 1164)
      • hamachi-2.exe (PID: 6196)

    • Changes Internet Explorer settings (feature browser emulation)

      • msiexec.exe (PID: 2032)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6280)

    • Checks supported languages

      • msiexec.exe (PID: 6520)
      • msiexec.exe (PID: 6668)
      • msiexec.exe (PID: 2032)
      • hamachi-2.exe (PID: 1164)
      • msiexec.exe (PID: 5636)
      • drvinst.exe (PID: 6420)
      • LMIGuardianSvc.exe (PID: 4164)
      • drvinst.exe (PID: 5680)
      • hamachi-2.exe (PID: 7948)
      • LMIGuardianSvc.exe (PID: 7968)
      • LMIGuardianSvc.exe (PID: 8004)
      • hamachi-2.exe (PID: 7748)
      • LMIGuardianSvc.exe (PID: 7804)
      • LMIGuardianSvc.exe (PID: 7916)
      • hamachi-2.exe (PID: 6196)
      • LMIGuardianSvc.exe (PID: 6804)
      • hamachi-2-ui.exe (PID: 7028)
      • LMIGuardianSvc.exe (PID: 7308)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6280)
      • LMIGuardianSvc.exe (PID: 7308)
      • hamachi-2-ui.exe (PID: 7028)

    • Checks proxy server information

      • msiexec.exe (PID: 6280)

    • Reads the computer name

      • msiexec.exe (PID: 6520)
      • msiexec.exe (PID: 6668)
      • msiexec.exe (PID: 2032)
      • msiexec.exe (PID: 5636)
      • LMIGuardianSvc.exe (PID: 4164)
      • hamachi-2.exe (PID: 1164)
      • drvinst.exe (PID: 6420)
      • drvinst.exe (PID: 5680)
      • LMIGuardianSvc.exe (PID: 7916)
      • hamachi-2.exe (PID: 7948)
      • LMIGuardianSvc.exe (PID: 7968)
      • LMIGuardianSvc.exe (PID: 7804)
      • hamachi-2.exe (PID: 7748)
      • LMIGuardianSvc.exe (PID: 6804)
      • LMIGuardianSvc.exe (PID: 8004)
      • hamachi-2.exe (PID: 6196)
      • hamachi-2-ui.exe (PID: 7028)
      • LMIGuardianSvc.exe (PID: 7308)

    • Reads the software policy settings

      • msiexec.exe (PID: 6280)
      • msiexec.exe (PID: 6520)
      • hamachi-2.exe (PID: 1164)
      • drvinst.exe (PID: 6420)

    • Create files in a temporary directory

      • msiexec.exe (PID: 6668)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6520)
      • hamachi-2.exe (PID: 1164)
      • drvinst.exe (PID: 6420)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6280)
      • msiexec.exe (PID: 6520)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6520)

    • Disables trace logs

      • netsh.exe (PID: 7364)
      • netsh.exe (PID: 7288)
      • netsh.exe (PID: 7660)
      • netsh.exe (PID: 7584)
      • netsh.exe (PID: 6652)

    • Creates or modifies Windows services

      • msiexec.exe (PID: 2032)

    • Creates files in the program directory

      • LMIGuardianSvc.exe (PID: 7308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Hamachi Installer
Author: LogMeIn, Inc.
Keywords: Installer
Comments: This installer database contains the logic and data required to install Hamachi.
Template: ;1033
Pages: 200
Words: 2
Security: Read-only recommended
RevisionNumber: {C15EA8DB-41DF-4C48-8704-7D4FAB7D9EBB}
CreateDate: 2024:03:25 12:38:25
ModifyDate: 2024:03:25 12:38:25
Software: Windows Installer XML v2.0.5805.0 (candle/light)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
40
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs hamachi-2.exe conhost.exe no specs lmiguardiansvc.exe no specs drvinst.exe drvinst.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs hamachi-2.exe no specs conhost.exe no specs lmiguardiansvc.exe no specs sc.exe no specs conhost.exe no specs lmiguardiansvc.exe no specs hamachi-2.exe no specs lmiguardiansvc.exe no specs lmiguardiansvc.exe no specs sc.exe no specs conhost.exe no specs hamachi-2.exe lmiguardiansvc.exe no specs netsh.exe no specs conhost.exe no specs hamachi-2-ui.exe no specs lmiguardiansvc.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
992C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" --add-tap-at-install HamachiC:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
msiexec.exe
User:
SYSTEM
Company:
LogMeIn Inc.
Integrity Level:
SYSTEM
Description:
Hamachi Client Tunneling Engine
Exit code:
0
Version:
2, 3, 0, 111
Modules
Images
c:\program files (x86)\logmein hamachi\x64\hamachi-2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
2032C:\Windows\syswow64\MsiExec.exe -Embedding D2CC04DD76CE546B8AED944C0C4B2A05 E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4164"C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 1164 /CUSTOM Hamachi C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe—hamachi-2.exe
User:
SYSTEM
Company:
LogMeIn, Inc.
Integrity Level:
SYSTEM
Description:
LMIGuardianSvc
Exit code:
0
Version:
10.1.1742
Modules
Images
c:\program files (x86)\logmein hamachi\x64\lmiguardiansvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\logmein hamachi\x64\lmiguardiandll.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
4196\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—hamachi-2.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5636C:\Windows\syswow64\MsiExec.exe -Embedding 9C797897DEEC562AF47623374A3A66E8C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5680DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\WINDOWS\INF\oem1.inf" "oem1.inf:db04a16c4ff220c2:Hamachi.ndi:15.28.40.464:hamachi," "42b53aaff" "00000000000001CC"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
6196"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -sC:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
services.exe
User:
SYSTEM
Company:
LogMeIn Inc.
Integrity Level:
SYSTEM
Description:
Hamachi Client Tunneling Engine
Version:
2, 3, 0, 111
Modules
Images
c:\program files (x86)\logmein hamachi\x64\hamachi-2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
6280"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\hamachi (1).msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6420DrvInst.exe "4" "1" "c:\program files (x86)\logmein hamachi\x64\hamdrv.inf" "9" "42b53aaff" "00000000000001CC" "WinSta0\Default" "00000000000001DC" "208" "c:\program files (x86)\logmein hamachi\x64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
Total events
26 585
Read events
26 155
Write events
408
Delete events
22

Modification events

(PID) Process:(6520) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000003BCED504E2D6DA0178190000B8160000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6520) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000003BCED504E2D6DA0178190000B8160000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6520) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000005C601D05E2D6DA0178190000B8160000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6520) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000005C601D05E2D6DA0178190000B8160000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6520) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000A6212205E2D6DA0178190000B8160000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6520) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000022EB2605E2D6DA0178190000B8160000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6520) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6520) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000DF8E9405E2D6DA0178190000B8160000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6520) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000095F29605E2D6DA0178190000D0130000E80300000100000000000000000000001ED0B27A3A45A64B9D6676BBA5DF68A500000000000000000000000000000000
(PID) Process:(992) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000F8BE9B05E2D6DA01E0030000900A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
35
Suspicious files
32
Text files
24
Unknown types
6

Dropped files

PID
Process
Filename
Type
6520msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6520msiexec.exeC:\WINDOWS\Installer\1d6786.msi —
MD5:—
SHA256:—
6280msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFAder
MD5:3A1B76634AA461F395539E860AD61AD9
SHA256:09A984EB5D9F13028EE0294CB8FD09F4033EBDFCC74A7C0D3F6A81C2C5F8987C
6520msiexec.exeC:\WINDOWS\Installer\MSI7111.tmp —
MD5:—
SHA256:—
6280msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141der
MD5:8376D373EA2565BD3904EE6498B30F23
SHA256:382F93BE3D53152F0E92510E6AB88B3DE25828255225F7EEE4C769F7536F678D
6280msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:3440F7CE10498E6031C9761825A14B80
SHA256:50489A11D73C482006345E4DD7BC794F0F2C132B82857A343A7D6E66F002AC3C
6520msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:1479233E49AD8047A849607C3A5F2F27
SHA256:A954059F9E823A6B8D52F2101EDF99AAA8CB89D5FB891797370A238CB581974A
6520msiexec.exeC:\WINDOWS\Installer\MSI6AC3.tmpexecutable
MD5:3BC82080D6356DAE779EED5135FABF66
SHA256:B076C9B888B130FB2FB5A74542C9A73322E78ED1F3F8476BE7A8209A20E56F7B
6520msiexec.exeC:\WINDOWS\Installer\MSI6CA8.tmpexecutable
MD5:3BC82080D6356DAE779EED5135FABF66
SHA256:B076C9B888B130FB2FB5A74542C9A73322E78ED1F3F8476BE7A8209A20E56F7B
6280msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI8DD.tmpexecutable
MD5:3BC82080D6356DAE779EED5135FABF66
SHA256:B076C9B888B130FB2FB5A74542C9A73322E78ED1F3F8476BE7A8209A20E56F7B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
78
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3508
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6280
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
6280
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6280
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAjegkJ27mLaGBP72%2FEoqPs%3D
unknown
—
—
whitelisted
5832
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
244
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5832
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1928
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4656
SearchApp.exe
92.123.104.18:443
www.bing.com
Akamai International B.V.
DE
unknown
2064
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3508
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
www.bing.com
  • 92.123.104.18
  • 92.123.104.19
  • 92.123.104.30
  • 92.123.104.31
  • 92.123.104.22
  • 92.123.104.25
  • 92.123.104.34
  • 92.123.104.26
  • 92.123.104.23
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.68
  • 40.126.32.133
  • 40.126.32.140
  • 40.126.32.136
  • 40.126.32.72
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.22
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.74.47.205
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hamachi (1).msi