File name:

Install_PCIE_Win11_11025_05272025.exe

Full analysis: https://app.any.run/tasks/30c3fbdd-9081-4c11-b9ce-9f06ea02a3e5
Verdict: Malicious activity
Analysis date: June 10, 2025, 16:38:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

05D7C205361DA2851A5C061AD591386F

SHA1:

CD16EAF275118DCDC6727171B0DDB8390572C440

SHA256:

767AA3C13FD647CA480CF77505D3348EF51768ED8B88E513C5706B930FA487B4

SSDEEP:

98304:xiM94ikkrFFNhC2WsKDH/ZXm1TofSBVdlTD7UnhnD7YGkWnbwcKhcb6uwDhQF9TX:BVC5d2ah

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Install_PCIE_Win11_11025_05272025.exe (PID: 1156)
      • setup.exe (PID: 1812)
      • setup.exe (PID: 6232)

    • Drops a system driver (possible attempt to evade defenses)

      • Install_PCIE_Win11_11025_05272025.exe (PID: 1156)

    • Starts itself from another location

      • setup.exe (PID: 1812)

    • Searches for installed software

      • setup.exe (PID: 6232)
      • dllhost.exe (PID: 7140)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5372)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 1812)
      • setup.exe (PID: 6232)

  • INFO

    • The sample compiled with english language support

      • Install_PCIE_Win11_11025_05272025.exe (PID: 1156)
      • setup.exe (PID: 1812)
      • setup.exe (PID: 6232)

    • Create files in a temporary directory

      • Install_PCIE_Win11_11025_05272025.exe (PID: 1156)
      • setup.exe (PID: 1812)
      • setup.exe (PID: 6232)

    • Reads the computer name

      • Install_PCIE_Win11_11025_05272025.exe (PID: 1156)
      • setup.exe (PID: 1812)
      • setup.exe (PID: 6232)
      • ISBEW64.exe (PID: 1136)
      • ISBEW64.exe (PID: 6672)
      • ISBEW64.exe (PID: 1324)
      • ISBEW64.exe (PID: 2952)
      • ISBEW64.exe (PID: 6208)
      • ISBEW64.exe (PID: 2696)

    • Checks supported languages

      • Install_PCIE_Win11_11025_05272025.exe (PID: 1156)
      • setup.exe (PID: 1812)
      • setup.exe (PID: 6232)
      • ISBEW64.exe (PID: 1136)
      • ISBEW64.exe (PID: 2696)
      • ISBEW64.exe (PID: 6672)
      • ISBEW64.exe (PID: 1324)
      • ISBEW64.exe (PID: 2952)
      • ISBEW64.exe (PID: 6208)

    • Manages system restore points

      • SrTasks.exe (PID: 4412)

    • Reads Environment values

      • setup.exe (PID: 6232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (46.7)
.exe | Winzip Win32 self-extracting archive (generic) (38.8)
.exe | Win32 Executable (generic) (7.6)
.exe | Generic Win/DOS Executable (3.3)
.exe | DOS Executable Generic (3.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:11:29 18:00:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 107520
InitializedDataSize: 183808
UninitializedDataSize: -
EntryPoint: 0x19e1c
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
16
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start install_pcie_win11_11025_05272025.exe setup.exe setup.exe isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs slui.exe SPPSurrogate no specs install_pcie_win11_11025_05272025.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
420C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
1136C:\Users\admin\AppData\Local\Temp\{D53A7212-A03B-409A-9E88-C470F7E6C4FE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B0A4CBE-F694-429E-9F95-D51F15FDDDCE}C:\Users\admin\AppData\Local\Temp\{D53A7212-A03B-409A-9E88-C470F7E6C4FE}\ISBEW64.exe—setup.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
29.0.111
Modules
Images
c:\users\admin\appdata\local\temp\{d53a7212-a03b-409a-9e88-c470f7e6c4fe}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1156"C:\Users\admin\AppData\Local\Temp\Install_PCIE_Win11_11025_05272025.exe" C:\Users\admin\AppData\Local\Temp\Install_PCIE_Win11_11025_05272025.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\install_pcie_win11_11025_05272025.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1200C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1324C:\Users\admin\AppData\Local\Temp\{D53A7212-A03B-409A-9E88-C470F7E6C4FE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C155215-5097-4E83-91BE-E3EB09C2BDC3}C:\Users\admin\AppData\Local\Temp\{D53A7212-A03B-409A-9E88-C470F7E6C4FE}\ISBEW64.exe—setup.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
29.0.111
Modules
Images
c:\users\admin\appdata\local\temp\{d53a7212-a03b-409a-9e88-c470f7e6c4fe}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1560\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1812.\setup.exeC:\Users\admin\AppData\Local\Temp\7zS484ADE77\setup.exe
Install_PCIE_Win11_11025_05272025.exe
User:
admin
Company:
Realtek
Integrity Level:
HIGH
Description:
InstallScript Setup Launcher Unicode
Exit code:
0
Version:
1.0.0.38
Modules
Images
c:\users\admin\appdata\local\temp\7zs484ade77\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2696C:\Users\admin\AppData\Local\Temp\{D53A7212-A03B-409A-9E88-C470F7E6C4FE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EAA5AE23-74AE-4B23-A3A2-5D969B5AEE60}C:\Users\admin\AppData\Local\Temp\{D53A7212-A03B-409A-9E88-C470F7E6C4FE}\ISBEW64.exe—setup.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
29.0.111
Modules
Images
c:\users\admin\appdata\local\temp\{d53a7212-a03b-409a-9e88-c470f7e6c4fe}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2952C:\Users\admin\AppData\Local\Temp\{D53A7212-A03B-409A-9E88-C470F7E6C4FE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FBE2F4CB-640C-4F54-904A-3744A206D611}C:\Users\admin\AppData\Local\Temp\{D53A7212-A03B-409A-9E88-C470F7E6C4FE}\ISBEW64.exe—setup.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
29.0.111
Modules
Images
c:\users\admin\appdata\local\temp\{d53a7212-a03b-409a-9e88-c470f7e6c4fe}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
3752"C:\Users\admin\AppData\Local\Temp\Install_PCIE_Win11_11025_05272025.exe" C:\Users\admin\AppData\Local\Temp\Install_PCIE_Win11_11025_05272025.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\install_pcie_win11_11025_05272025.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
2 618
Read events
2 396
Write events
197
Delete events
25

Modification events

(PID) Process:(6232) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
Operation:delete valueName:%IS_PREREQ%-Realtek Ethernet Controller Driver
Value:
(PID) Process:(6232) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
Operation:delete valueName:%IS_PREREQF%-Realtek Ethernet Controller Driver
Value:
(PID) Process:(6232) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName: ISSetupPrerequisistes
Value:
(PID) Process:(6232) setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
400000000000000079D0ED3B26DADB015818000090130000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7140) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000001135F03B26DADB01E41B0000A4090000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7140) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000BA50163C26DADB01E41B0000A4090000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7140) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(5372) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B0D35D3C26DADB01FC140000CC060000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5372) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B0D35D3C26DADB01FC140000AC0F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5372) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B0D35D3C26DADB01FC140000E80A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
31
Suspicious files
51
Text files
674
Unknown types
18

Dropped files

PID
Process
Filename
Type
1156Install_PCIE_Win11_11025_05272025.exeC:\Users\admin\AppData\Local\Temp\7zS484ADE77\0x0404.initext
MD5:CD658D92DF1AD180483136CD6960E7F6
SHA256:5D31E009A36325032AB1521D2B1CA1A5BE89BB969D1948D4FE99C387B1055DB1
1156Install_PCIE_Win11_11025_05272025.exeC:\Users\admin\AppData\Local\Temp\7zS484ADE77\0x0403.initext
MD5:B306203AA1539AE5A541D42116066101
SHA256:B456FC5A73D06BA3B76BF803A875A4CA742BE1C7AC7E1A88A35CB62CE3346E3B
1156Install_PCIE_Win11_11025_05272025.exeC:\Users\admin\AppData\Local\Temp\7zS484ADE77\0x0402.initext
MD5:A65C6EA55E2CF446FF4DE8DE928B9518
SHA256:B3D3321A0B5BB440D6439F3AF39B3BBAD11F4C1426004C706F1BE117410EF9E0
1156Install_PCIE_Win11_11025_05272025.exeC:\Users\admin\AppData\Local\Temp\7zS484ADE77\0x0406.initext
MD5:75BFC6FA26A38A09F22331B425F99179
SHA256:8CD689EA619D6C331304E26098D4CF6C20FF4CC28FD9CAD1548BFE5ABC545350
1156Install_PCIE_Win11_11025_05272025.exeC:\Users\admin\AppData\Local\Temp\7zS484ADE77\0x0405.initext
MD5:AEE41AC183A4D1BEC95A511BC7F959FC
SHA256:E3A0AAF26E309FABCD308473387855F2E4B673358588439C4503B2965E5A8A0E
1156Install_PCIE_Win11_11025_05272025.exeC:\Users\admin\AppData\Local\Temp\7zS484ADE77\0x040b.initext
MD5:4E5D02CC0D690246F40C01771174E95C
SHA256:A26C1A4F9B457940D94D2DEAC6550C01740964051405E2999C1D884F6D46D5C7
1156Install_PCIE_Win11_11025_05272025.exeC:\Users\admin\AppData\Local\Temp\7zS484ADE77\0x0407.initext
MD5:1F71DEAF7E3C298F4C4112DB5E7AC029
SHA256:B4D2BF8DDEEE1E2ACC5DFAA14AC602A69F52195C38EAB4660408FD879AD41A56
1156Install_PCIE_Win11_11025_05272025.exeC:\Users\admin\AppData\Local\Temp\7zS484ADE77\0x0412.initext
MD5:59B2E4A2D3898F3E4F49186FF150E26C
SHA256:9416C7B55D1FD9DC06F20E1E3EBBAC1357217113833553D49586E339360529C7
1156Install_PCIE_Win11_11025_05272025.exeC:\Users\admin\AppData\Local\Temp\7zS484ADE77\0x0408.initext
MD5:F0D1FE8FE1139887DD77BD288C301211
SHA256:6596A4FF344BCD6B09E57F9F9BB7AC62E7BA7FD462FD798E45B1BB1917A2BC37
1156Install_PCIE_Win11_11025_05272025.exeC:\Users\admin\AppData\Local\Temp\7zS484ADE77\0x040a.initext
MD5:B216BC7B827622578E60B0B37CE9C4C0
SHA256:4E42D96CF24224D3ED43E7E14227B96FDE3B43235636480F8861DB0B048FFDDF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
33
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3576
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2952
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2952
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6960
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
3576
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3576
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.216.77.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.22
  • 20.190.160.14
  • 40.126.32.76
  • 40.126.32.138
  • 20.190.160.20
  • 20.190.160.130
  • 20.190.160.132
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.8
  • 23.216.77.19
  • 23.216.77.14
  • 23.216.77.5
  • 23.216.77.7
  • 23.216.77.20
  • 23.216.77.17
  • 23.216.77.10
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Install_PCIE_Win11_11025_05272025.exe