File name:

em_XsVM4WZh_installer_Win7-Win11_x86_x64.msi

Full analysis: https://app.any.run/tasks/441980ef-5745-4ff8-b662-0ddf28477b43
Verdict: Malicious activity
Analysis date: March 24, 2025, 13:33:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
python
crypto-regex
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Endpoint Manager Communication Client, Author: ITarian LLC, Keywords: Installer, Comments: Version 9.2.49090.24060, Template: Intel;0, Revision Number: {C7630387-EB33-424A-A543-BE5617F676DD}, Create Time/Date: Mon Sep 16 19:55:22 2024, Last Saved Time/Date: Mon Sep 16 19:55:22 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.4330.19070), Security: 2
MD5:

8F7EA7BE4386DA8059546CC2A0646DE1

SHA1:

4E0812D11EE4344E599D5C8A5F52E3E0664D2642

SHA256:

A9C42F11E75C3525D8D0F3F036C2F603E60FE102FC68B8F22A8B4C81779652A2

SSDEEP:

786432:i74NR4XVuHySZut2tIbSyFjsYGvBIPFY2SNrrMAIx:i74NR4XVuSSZMIIbS4jSvBIPFYHFQz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 896)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 4112)
      • ITSMService.exe (PID: 3364)
      • WmiApSrv.exe (PID: 2416)
      • RmmService.exe (PID: 7136)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 896)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 896)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 896)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 2344)
      • python_x86_Lib.exe (PID: 672)

    • Executable content was dropped or overwritten

      • python_x86_Lib.exe (PID: 672)

    • Process drops python dynamic module

      • python_x86_Lib.exe (PID: 672)

    • Reads security settings of Internet Explorer

      • python_x86_Lib.exe (PID: 672)

    • Executing commands from ".cmd" file

      • python_x86_Lib.exe (PID: 672)

    • Loads Python modules

      • RmmService.exe (PID: 2568)
      • RmmService.exe (PID: 7136)

    • Found regular expressions for crypto-addresses (YARA)

      • ITSMService.exe (PID: 3364)
      • ITSMAgent.exe (PID: 3620)

    • Searches for installed software

      • ITSMService.exe (PID: 3364)

    • There is functionality for taking screenshot (YARA)

      • ITSMAgent.exe (PID: 3620)
      • ITSMAgent.exe (PID: 3024)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 536)

    • Reads the software policy settings

      • msiexec.exe (PID: 536)
      • msiexec.exe (PID: 896)
      • slui.exe (PID: 4000)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 536)

    • Checks proxy server information

      • msiexec.exe (PID: 536)
      • slui.exe (PID: 4000)

    • The sample compiled with english language support

      • msiexec.exe (PID: 896)
      • python_x86_Lib.exe (PID: 672)

    • Reads the computer name

      • msiexec.exe (PID: 896)
      • msiexec.exe (PID: 2344)
      • msiexec.exe (PID: 968)
      • python_x86_Lib.exe (PID: 672)
      • ITSMService.exe (PID: 3364)
      • ITSMAgent.exe (PID: 3024)
      • ITSMAgent.exe (PID: 3620)
      • ITSMAgent.exe (PID: 1300)
      • RmmService.exe (PID: 2568)
      • RmmService.exe (PID: 7136)

    • Checks supported languages

      • msiexec.exe (PID: 896)
      • msiexec.exe (PID: 2344)
      • msiexec.exe (PID: 968)
      • python_x86_Lib.exe (PID: 672)
      • ITSMService.exe (PID: 3364)
      • ITSMAgent.exe (PID: 3024)
      • ITSMAgent.exe (PID: 3620)
      • ITSMAgent.exe (PID: 1300)
      • RmmService.exe (PID: 2568)
      • RmmService.exe (PID: 7136)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 896)
      • ITSMService.exe (PID: 3364)
      • RmmService.exe (PID: 7136)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 896)

    • Manages system restore points

      • SrTasks.exe (PID: 6576)

    • Process checks computer location settings

      • python_x86_Lib.exe (PID: 672)

    • Creates files in the program directory

      • python_x86_Lib.exe (PID: 672)
      • ITSMService.exe (PID: 3364)
      • RmmService.exe (PID: 7136)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Endpoint Manager Communication Client
Author: ITarian LLC
Keywords: Installer
Comments: Version 9.2.49090.24060
Template: Intel;0
RevisionNumber: {C7630387-EB33-424A-A543-BE5617F676DD}
CreateDate: 2024:09:16 19:55:22
ModifyDate: 2024:09:16 19:55:22
Pages: 301
Words: 2
Software: Windows Installer XML Toolset (3.11.4330.19070)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
21
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs cmd.exe no specs conhost.exe no specs python_x86_lib.exe slui.exe cmd.exe no specs conhost.exe no specs itsmservice.exe itsmagent.exe no specs itsmagent.exe no specs itsmagent.exe no specs wmiapsrv.exe no specs rmmservice.exe no specs conhost.exe no specs rmmservice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\WINDOWS\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\ITarian\Endpoint Manager\" && "C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe" "C:\Windows\SysWOW64\cmd.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
536"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\Desktop\em_XsVM4WZh_installer_Win7-Win11_x86_x64.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
672"C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe" C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe
cmd.exe
User:
SYSTEM
Company:
Oleg N. Scherbakov
Integrity Level:
SYSTEM
Description:
7z Setup SFX (x86)
Exit code:
0
Version:
1.6.0.2712
Modules
Images
c:\program files (x86)\itarian\endpoint manager\python_x86_lib.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
968C:\Windows\syswow64\MsiExec.exe -Embedding 5E3DD90C4A1FB4CEDB0E842DFAB822B4C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1300"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe—ITSMService.exe
User:
admin
Company:
ITarian
Integrity Level:
MEDIUM
Description:
Endpoint Manager Tray Application
Exit code:
0
Version:
9.2.49090.24060
Modules
Images
c:\program files (x86)\itarian\endpoint manager\itsmagent.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2344C:\Windows\syswow64\MsiExec.exe -Embedding 681F90EE5DFB099A4ECF27D82010621D E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2416C:\WINDOWS\system32\wbem\WmiApSrv.exeC:\Windows\System32\wbem\WmiApSrv.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Performance Reverse Adapter
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\psapi.dll
2568"C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe" --startC:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe—ITSMService.exe
User:
SYSTEM
Company:
ITarian
Integrity Level:
SYSTEM
Description:
Endpoint Manager RMM Service
Exit code:
0
Modules
Images
c:\program files (x86)\itarian\endpoint manager\rmmservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
Total events
18 465
Read events
17 924
Write events
522
Delete events
19

Modification events

(PID) Process:(896) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000057FF0A7BC19CDB018003000078070000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(896) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000057FF0A7BC19CDB018003000078070000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(896) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000CE8B527BC19CDB018003000078070000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(896) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000CE8B527BC19CDB018003000078070000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(896) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000B0EE547BC19CDB018003000078070000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(896) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000061B5597BC19CDB018003000078070000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(896) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(896) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000A2F8C47BC19CDB018003000078070000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(896) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000235CC77BC19CDB0180030000A4040000E8030000010000000000000000000000EA01F613086B9740B3CCB71C29298B1E00000000000000000000000000000000
(PID) Process:(4112) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4800000000000000DF03D87BC19CDB011010000050120000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
89
Suspicious files
340
Text files
2 219
Unknown types
0

Dropped files

PID
Process
Filename
Type
896msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
896msiexec.exeC:\Windows\Installer\117443.msi —
MD5:—
SHA256:—
536msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225Fbinary
MD5:9E290019BF164BAA6C22D5D15D0B7EAD
SHA256:C39879CB97AFCA23BD2B5D432214F7555BB17286FF9047075FFE3D4182A0EAB7
536msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225Fbinary
MD5:22D52EA2716ACFD0E2BA304641A8EB0E
SHA256:3B98A64E000BDF178CF22F1F3B256A2C1C0DDD3365C8A862598BC0DEDCE25F54
536msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013binary
MD5:8BE2787F490295AEB2A62B1DE2A009EA
SHA256:F538C9EFA3BF0A2D1CCDE9FDB73D1881EB79535022F6CF5502258CB1FA49DFC7
896msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:417D66F2E336699CA4C69B9F154C97B3
SHA256:BDBDF11B643F75D001E591283E1E3143334FFB7D3371EFBDAF2EF79BBC647D02
536msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_B2CA343459C05DC728694AF1B28799A4binary
MD5:BDB019E6FE2645C770C2DB5CC1B6C8CE
SHA256:F1E09416E86D37E7F4B2B80917204B357E0A3A6C284D1A6495B493FE0312BA39
896msiexec.exeC:\Windows\Installer\MSI81F3.tmpexecutable
MD5:D53B2B818B8C6A2B2BAE3A39E988AF10
SHA256:2A81878BE73B5C1D7D02C6AFC8A82336D11E5F8749EAACF54576638D81DED6E2
536msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_B2CA343459C05DC728694AF1B28799A4binary
MD5:5A2FCF3F9F29E7ADF19E61041109A9D4
SHA256:2E63EFCD19253851517942D6CE8BE9EBB341DEEB851D94EAB9524FAB5D3CC4E2
896msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{13f601ea-6b08-4097-b3cc-b71c29298b1e}_OnDiskSnapshotPropbinary
MD5:5EC6ACBFE2F23236C2031B8E02EFF9D7
SHA256:120B3ADA570DDBC37E1F13B03FD173C724C6BA12382600161B5A911068B249A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
60
TCP/UDP connections
71
DNS requests
22
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
536
msiexec.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D
unknown
—
—
whitelisted
536
msiexec.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D
unknown
—
—
whitelisted
536
msiexec.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQDFkkwCc%2F6QyRK%2F5PUP8RSE
unknown
—
—
whitelisted
—
—
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
52.165.164.15:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
856
SIHClient.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
856
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
52.29.114.9:443
https://mdmsupport.cmdm.comodo.com/enroll/resolve/token/XsVM4WZh
unknown
text
128 b
—
856
SIHClient.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
—
—
PUT
200
54.234.53.118:443
https://evphoto-msp.itsm-us1.comodo.com/command/windows/
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
536
msiexec.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
whitelisted
6028
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4000
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3364
ITSMService.exe
18.157.52.237:443
mdmsupport.cmdm.comodo.com
AMAZON-02
DE
unknown
3364
ITSMService.exe
54.234.53.118:443
evphoto-msp.itsm-us1.comodo.com
AMAZON-AES
US
unknown
3812
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
mdmsupport.cmdm.comodo.com
  • 18.157.52.237
  • 52.29.114.9
unknown
evphoto-msp.itsm-us1.comodo.com
  • 54.234.53.118
unknown
xmpp.itsm-us1.comodo.com
  • 174.129.244.210
  • 34.227.128.175
unknown
api.dragonplatform.net
  • 35.222.52.117
unknown
self.events.data.microsoft.com
  • 20.189.173.25
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO Outgoing Basic Auth Base64 HTTP Password detected unencrypted
—
—
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Get-WmiObject Cmdlet has been detected
—
—
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
—
—
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Get-WmiObject Cmdlet has been detected
Process
Message
ITSMService.exe
QCoreApplication::applicationDirPath: Please instantiate the QApplication object first
ITSMService.exe
Try to find oem.strings in "C:/Program Files (x86)/ITarian/Endpoint Manager/oem.strings"
ITSMService.exe
Log dir is 'C:/ProgramData/ITarian/Endpoint Manager'
ITSMService.exe
OEM strings file does not exists! "C:/Program Files (x86)/ITarian/Endpoint Manager/oem.strings"
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
em_XsVM4WZh_installer_Win7-Win11_x86_x64.msi