download:

/downloads/SGTOnlineExamBrowserWin_5.0.20.msi

Full analysis: https://app.any.run/tasks/aab17432-a696-4109-857b-fef9f5d3eb0f
Verdict: Malicious activity
Analysis date: January 18, 2025, 02:29:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {4B7C06CD-80DC-472E-AAC6-F87D43E592A3}, Number of Words: 2, Subject: SGT Online Exam Browser, Author: Serco Canada Inc, Name of Creating Application: SGT Online Exam Browser, Template: ;1033, Comments: This installer database contains the logic and data required to install SGT Online Exam Browser., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Mon Dec 23 14:55:24 2024, Last Saved Time/Date: Mon Dec 23 14:55:24 2024, Last Printed: Mon Dec 23 14:55:24 2024, Number of Pages: 200
MD5:

C2BF07458515C9FE597717351EBC8272

SHA1:

44416121E61493E772C0E2D73E33FC29204294C1

SHA256:

8E55054FD48CDA81C634D3F7103BC445893B5C013CFA97B117560B2E7F439377

SSDEEP:

98304:H9ISN1orhnUGWL20qweDI4DSQko+JK8Y/FaDPoQ+lQAlvWN:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 6520)
      • SetupBundle.exe (PID: 5000)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 7104)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 540)
      • powershell.exe (PID: 6580)

  • SUSPICIOUS

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6520)
      • msiexec.exe (PID: 6480)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6520)
      • SetupBundle.exe (PID: 7116)
      • MicrosoftEdgeUpdate.exe (PID: 4952)

    • Executable content was dropped or overwritten

      • SetupBundle.exe (PID: 7116)
      • SetupBundle.exe (PID: 7156)
      • SetupBundle.exe (PID: 5000)
      • WebView2 Bootstrapper (PID: 5876)

    • Starts itself from another location

      • SetupBundle.exe (PID: 7116)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3532)

    • Searches for installed software

      • dllhost.exe (PID: 4160)
      • SetupBundle.exe (PID: 7116)

    • Process drops legitimate windows executable

      • SetupBundle.exe (PID: 7116)
      • SetupBundle.exe (PID: 5000)
      • WebView2 Bootstrapper (PID: 5876)
      • MicrosoftEdgeUpdate.exe (PID: 4952)

    • Creates a software uninstall entry

      • SetupBundle.exe (PID: 5000)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 4952)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 4952)

    • Starts application with an unusual extension

      • SetupBundle.exe (PID: 5000)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6480)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 7104)
      • powershell.exe (PID: 6580)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 7104)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 7104)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 7104)
      • powershell.exe (PID: 6580)

    • Checks a user's role membership (POWERSHELL)

      • powershell.exe (PID: 6580)

    • Application launched itself

      • powershell.exe (PID: 6580)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6244)
      • powershell.exe (PID: 540)
      • powershell.exe (PID: 6580)

    • An automatically generated document

      • msiexec.exe (PID: 6244)

    • Create files in a temporary directory

      • msiexec.exe (PID: 6244)
      • msiexec.exe (PID: 6520)
      • SetupBundle.exe (PID: 7156)
      • SetupBundle.exe (PID: 7116)
      • msiexec.exe (PID: 7104)
      • powershell.exe (PID: 540)
      • powershell.exe (PID: 6580)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6244)
      • msiexec.exe (PID: 6520)
      • wermgr.exe (PID: 6876)

    • Checks proxy server information

      • msiexec.exe (PID: 6244)
      • msiexec.exe (PID: 6520)
      • MicrosoftEdgeUpdate.exe (PID: 4952)
      • wermgr.exe (PID: 6876)

    • Reads the software policy settings

      • msiexec.exe (PID: 6244)
      • msiexec.exe (PID: 6520)
      • MicrosoftEdgeUpdate.exe (PID: 4952)
      • wermgr.exe (PID: 6876)
      • msiexec.exe (PID: 6480)
      • powershell.exe (PID: 540)
      • powershell.exe (PID: 6580)

    • Reads the computer name

      • msiexec.exe (PID: 6480)
      • msiexec.exe (PID: 6520)
      • SetupBundle.exe (PID: 7116)
      • SetupBundle.exe (PID: 5000)
      • MicrosoftEdgeUpdate.exe (PID: 4952)
      • msiexec.exe (PID: 7104)

    • The sample compiled with english language support

      • msiexec.exe (PID: 6244)
      • msiexec.exe (PID: 6520)
      • SetupBundle.exe (PID: 7156)
      • SetupBundle.exe (PID: 7116)
      • SetupBundle.exe (PID: 5000)
      • WebView2 Bootstrapper (PID: 5876)
      • MicrosoftEdgeUpdate.exe (PID: 4952)
      • msiexec.exe (PID: 6480)

    • Checks supported languages

      • msiexec.exe (PID: 6480)
      • msiexec.exe (PID: 6520)
      • SetupBundle.exe (PID: 7156)
      • SetupBundle.exe (PID: 7116)
      • SetupBundle.exe (PID: 5000)
      • MicrosoftEdgeUpdate.exe (PID: 4952)
      • WebView2 Bootstrapper (PID: 5876)
      • msiexec.exe (PID: 7104)

    • Reads Environment values

      • msiexec.exe (PID: 6520)
      • MicrosoftEdgeUpdate.exe (PID: 4952)
      • msiexec.exe (PID: 7104)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6244)
      • msiexec.exe (PID: 6520)
      • msiexec.exe (PID: 6480)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6520)
      • SetupBundle.exe (PID: 5000)
      • msiexec.exe (PID: 6480)

    • Manual execution by a user

      • WINWORD.EXE (PID: 836)
      • mspaint.exe (PID: 6936)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • WINWORD.EXE (PID: 836)

    • Sends debugging messages

      • WINWORD.EXE (PID: 836)

    • The process uses the downloaded file

      • msiexec.exe (PID: 6520)
      • WINWORD.EXE (PID: 836)
      • SetupBundle.exe (PID: 7116)
      • powershell.exe (PID: 6580)

    • Process checks computer location settings

      • msiexec.exe (PID: 6520)
      • SetupBundle.exe (PID: 7116)
      • MicrosoftEdgeUpdate.exe (PID: 4952)

    • Manages system restore points

      • SrTasks.exe (PID: 1556)
      • SrTasks.exe (PID: 6412)

    • Creates files in the program directory

      • SetupBundle.exe (PID: 5000)
      • WebView2 Bootstrapper (PID: 5876)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 540)
      • powershell.exe (PID: 6580)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 540)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6480)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 624)
      • OpenWith.exe (PID: 6096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {4B7C06CD-80DC-472E-AAC6-F87D43E592A3}
Words: 2
Subject: SGT Online Exam Browser
Author: Serco Canada Inc
LastModifiedBy: -
Software: SGT Online Exam Browser
Template: ;1033
Comments: This installer database contains the logic and data required to install SGT Online Exam Browser.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2024:12:23 14:55:24
ModifyDate: 2024:12:23 14:55:24
LastPrinted: 2024:12:23 14:55:24
Pages: 200
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
27
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe winword.exe ai.exe no specs mspaint.exe no specs setupbundle.exe setupbundle.exe setupbundle.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs webview2 bootstrapper microsoftedgeupdate.exe wermgr.exe srtasks.exe no specs conhost.exe no specs msiexec.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs openwith.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
540 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pss4080.ps1" -propFile "C:\Users\admin\AppData\Local\Temp\msi406E.txt" -scriptFile "C:\Users\admin\AppData\Local\Temp\scr406F.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\Temp\scr4070.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
624C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
836"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\holidaysterm.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1556C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2260\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3172\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3532C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4160C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
4500\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4716"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -File "C:\Users\admin\AppData\Local\Temp\scr5303.ps1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
4294770688
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
Total events
43 229
Read events
42 379
Write events
772
Delete events
78

Modification events

(PID) Process:(836) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\WINWORD\2200
Operation:delete valueName:0
Value:
ซ鴐㝅娴Ꝇ힬꿹�䙔�닜樁င$驄摽鶲…ީ湕湫睯쥮Ȇ∢්ł¢ᣂ숁씀褎예똏캲ǭ჉砃㐶ᇅᆘዒ看椀渀眀漀爀搀⸀攀砀攀씀‖ៅ肀줄࠘㈲㈱䐭捥
(PID) Process:(836) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\WINWORD\2200
Operation:delete keyName:(default)
Value:
(PID) Process:(836) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\836
Operation:writeName:0
Value:
0B0E10DA3407EC36AC7B42AFD42C6AD373F7F423004696D0DEEE8DAADAED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C50E8908C91003783634C511C406D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(836) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.16026&crev=3\0
Operation:writeName:FilePath
Value:
officeclient.microsoft.com\C1910611-6386-44C5-A2D7-BA994E8DB3CB
(PID) Process:(836) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.16026&crev=3\0
Operation:writeName:StartDate
Value:
20F92ADE5069DB01
(PID) Process:(836) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.16026&crev=3\0
Operation:writeName:EndDate
Value:
20B994081A6ADB01
(PID) Process:(836) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\836
Operation:writeName:0
Value:
0B0E10DA3407EC36AC7B42AFD42C6AD373F7F423004696D0DEEE8DAADAED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DA201C2190000C50E8908C91003783634C511C406D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(836) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
Operation:writeName:99)
Value:
39392900440300000200000000000000223932DE5069DB01A000000001000000740000002000000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C0072006F006F0074005C006F0066006600690063006500310036005C00670065006E006B006F002E0064006C006C000000670065006E006B006F002E0063006F006E006E00650063007400310032000000
(PID) Process:(836) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\AddInLoadTimes
Operation:writeName:Genko.Connect12
Value:
040000005E0000002F0000003F0000001000000000000000
(PID) Process:(836) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
Operation:delete valueName:99)
Value:
㤹)̈́
Executable files
234
Suspicious files
72
Text files
30
Unknown types
0

Dropped files

PID
Process
Filename
Type
6244msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43Dder
MD5:72A9F0EDFEA43F11441E13A3FF79BBB0
SHA256:E1CD480C4C41A0F25F81CC93155B3258183BE2ECAB9B09955B3A95063AD384B2
6244msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FFbinary
MD5:22E2FB11DAD84EB8802C3CC94D23F0BF
SHA256:B1E43A1A701632DF73508856CD6D4670C30ACEE60508F507D2DF0A87C8AF0961
6244msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF360AACB1570042DEFBC833317997D0_B5E3D2EB5673F5A34224EB974C41DB7Dbinary
MD5:C5DEEE43997E24C603636DA1910E6F99
SHA256:440C538767EBBC678108ADD081FE7724C595052F7BE3AD4312C7DB1FF7026488
6244msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5D5B.tmpexecutable
MD5:C9C085C00BC24802F066E5412DEFCF50
SHA256:A412B642DE0E94DB761EBD2834DDE72EED86E65FC4A580670A300015B874BA24
6244msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5D1A.tmpexecutable
MD5:C9C085C00BC24802F066E5412DEFCF50
SHA256:A412B642DE0E94DB761EBD2834DDE72EED86E65FC4A580670A300015B874BA24
6244msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AF360AACB1570042DEFBC833317997D0_B5E3D2EB5673F5A34224EB974C41DB7Dbinary
MD5:FBB0EC9ACE4509E500F878B02D1B184A
SHA256:21DA2B09CE1867767D6D98D954D9CF8ABB8335C98E3FF3377C9E81BB480EAFE8
6520msiexec.exeC:\Users\admin\AppData\Local\Temp\viewer.exeexecutable
MD5:F54537CCFB8EB8E463E12269F148654D
SHA256:71D389362E5803D398A11B45D1697CEDDB504AB47EB77A4C3D56659874A15A25
6244msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5E96.tmpexecutable
MD5:C9C085C00BC24802F066E5412DEFCF50
SHA256:A412B642DE0E94DB761EBD2834DDE72EED86E65FC4A580670A300015B874BA24
6244msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5B63.tmpexecutable
MD5:C9C085C00BC24802F066E5412DEFCF50
SHA256:A412B642DE0E94DB761EBD2834DDE72EED86E65FC4A580670A300015B874BA24
6244msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5D3A.tmpexecutable
MD5:C9C085C00BC24802F066E5412DEFCF50
SHA256:A412B642DE0E94DB761EBD2834DDE72EED86E65FC4A580670A300015B874BA24
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
57
DNS requests
35
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6244
msiexec.exe
GET
200
23.209.209.62:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCEE5A5DdU7eaMAAAAAFHTlH8%3D
unknown
—
—
whitelisted
6520
msiexec.exe
GET
200
142.250.186.35:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
836
WINWORD.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
3060
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
836
WINWORD.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
6876
wermgr.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4712
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
2632
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
unknown
5064
SearchApp.exe
2.21.65.154:443
www.bing.com
Akamai International B.V.
NL
unknown
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown
1176
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.72
  • 2.19.11.120
  • 2.19.11.105
unknown
www.microsoft.com
  • 95.101.149.131
  • 23.209.214.100
unknown
google.com
  • 142.250.185.110
unknown
www.bing.com
  • 2.21.65.154
  • 2.21.65.132
unknown
ocsp.digicert.com
  • 184.30.131.245
  • 2.17.190.73
unknown
login.live.com
  • 20.190.160.22
  • 40.126.32.74
  • 40.126.32.72
  • 40.126.32.138
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.140
  • 20.190.160.20
unknown
ocsp.entrust.net
  • 23.209.209.62
unknown
go.microsoft.com
  • 184.28.89.167
  • 2.18.97.227
unknown
ontariosecuritytesting.com
  • 172.67.74.225
  • 104.26.11.45
  • 104.26.10.45
unknown
c.pki.goog
  • 142.250.186.35
unknown

Threats

No threats detected
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/downloads/SGTOnlineExamBrowserWin_5.0.20.msi