File name:

37N00-2NTA-2if27ecr5.msi

Full analysis: https://app.any.run/tasks/852c470c-f577-460b-80b7-7ad84677a17f
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: June 06, 2025, 05:52:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
adware
takemyfile
advancedinstaller
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 14:06:51 2020, Security: 0, Code page: 1252, Revision Number: {95F67A08-8375-430F-9C9E-18084F36C5EA}, Number of Words: 10, Subject: 41324432342432, Author: 41324432342432, Name of Creating Application: Advanced Installer 18.3 build e2a0201b, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o 41324432342432., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5:

E7AC80117A84412F3CE7140407D01239

SHA1:

5B6F3C7AF43571845841D35364F4382CE150C3DE

SHA256:

A388FAEE5476F98EB465F5C5D66E6CEB7F8213E635DD20CDB2D5523C1564E464

SSDEEP:

98304:P211FdCQXgoB4VVq3VuCM22OmxotWLBGr31hWdb6WkBqzhfuEgtZEXvtzidyRiqF:wsH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ADWARE has been detected (SURICATA)

      • msiexec.exe (PID: 7404)

    • Create files in the Startup directory

      • msiexec.exe (PID: 3304)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2980)

    • Checks for Java to be installed

      • msiexec.exe (PID: 7404)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 7404)

    • Application launched itself

      • msiexec.exe (PID: 2980)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3304)
      • msiexec.exe (PID: 7404)

    • Detects AdvancedInstaller (YARA)

      • msiexec.exe (PID: 6048)

    • Reads the date of Windows installation

      • msiexec.exe (PID: 3304)

    • The system shut down or reboot

      • msiexec.exe (PID: 3304)

    • Access to an unwanted program domain was detected

      • msiexec.exe (PID: 7404)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 2596)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 2980)
      • msiexec.exe (PID: 7404)
      • msiexec.exe (PID: 3304)

    • Reads the computer name

      • msiexec.exe (PID: 2980)
      • msiexec.exe (PID: 7404)
      • msiexec.exe (PID: 3304)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2980)
      • msiexec.exe (PID: 7404)
      • msiexec.exe (PID: 3304)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7404)
      • msiexec.exe (PID: 3304)

    • The sample compiled with english language support

      • msiexec.exe (PID: 2980)
      • msiexec.exe (PID: 7404)

    • Reads Environment values

      • msiexec.exe (PID: 7404)
      • msiexec.exe (PID: 3304)

    • Create files in a temporary directory

      • msiexec.exe (PID: 7404)

    • Reads Microsoft Office registry keys

      • msiexec.exe (PID: 7404)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2980)

    • Launching a file from the Startup directory

      • msiexec.exe (PID: 3304)

    • Process checks computer location settings

      • msiexec.exe (PID: 3304)

    • Reads the software policy settings

      • slui.exe (PID: 5392)

    • Checks proxy server information

      • msiexec.exe (PID: 7404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
ModifyDate: 2020:09:18 14:06:51
Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {95F67A08-8375-430F-9C9E-18084F36C5EA}
Words: 10
Subject: 41324432342432
Author: 41324432342432
LastModifiedBy: -
Software: Advanced Installer 18.3 build e2a0201b
Template: ;1046
Comments: A base dados do instalador contêm a lógica e os dados necessários para instalar o 41324432342432.
Title: Installation Database
Keywords: Installer, MSI, Database
Pages: 200
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
244
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs sppextcomobj.exe no specs slui.exe msiexec.exe #ADWARE msiexec.exe msiexec.exe shutdown.exe no specs conhost.exe no specs slui.exe no specs plugscheduler.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2040C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2596"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2980C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3304C:\Windows\System32\MsiExec.exe -Embedding B0955BC548D9633D04F34B6B0AFED113C:\Windows\System32\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5392"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6048"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\37N00-2NTA-2if27ecr5.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6852"C:\Windows\System32\shutdown.exe" /r /f /t 60C:\Windows\System32\shutdown.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shutdown and Annotation Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shutdownext.dll
7012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—shutdown.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7404C:\Windows\syswow64\MsiExec.exe -Embedding 743F2A90B45CC0B90D644D7939B1D479C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7552C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 691
Read events
3 590
Write events
92
Delete events
9

Modification events

(PID) Process:(3304) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings
Operation:writeName:JITDebug
Value:
0
(PID) Process:(2980) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
A40B0000517D2E3BA7D6DB01
(PID) Process:(2980) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
5D1FC089D21C8D7E456376B7CB7E700FFDD74AE918DF43904B596697B24510D4
(PID) Process:(2980) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(2980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\12047e.rbs
Value:
31184551
(PID) Process:(2980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\12047e.rbsLow
Value:
(PID) Process:(2980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
(PID) Process:(2980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\D161690A4F6D12D4FB11F642FA454CE1
Operation:writeName:B72A53D954842C748A0D2C9840592555
Value:
C:\Users\Public\41324432342432\41324432342432\
(PID) Process:(2980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\FFE6D5EEFA32A9A4F8D36CCF0FC07604
Operation:writeName:B72A53D954842C748A0D2C9840592555
Value:
01:\Software\41324432342432\41324432342432\Version
Executable files
17
Suspicious files
61
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2980msiexec.exeC:\Windows\Installer\MSI6B2.tmpexecutable
MD5:20C782EB64C81AC14C83A853546A8924
SHA256:0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
7404msiexec.exeC:\Users\admin\AppData\Local\AdvinstAnalytics\6841e21dc28f998aee3c636a\1.0.0\{3658C8EF-B6A4-48F1-99E9-9C287E256EF7}.sessiontext
MD5:4399564E992EE9A7E5A53541215AC356
SHA256:811C81D673370D10C6A4EFDE5C8652026A0DA7307C16D2F9EDE8E23CCA00130E
2980msiexec.exeC:\Windows\Installer\12047c.msiexecutable
MD5:E7AC80117A84412F3CE7140407D01239
SHA256:A388FAEE5476F98EB465F5C5D66E6CEB7F8213E635DD20CDB2D5523C1564E464
7404msiexec.exeC:\Users\admin\AppData\Local\Temp\shi7AA.tmpexecutable
MD5:B44E8A0CFA9E2816449D5B56098890C3
SHA256:3827A5A73D4404B226B2FC00517EDB148AEB9185E0CCD790938FCBA86972DB54
2980msiexec.exeC:\Windows\Installer\MSI672.tmpexecutable
MD5:20C782EB64C81AC14C83A853546A8924
SHA256:0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
2980msiexec.exeC:\Windows\Installer\MSI6D2.tmpexecutable
MD5:D51A7E3BCE34C74638E89366DEEE2AAB
SHA256:7C6BDF16A0992DB092B7F94C374B21DE5D53E3043F5717A6EECAE614432E0DF5
7404msiexec.exeC:\Users\admin\AppData\Local\Temp\shi71C.tmpexecutable
MD5:F8020A76E8616207AB1FE91334E5E934
SHA256:67D9FFB4E10EB0C300DA8B52B32728F9683FD4E5AA70AE5307E15CDF0F07A07A
2980msiexec.exeC:\Windows\Installer\MSIC16.tmpexecutable
MD5:573F5E653258BF622AE1C0AD118880A2
SHA256:371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
2980msiexec.exeC:\Windows\Installer\MSIAFB.tmpexecutable
MD5:573F5E653258BF622AE1C0AD118880A2
SHA256:371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
2980msiexec.exeC:\Windows\Installer\MSIA8C.tmpexecutable
MD5:573F5E653258BF622AE1C0AD118880A2
SHA256:371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
30
DNS requests
21
Threats
40

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5608
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5608
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7404
msiexec.exe
POST
200
44.196.132.194:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
7404
msiexec.exe
POST
200
44.196.132.194:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
7404
msiexec.exe
POST
200
44.196.132.194:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
7404
msiexec.exe
POST
200
44.196.132.194:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
7404
msiexec.exe
POST
200
44.196.132.194:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5352
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5608
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5608
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5608
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.128
  • 20.190.159.2
  • 40.126.31.73
  • 40.126.31.0
  • 20.190.159.23
  • 40.126.31.1
  • 40.126.31.131
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
collect.installeranalytics.com
  • 44.196.132.194
  • 54.146.95.220
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
7404
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
7404
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
7404
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
7404
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
7404
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
7404
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
7404
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
7404
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
7404
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
7404
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
37N00-2NTA-2if27ecr5.msi