File name:

nada_164_046d-uipak_x32.exe

Full analysis: https://app.any.run/tasks/903f410e-c262-42ba-9f5d-36c7ab824f14
Verdict: Malicious activity
Analysis date: September 21, 2025, 07:38:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
qrcode
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

391D2487595EF8E8368B9271ABC76799

SHA1:

BFA7D96B893CA7FEA349BA8D01A4F6AC17FBD968

SHA256:

85156B6391D646DFD0A9E8FBFBA5BF234E1F629C78F0844034330A862FD77C1C

SSDEEP:

6144:tzZZxgKlrEf08BCxkA6IGfA9TlM432wa7AfNgm2/xqHTi0zY108OiI:tzZz3wf0YWkIGoBMJ5QN3neVO/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • nada_164_046d-uipak_x32.exe (PID: 6492)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • nada_164_046d-uipak_x32.exe (PID: 6492)

    • Launching a dropped file

      • nada_164_046d-uipak_x32.exe (PID: 6492)
      • uninstall.exe (PID: 2876)

    • Executable content was dropped or overwritten

      • nada_164_046d-uipak_x32.exe (PID: 6492)
      • uninstall.exe (PID: 2876)

    • There is functionality for taking screenshot (YARA)

      • nada_164_046d-uipak_x32.exe (PID: 6492)

    • Starts itself from another location

      • uninstall.exe (PID: 2876)

  • INFO

    • Create files in a temporary directory

      • nada_164_046d-uipak_x32.exe (PID: 6492)
      • uninstall.exe (PID: 2876)

    • The sample compiled with english language support

      • nada_164_046d-uipak_x32.exe (PID: 6492)
      • uninstall.exe (PID: 2876)

    • Checks proxy server information

      • slui.exe (PID: 1508)

    • Manual execution by a user

      • Au_.exe (PID: 1268)
      • uninstall.exe (PID: 2876)
      • Au_.exe (PID: 7060)
      • msedge.exe (PID: 1336)

    • Reads the computer name

      • nada_164_046d-uipak_x32.exe (PID: 6492)
      • identity_helper.exe (PID: 4196)

    • Checks supported languages

      • nada_164_046d-uipak_x32.exe (PID: 6492)
      • uninstall.exe (PID: 2876)
      • identity_helper.exe (PID: 4196)
      • Au_.exe (PID: 1268)
      • Au_.exe (PID: 7060)
      • Au_.exe (PID: 3704)

    • Reads Environment values

      • identity_helper.exe (PID: 4196)

    • Application launched itself

      • msedge.exe (PID: 1336)

    • Reads the software policy settings

      • slui.exe (PID: 1508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:09:09 13:23:33+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 26624
InitializedDataSize: 475136
UninitializedDataSize: 16896
EntryPoint: 0x3415
OSVersion: 5
ImageVersion: 6.1
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2.0.119.0
ProductVersionNumber: 2.0.119.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: Logitech
CompanyWebsite: http://www.logitech.com
FileDescription: -
FileVersion: 2
LegalCopyright: -
ProductName: LogiUI Pak
ProductVersion: 2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
193
Monitored processes
37
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start nada_164_046d-uipak_x32.exe slui.exe uninstall.exe au_.exe no specs au_.exe no specs rundll32.exe no specs au_.exe msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3652,i,7252976750735680898,1871839335150953328,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
536"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=7568,i,7252976750735680898,1871839335150953328,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1056"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=6192,i,7252976750735680898,1871839335150953328,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1268"C:\Users\admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" C:\Users\admin\AppData\Local\Temp\~nsu.tmp\Au_.exe—explorer.exe
User:
admin
Company:
Logitech
Integrity Level:
MEDIUM
Exit code:
2
Version:
2.00
Modules
Images
c:\users\admin\appdata\local\temp\~nsu.tmp\au_.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1336"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=DefaultC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1508C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2304"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6580,i,7252976750735680898,1871839335150953328,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2304"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=7772,i,7252976750735680898,1871839335150953328,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2876"C:\Users\admin\AppData\Local\Temp\LogiUI\Pak\uninstall.exe" C:\Users\admin\AppData\Local\Temp\LogiUI\Pak\uninstall.exe
explorer.exe
User:
admin
Company:
Logitech
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.00
Modules
Images
c:\users\admin\appdata\local\temp\logiui\pak\uninstall.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3092"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2072,i,7252976750735680898,1871839335150953328,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 980
Read events
5 921
Write events
53
Delete events
6

Modification events

(PID) Process:(6492) nada_164_046d-uipak_x32.exeKey:HKEY_CURRENT_USER\SOFTWARE\LogiShrd\DownloadAssistant
Operation:writeName:UIPath
Value:
C:\Users\admin\AppData\Local\Temp\LogiUI\Pak
(PID) Process:(6492) nada_164_046d-uipak_x32.exeKey:HKEY_CURRENT_USER\SOFTWARE\LogiShrd\DownloadAssistant
Operation:writeName:UIRemove
Value:
C:\Users\admin\AppData\Local\Temp\LogiUI\Pak\uninstall.exe
(PID) Process:(6492) nada_164_046d-uipak_x32.exeKey:HKEY_CURRENT_USER\SOFTWARE\LogiUI Pak\Components
Operation:writeName:UI
Value:
1
(PID) Process:(6492) nada_164_046d-uipak_x32.exeKey:HKEY_CURRENT_USER\SOFTWARE\LogiUI Pak
Operation:writeName:Path
Value:
C:\Users\admin\AppData\Local\Temp\LogiUI\Pak
(PID) Process:(6492) nada_164_046d-uipak_x32.exeKey:HKEY_CURRENT_USER\SOFTWARE\LogiUI Pak
Operation:writeName:StartMenuGroup
Value:
LogiLang Pak
(PID) Process:(6492) nada_164_046d-uipak_x32.exeKey:HKEY_CURRENT_USER\SOFTWARE\LogiUI Pak
Operation:writeName:InstallerLanguage
Value:
1033
(PID) Process:(3704) Au_.exeKey:HKEY_CURRENT_USER\SOFTWARE\LogiShrd\DownloadAssistant
Operation:delete valueName:UIPath
Value:
C:\Users\admin\AppData\Local\Temp\LogiUI\Pak
(PID) Process:(3704) Au_.exeKey:HKEY_CURRENT_USER\SOFTWARE\LogiShrd\DownloadAssistant
Operation:delete valueName:UIRemove
Value:
C:\Users\admin\AppData\Local\Temp\LogiUI\Pak\uninstall.exe
(PID) Process:(3704) Au_.exeKey:HKEY_CURRENT_USER\SOFTWARE\LogiUI Pak\Components
Operation:delete valueName:UI
Value:
1
(PID) Process:(3704) Au_.exeKey:HKEY_CURRENT_USER\SOFTWARE\LogiUI Pak\Components
Operation:delete keyName:(default)
Value:
Executable files
52
Suspicious files
850
Text files
159
Unknown types
0

Dropped files

PID
Process
Filename
Type
6492nada_164_046d-uipak_x32.exeC:\Users\admin\AppData\Local\Temp\nspCC06.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
6492nada_164_046d-uipak_x32.exeC:\Users\admin\AppData\Local\Temp\LogiUI\Pak\html\download.htmlhtml
MD5:8B9EB8DB472EBE5F0433AF26DC7D676F
SHA256:5B29978827B527001EDE12D08281C36CDCDF7C3D228B91166893285FCF7B4634
6492nada_164_046d-uipak_x32.exeC:\Users\admin\AppData\Local\Temp\LogiUI\Pak\css\basic-quickflips.csstext
MD5:F3856202AA9A07416089BA98AD01419E
SHA256:3502017550AF6C2E1BC08C5E0A5A55C1C48706BC10A51CF2212E3A6F687791DB
6492nada_164_046d-uipak_x32.exeC:\Users\admin\AppData\Local\Temp\LogiUI\Pak\html\welcome.htmlbinary
MD5:CFCB0E546D9A5B527FCBD970D5285BC7
SHA256:2065BCFA62B410FFA2B79AFC102B78A5071301CF16F94D2D42C12BE8365AB253
6492nada_164_046d-uipak_x32.exeC:\Users\admin\AppData\Local\Temp\LogiUI\Pak\css\smart.csstext
MD5:119E08845635C6B45D3AAAECE1801072
SHA256:98FCC4A906EC8E2534224EF834E8CB1A440BDA4D2C15044D434FDBE9BCC1E9D5
6492nada_164_046d-uipak_x32.exeC:\Users\admin\AppData\Local\Temp\LogiUI\Pak\img\button_close_disabled.pngimage
MD5:B5F344C060C2A81EB9CFDF8FF56B776A
SHA256:9EE069E6F1C689AF4B21CA276BA7EFC117AE2D391894A03CA75E91B9D70E4F44
6492nada_164_046d-uipak_x32.exeC:\Users\admin\AppData\Local\Temp\LogiUI\Pak\html\finish.htmlhtml
MD5:572FD27E56F1A964DD0D44350FBB0572
SHA256:B82DEA4689E45D9C1861D03AD7719CC17340EAC08225206769E3A7FC8817AFA6
6492nada_164_046d-uipak_x32.exeC:\Users\admin\AppData\Local\Temp\LogiUI\Pak\img\icon_error.pngimage
MD5:2FCD5ED873E72D95412A3AA11E04650F
SHA256:6F2DE92FDED990DEF91A02BA1F289C4FDE1121E3B01A6EF5888EB117B4118123
6492nada_164_046d-uipak_x32.exeC:\Users\admin\AppData\Local\Temp\LogiUI\Pak\img\logo.pngimage
MD5:9F06CA5B2F3A8777D742C7494679905B
SHA256:5992638A5C0BB07CEBD61F48BC56029808B5B5A1E6403DC0DFB42037A2771441
6492nada_164_046d-uipak_x32.exeC:\Users\admin\AppData\Local\Temp\LogiUI\Pak\img\logo-too-big.pngimage
MD5:1C91C0EAE593C8AEA82B2D5F5B15366C
SHA256:7E2FAF415843068E0E4136DF6D6A16771C94A8C33A7F9B7943A283BB1983110F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
154
DNS requests
153
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
92.123.133.196:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
1268
svchost.exe
GET
200
2.23.10.85:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
CZ
binary
814 b
whitelisted
1128
SIHClient.exe
GET
200
2.23.10.85:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
CZ
binary
419 b
whitelisted
5708
svchost.exe
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
GB
binary
471 b
whitelisted
1128
SIHClient.exe
GET
200
2.23.10.85:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
CZ
binary
813 b
whitelisted
1128
SIHClient.exe
GET
200
2.23.10.85:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
CZ
binary
407 b
whitelisted
1128
SIHClient.exe
GET
200
92.123.133.198:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
DE
binary
824 b
whitelisted
1128
SIHClient.exe
GET
200
2.23.10.85:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
CZ
binary
400 b
whitelisted
1128
SIHClient.exe
GET
200
2.23.10.85:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
CZ
binary
401 b
whitelisted
5328
SearchApp.exe
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
GB
binary
313 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5468
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
92.123.133.196:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
2.23.10.85:80
www.microsoft.com
AKAMAI-AS
CZ
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 4.231.128.59
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 92.123.133.196
  • 92.123.133.198
whitelisted
www.microsoft.com
  • 2.23.10.85
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.71
  • 40.126.31.71
  • 40.126.31.2
  • 40.126.31.128
  • 20.190.159.130
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.160.4
  • 40.126.32.76
  • 20.190.160.64
  • 40.126.32.138
  • 20.190.160.20
  • 20.190.160.22
  • 20.190.160.132
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 104.78.173.167
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 135.232.92.137
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
self.events.data.microsoft.com
  • 51.11.192.51
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
Potentially Bad Traffic
ET INFO Possible Chrome Plugin install
3092
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3092
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3092
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
nada_164_046d-uipak_x32.exe