File name:

NosVarya Installer.msi

Full analysis: https://app.any.run/tasks/97a7f0c7-4375-4b50-8e52-0b7662235069
Verdict: Malicious activity
Analysis date: July 18, 2025, 18:30:11
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
advancedinstaller
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {0EDC0313-011F-4482-A03D-DAEFEC11E9C8}, Number of Words: 2, Subject: NosVarya, Author: NosVarya, Name of Creating Application: NosVarya, Template: x64;2057, Comments: This installer database contains the logic and data required to install NosVarya., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Jul 17 14:27:04 2025, Last Saved Time/Date: Thu Jul 17 14:27:04 2025, Last Printed: Thu Jul 17 14:27:04 2025, Number of Pages: 450
MD5:

C2E0A3A3EEB5C1F909216124B96FA730

SHA1:

04192933F24F8AB212ABF15FA4C5AF92E76623AC

SHA256:

84D17FFB71B3B1B98D9CB47E599F4A300070B240B3562DB97CB69A6839DA95AC

SSDEEP:

98304:V9IBo1SLUbnCC9qM10w1SG6pRJy9Az++rM4cjOUPTTTj2FhqMdWv3vWYQrg2rvns:aib7pleY5XFgU+/EJ4+u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 3628)

    • Detects AdvancedInstaller (YARA)

      • msiexec.exe (PID: 4320)
      • msiexec.exe (PID: 4916)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 4916)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 4916)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8028)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8052)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)

    • Starts a Microsoft application from unusual location

      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8052)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)

    • Executable content was dropped or overwritten

      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8028)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8052)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 4200)
      • NosVarya Launcher.exe (PID: 7084)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8052)
      • msiexec.exe (PID: 7880)
      • NosVarya Launcher.exe (PID: 4576)

    • Searches for installed software

      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8052)

    • Starts itself from another location

      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8052)

    • Creates a software uninstall entry

      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 4916)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 4916)

    • Executes application which crashes

      • NosVarya Launcher.exe (PID: 4576)

    • Connects to unusual port

      • NosVarya Launcher.exe (PID: 4576)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 4200)
      • msiexec.exe (PID: 4916)
      • msiexec.exe (PID: 5576)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8028)
      • identity_helper.exe (PID: 7828)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8052)
      • NosVarya Launcher.exe (PID: 7084)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)
      • msiexec.exe (PID: 6332)
      • msiexec.exe (PID: 7016)
      • msiexec.exe (PID: 7688)
      • msiexec.exe (PID: 8108)
      • msiexec.exe (PID: 7680)
      • NosVarya Launcher.exe (PID: 4576)
      • msiexec.exe (PID: 7880)

    • An automatically generated document

      • msiexec.exe (PID: 4320)

    • Reads the computer name

      • msiexec.exe (PID: 4916)
      • msiexec.exe (PID: 4200)
      • msiexec.exe (PID: 5576)
      • NosVarya Launcher.exe (PID: 7084)
      • identity_helper.exe (PID: 7828)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8052)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)
      • msiexec.exe (PID: 6332)
      • msiexec.exe (PID: 7016)
      • msiexec.exe (PID: 7688)
      • msiexec.exe (PID: 8108)
      • msiexec.exe (PID: 7680)
      • msiexec.exe (PID: 7880)
      • NosVarya Launcher.exe (PID: 4576)

    • Reads Environment values

      • msiexec.exe (PID: 4200)
      • msiexec.exe (PID: 5576)
      • identity_helper.exe (PID: 7828)
      • msiexec.exe (PID: 7680)
      • msiexec.exe (PID: 7880)

    • The sample compiled with english language support

      • msiexec.exe (PID: 4320)
      • msiexec.exe (PID: 4916)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8028)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8052)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)
      • msiexec.exe (PID: 3656)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4320)
      • msiexec.exe (PID: 4916)
      • msedge.exe (PID: 6524)
      • msiexec.exe (PID: 3656)

    • Manages system restore points

      • SrTasks.exe (PID: 5248)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 4916)

    • Process checks computer location settings

      • msiexec.exe (PID: 4200)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8052)

    • Manual execution by a user

      • msedge.exe (PID: 6524)
      • msiexec.exe (PID: 3656)
      • NosVarya Launcher.exe (PID: 2464)
      • NosVarya Launcher.exe (PID: 4576)

    • Application launched itself

      • msedge.exe (PID: 1232)
      • msedge.exe (PID: 7140)
      • msedge.exe (PID: 6524)

    • Create files in a temporary directory

      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8028)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8052)
      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)

    • Creates files in the program directory

      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)
      • NosVarya Launcher.exe (PID: 4576)

    • Launching a file from a Registry key

      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)

    • Reads the machine GUID from the registry

      • windowsdesktop-runtime-8.0.18-win-x64.exe (PID: 8136)
      • msiexec.exe (PID: 4916)

    • Reads the software policy settings

      • msiexec.exe (PID: 4916)
      • slui.exe (PID: 7924)
      • NosVarya Launcher.exe (PID: 4576)
      • WerFault.exe (PID: 4444)

    • Checks proxy server information

      • slui.exe (PID: 7924)
      • NosVarya Launcher.exe (PID: 4576)
      • WerFault.exe (PID: 4444)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 4444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {0EDC0313-011F-4482-A03D-DAEFEC11E9C8}
Words: 2
Subject: NosVarya
Author: NosVarya
LastModifiedBy: -
Software: NosVarya
Template: x64;2057
Comments: This installer database contains the logic and data required to install NosVarya.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2025:07:17 14:27:04
ModifyDate: 2025:07:17 14:27:04
LastPrinted: 2025:07:17 14:27:04
Pages: 450
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
209
Monitored processes
56
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs nosvarya launcher.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs windowsdesktop-runtime-8.0.18-win-x64.exe windowsdesktop-runtime-8.0.18-win-x64.exe windowsdesktop-runtime-8.0.18-win-x64.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe no specs msiexec.exe no specs slui.exe msiexec.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs nosvarya launcher.exe no specs nosvarya launcher.exe msedge.exe no specs msedge.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
592"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4348,i,11323631465457850805,12142607455312028373,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1160"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2724,i,11323631465457850805,12142607455312028373,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1232"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win-x64&os=win10&apphost_version=8.0.16&gui=trueC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—NosVarya Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1244"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2380,i,4788351070189470019,9590653552353193711,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1872"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=7904,i,11323631465457850805,12142607455312028373,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2464"C:\Program Files (x86)\NosVarya\NosVarya\NosVarya Launcher.exe" C:\Program Files (x86)\NosVarya\NosVarya\NosVarya Launcher.exe—explorer.exe
User:
admin
Company:
NosVarya Launcher
Integrity Level:
MEDIUM
Description:
NosVarya Launcher
Exit code:
3221226540
Version:
1.0.1
Modules
Images
c:\program files (x86)\nosvarya\nosvarya\nosvarya launcher.exe
c:\windows\system32\ntdll.dll
2524C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2256,i,4788351070189470019,9590653552353193711,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3628C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
32 113
Read events
30 095
Write events
1 915
Delete events
103

Modification events

(PID) Process:(4916) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000A56B4B0612F8DB013413000054150000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4916) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000002AD04D0612F8DB013413000054150000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4916) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000073D16C0612F8DB013413000054150000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4916) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000002AD3AA0612F8DB013413000054150000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3628) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000CD1EB90612F8DB012C0E0000300F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3628) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000CD1EB90612F8DB012C0E000048050000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3628) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000CD1EB90612F8DB012C0E0000A8040000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3628) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000CD1EB90612F8DB012C0E000064080000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3628) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4800000000000000E3CEC20612F8DB012C0E000064080000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4916) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000116E6A0612F8DB013413000054150000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
637
Suspicious files
236
Text files
87
Unknown types
19

Dropped files

PID
Process
Filename
Type
4916msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
4916msiexec.exeC:\Windows\Installer\191ca6.msi —
MD5:—
SHA256:—
4320msiexec.exeC:\Users\admin\AppData\Local\Temp\MSICD34.tmpexecutable
MD5:5209BA1F48C19C8D255B91A13ADBDD3D
SHA256:98911811A173883C729791A5D57E16533BFD8703D340F71DA80C3E5996AECF17
4320msiexec.exeC:\Users\admin\AppData\Local\Temp\MSICB1B.tmpexecutable
MD5:5209BA1F48C19C8D255B91A13ADBDD3D
SHA256:98911811A173883C729791A5D57E16533BFD8703D340F71DA80C3E5996AECF17
4320msiexec.exeC:\Users\admin\AppData\Local\Temp\MSICC28.tmpexecutable
MD5:5209BA1F48C19C8D255B91A13ADBDD3D
SHA256:98911811A173883C729791A5D57E16533BFD8703D340F71DA80C3E5996AECF17
4320msiexec.exeC:\Users\admin\AppData\Local\Temp\MSICBF8.tmpexecutable
MD5:5209BA1F48C19C8D255B91A13ADBDD3D
SHA256:98911811A173883C729791A5D57E16533BFD8703D340F71DA80C3E5996AECF17
4320msiexec.exeC:\Users\admin\AppData\Local\Temp\MSICD04.tmpexecutable
MD5:B38945FC98DD7E93BAEC16F7EF7309F3
SHA256:010DBD5FE1A3B664112A89AA098279185651911797581C1C4638FF510E481606
4320msiexec.exeC:\Users\admin\AppData\Local\Temp\MSICB89.tmpexecutable
MD5:5209BA1F48C19C8D255B91A13ADBDD3D
SHA256:98911811A173883C729791A5D57E16533BFD8703D340F71DA80C3E5996AECF17
4320msiexec.exeC:\Users\admin\AppData\Local\Temp\MSICC57.tmpexecutable
MD5:5209BA1F48C19C8D255B91A13ADBDD3D
SHA256:98911811A173883C729791A5D57E16533BFD8703D340F71DA80C3E5996AECF17
4916msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:8BADB14EDF1CE7F599AA2692A9C3C3B5
SHA256:1A3EDE72E9A5909837B42A035813FB236F422535F52B35906C8A6EFAFE5B9E2F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
108
DNS requests
103
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2460
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2588
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2588
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4456
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:n6MxSyMCew5m5Oexpv3fKVyBuX0woektpX_1Fe-o2wI&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
6524
msedge.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2320
svchost.exe
HEAD
200
208.89.74.29:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1753422376&P2=404&P3=2&P4=j%2fDXP4l5gyHTU1lYtP8yPuJ0UNsCsVbqlOK3EgqqZ1liTr98VuQ%2fxCPWYFoQkBtdRnsiHQfB3oqToX2U%2fwwgkg%3d%3d
unknown
—
—
whitelisted
6524
msedge.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
684
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2460
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2460
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.110
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.130
  • 20.190.160.2
  • 40.126.32.68
  • 20.190.160.22
  • 40.126.32.74
  • 40.126.32.72
  • 20.190.160.20
  • 20.190.160.66
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
Process
Message
NosVarya Launcher.exe
You must install .NET to run this application. App: C:\Program Files (x86)\NosVarya\NosVarya\NosVarya Launcher.exe Architecture: x64 App host version: 8.0.16 .NET location: Not found Learn more: https://aka.ms/dotnet/app-launch-failed Download the .NET runtime: https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win-x64&os=win10&apphost_version=8.0.16
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NosVarya Installer.msi