URL:

https://vogtsconstructlon.com/shared/_SWIFT_FIN103_202_GPI_07_31_2025_RAVENFINANCE_GMBH_SINGMECH_ENGINEERING_pdf.msi

Full analysis: https://app.any.run/tasks/654f0f63-b4f0-47b6-8d4d-e01b88c49853
Verdict: Malicious activity
Analysis date: September 03, 2025, 16:21:11
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
pdqconnect
rmm-tool
anti-evasion
rust
Indicators:
MD5:

B2111C25E77CCAC4DCA55683E9FEC868

SHA1:

D8890A685A8D93C877CC4743AE02DA1DC2B09030

SHA256:

AA673F2753167C23A1722C03D7AAE23392BDC4CAB23D12D7D5B1786E837428D9

SSDEEP:

3:N8IdnLkNJ3y6X1j2JkzujKk0Ls4kc2++Ln:2IdINJ5X1j2Jf+xLs4kcXi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5712)
      • powershell.exe (PID: 2612)
      • powershell.exe (PID: 4460)
      • powershell.exe (PID: 7772)
      • powershell.exe (PID: 7924)
      • powershell.exe (PID: 6392)
      • powershell.exe (PID: 7924)
      • powershell.exe (PID: 984)
      • powershell.exe (PID: 6912)
      • powershell.exe (PID: 7948)
      • powershell.exe (PID: 8060)
      • powershell.exe (PID: 2708)
      • powershell.exe (PID: 6148)
      • powershell.exe (PID: 6892)
      • powershell.exe (PID: 4664)
      • powershell.exe (PID: 8996)
      • powershell.exe (PID: 9392)
      • powershell.exe (PID: 10048)
      • powershell.exe (PID: 10236)
      • powershell.exe (PID: 8204)

    • Collects BIOS Properties (Win32_BIOS) (SCRIPT)

      • powershell.exe (PID: 4460)

    • Changes powershell execution policy (Bypass)

      • pdq-connect-agent.exe (PID: 4984)

    • Accesses installed system drivers(Win32_SystemDriver) (SCRIPT)

      • powershell.exe (PID: 8696)

    • Accesses system services(Win32_Service) (SCRIPT)

      • powershell.exe (PID: 8836)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • explorer.exe (PID: 4772)

    • Executes as Windows Service

      • VSSVC.exe (PID: 320)
      • pdq-connect-agent.exe (PID: 1204)
      • pdq-connect-updater.exe (PID: 4708)
      • pdq-connect-agent.exe (PID: 4984)
      • WmiApSrv.exe (PID: 8268)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 8116)

    • Application launched itself

      • msiexec.exe (PID: 8116)
      • powershell.exe (PID: 7948)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 3396)
      • rundll32.exe (PID: 2588)
      • rundll32.exe (PID: 6688)
      • rundll32.exe (PID: 7004)
      • rundll32.exe (PID: 1636)
      • pdq-connect-agent.exe (PID: 1204)
      • rundll32.exe (PID: 4088)
      • rundll32.exe (PID: 4308)
      • rundll32.exe (PID: 5968)
      • rundll32.exe (PID: 7528)
      • rundll32.exe (PID: 7140)
      • rundll32.exe (PID: 592)
      • rundll32.exe (PID: 6856)
      • rundll32.exe (PID: 3620)
      • rundll32.exe (PID: 7224)
      • csc.exe (PID: 8284)
      • powershell.exe (PID: 6148)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 7780)
      • msiexec.exe (PID: 1568)
      • msiexec.exe (PID: 7156)
      • msiexec.exe (PID: 424)

    • Starts SC.EXE for service management

      • rundll32.exe (PID: 1636)
      • rundll32.exe (PID: 7224)

    • Windows service management via SC.EXE

      • sc.exe (PID: 3540)
      • sc.exe (PID: 700)

    • PDQConnect is probably used for system patching and software deployment

      • sc.exe (PID: 3540)
      • sc.exe (PID: 700)

    • The process bypasses the loading of PowerShell profile settings

      • pdq-connect-agent.exe (PID: 4984)
      • powershell.exe (PID: 7948)

    • The process hides Powershell's copyright startup banner

      • pdq-connect-agent.exe (PID: 4984)
      • powershell.exe (PID: 7948)

    • The process hide an interactive prompt from the user

      • pdq-connect-agent.exe (PID: 4984)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 7772)
      • powershell.exe (PID: 6148)

    • Enumerates operating system information (Win32_OperatingSystem) (SCRIPT)

      • powershell.exe (PID: 2612)
      • powershell.exe (PID: 7924)
      • powershell.exe (PID: 6148)
      • powershell.exe (PID: 8384)

    • Reads Microsoft Outlook installation path

      • mmc.exe (PID: 3636)

    • Reads Internet Explorer settings

      • mmc.exe (PID: 3636)

    • Starts POWERSHELL.EXE for commands execution

      • pdq-connect-agent.exe (PID: 4984)
      • powershell.exe (PID: 7948)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 8284)

    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 6148)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 6148)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 6148)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 9276)

    • Receives information about network interfaces and IP addresses (POWERSHELL)

      • powershell.exe (PID: 8996)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 6376)
      • firefox.exe (PID: 2976)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 2976)
      • explorer.exe (PID: 4772)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4772)
      • msiexec.exe (PID: 3288)
      • mmc.exe (PID: 3636)

    • Checks proxy server information

      • explorer.exe (PID: 4772)
      • mmc.exe (PID: 3636)
      • slui.exe (PID: 4232)

    • Checks supported languages

      • msiexec.exe (PID: 8116)
      • msiexec.exe (PID: 7780)
      • msiexec.exe (PID: 1568)
      • msiexec.exe (PID: 7156)
      • pdq-connect-agent.exe (PID: 1204)
      • pdq-connect-updater.exe (PID: 4708)
      • msiexec.exe (PID: 424)
      • pdq-connect-agent.exe (PID: 4984)
      • csc.exe (PID: 8284)
      • cvtres.exe (PID: 8376)
      • DismHost.exe (PID: 9276)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 4772)
      • mmc.exe (PID: 3636)

    • Reads the software policy settings

      • explorer.exe (PID: 4772)
      • msiexec.exe (PID: 3288)
      • msiexec.exe (PID: 8116)
      • pdq-connect-agent.exe (PID: 1204)
      • pdq-connect-updater.exe (PID: 4708)
      • pdq-connect-agent.exe (PID: 4984)
      • slui.exe (PID: 4232)

    • Reads the computer name

      • msiexec.exe (PID: 8116)
      • msiexec.exe (PID: 1568)
      • msiexec.exe (PID: 7780)
      • pdq-connect-agent.exe (PID: 1204)
      • msiexec.exe (PID: 7156)
      • pdq-connect-updater.exe (PID: 4708)
      • msiexec.exe (PID: 424)
      • pdq-connect-agent.exe (PID: 4984)
      • DismHost.exe (PID: 9276)

    • Manages system restore points

      • SrTasks.exe (PID: 2140)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 8116)
      • csc.exe (PID: 8284)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 8116)
      • firefox.exe (PID: 2976)

    • Create files in a temporary directory

      • rundll32.exe (PID: 3396)
      • rundll32.exe (PID: 2588)

    • PDQCONNECT has been detected

      • msiexec.exe (PID: 1568)
      • rundll32.exe (PID: 1636)
      • pdq-connect-agent.exe (PID: 1204)
      • msiexec.exe (PID: 424)
      • rundll32.exe (PID: 7224)

    • Creates files in the program directory

      • rundll32.exe (PID: 7004)
      • pdq-connect-agent.exe (PID: 1204)
      • msiexec.exe (PID: 7084)
      • msiexec.exe (PID: 6764)
      • pdq-connect-agent.exe (PID: 4984)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 8116)

    • The sample compiled with english language support

      • msiexec.exe (PID: 8116)
      • powershell.exe (PID: 6148)
      • firefox.exe (PID: 2976)

    • Application based on Rust

      • pdq-connect-updater.exe (PID: 4708)
      • pdq-connect-agent.exe (PID: 4984)

    • Reads Environment values

      • pdq-connect-agent.exe (PID: 4984)
      • DismHost.exe (PID: 9276)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7772)
      • powershell.exe (PID: 984)
      • powershell.exe (PID: 6148)
      • powershell.exe (PID: 8020)

    • Process checks computer location settings

      • pdq-connect-agent.exe (PID: 4984)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 984)

    • Reads Windows Product ID

      • powershell.exe (PID: 6148)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 8996)
      • powershell.exe (PID: 6148)
      • powershell.exe (PID: 5716)
      • powershell.exe (PID: 8200)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8996)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6148)
      • powershell.exe (PID: 8996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
279
Monitored processes
120
Malicious processes
5
Suspicious processes
13

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs rundll32.exe no specs explorer.exe msiexec.exe no specs msiexec.exe vssvc.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe sc.exe no specs conhost.exe no specs pdq-connect-agent.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe pdq-connect-updater.exe slui.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe sc.exe no specs conhost.exe no specs pdq-connect-agent.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs mmc.exe no specs mmc.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs powershell.exe no specs conhost.exe no specs tiworker.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmiapsrv.exe no specs dismhost.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs dsregcmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
320C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
424C:\Windows\System32\MsiExec.exe -Embedding BEEA53B73255875E18A0375763E5209E E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
512\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
592rundll32.exe "C:\WINDOWS\Installer\MSIB50F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1684750 96 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_ActionC:\Windows\System32\rundll32.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
700"C:\WINDOWS\system32\sc.exe" start "PDQConnectAgent"C:\Windows\System32\sc.exe—rundll32.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
984"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1204"C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe" --serviceC:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
PDQ Connect Agent
Exit code:
0
Version:
5.8.18
Modules
Images
c:\program files\pdq\pdqconnectagent\pdq-connect-agent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1568C:\Windows\System32\MsiExec.exe -Embedding F6771B0D9EE502383EEF87BC6204D032 E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1636rundll32.exe "C:\WINDOWS\Installer\MSI7926.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1669437 50 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.StartServiceC:\Windows\System32\rundll32.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1816\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
234 962
Read events
234 230
Write events
556
Delete events
176

Modification events

(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A02D4
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(2976) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated
Operation:writeName:308046B0AF4A39CB
Value:
29
(PID) Process:(4772) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(4772) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
040000000000000003000000110000000E000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(4772) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0
Operation:writeName:MRUListEx
Value:
0400000006000000050000000100000008000000020000000C0000000B0000000A00000009000000070000000000000003000000FFFFFFFF
(PID) Process:(4772) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\4\0
Operation:writeName:MRUListEx
Value:
0100000000000000FFFFFFFF
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon
Operation:writeName:MinimizedStateTabletModeOff
Value:
0
(PID) Process:(4772) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\208\Shell
Operation:writeName:SniffedFolderType
Value:
Pictures
(PID) Process:(4772) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\208\Shell
Operation:writeName:SniffedFolderType
Value:
Downloads
Executable files
129
Suspicious files
406
Text files
181
Unknown types
0

Dropped files

PID
Process
Filename
Type
2976firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
4772explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
2976firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:3134ED3F12E4F4F8643DB90043B0FD7B
SHA256:26E4F122034D7A03F6DA0E707799B09CBEEBDAF8D7A3133A1F7BD894AC72EEA1
2976firefox.exeC:\Users\admin\Downloads\_SWIFT_FIN103_202_GPI_07_31_2025_RAVENFINANCE_GMBH_SINGMECH_ENGINEERING_pdf.kTkShrno.msi.part —
MD5:—
SHA256:—
2976firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
2976firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
2976firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\safebrowsing-updating\ads-track-digest256.sbstore —
MD5:—
SHA256:—
2976firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.jstext
MD5:2FD670934FEF0C60E2119BD874AAF470
SHA256:771A7C83CA015BDBC6AB86A7BD9B1D54E40062E28942D311A9178A0FE6433CF2
2976firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2976firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
116
DNS requests
137
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2976
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
US
text
90 b
whitelisted
2976
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
US
text
8 b
whitelisted
2976
firefox.exe
POST
200
142.250.185.99:80
http://o.pki.goog/we2
US
binary
278 b
whitelisted
2976
firefox.exe
POST
200
142.250.185.99:80
http://o.pki.goog/we2
US
binary
281 b
whitelisted
2976
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
US
text
8 b
whitelisted
7104
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
2976
firefox.exe
POST
200
142.250.185.99:80
http://o.pki.goog/s/wr3/vbw
US
binary
472 b
whitelisted
2112
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
NL
binary
419 b
whitelisted
2112
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
NL
binary
407 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5876
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2976
firefox.exe
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
whitelisted
2976
firefox.exe
143.198.228.225:443
vogtsconstructlon.com
DIGITALOCEAN-ASN
US
unknown
2976
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
2976
firefox.exe
34.36.137.203:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
unknown
2976
firefox.exe
151.101.1.91:443
firefox.settings.services.mozilla.com
FASTLY
US
whitelisted
2976
firefox.exe
142.250.185.99:80
o.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
content-signature-2.cdn.mozilla.net
  • 34.160.144.191
whitelisted
content-signature-chains.prod.autograph.services.mozaws.net
  • 34.160.144.191
  • 2600:1901:0:92a9::
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
vogtsconstructlon.com
  • 143.198.228.225
unknown
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted
spocs.getpocket.com
  • 34.36.137.203
whitelisted
mc.prod.ads.prod.webservices.mozgcp.net
  • 34.36.137.203
unknown
firefox.settings.services.mozilla.com
  • 151.101.1.91
  • 151.101.65.91
  • 151.101.193.91
  • 151.101.129.91
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
Process
Message
powershell.exe
PID=6148 TID=8332 DismApi.dll: - DismInitializeInternal
powershell.exe
PID=6148 TID=8332 DismApi.dll: <----- Starting DismApi.dll session -----> - DismInitializeInternal
powershell.exe
PID=6148 TID=8332 DismApi.dll: - DismInitializeInternal
powershell.exe
PID=6148 TID=8332 DismApi.dll: Host machine information: OS Version=10.0.19045, Running architecture=amd64, Number of processors=4 - DismInitializeInternal
powershell.exe
PID=6148 TID=8332 DismApi.dll: API Version 10.0.19041.3758 - DismInitializeInternal
powershell.exe
PID=6148 TID=8332 DismApi.dll: Parent process command line: "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command - - DismInitializeInternal
powershell.exe
PID=6148 TID=8332 Enter DismInitializeInternal - DismInitializeInternal
powershell.exe
PID=6148 TID=8332 Input parameters: LogLevel: 2, LogFilePath: C:\WINDOWS\Logs\DISM\dism.log, ScratchDirectory: (null) - DismInitializeInternal
powershell.exe
PID=6148 TID=8332 Initialized GlobalConfig - DismInitializeInternal
powershell.exe
PID=6148 TID=8332 Initialized SessionTable - DismInitializeInternal
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://vogtsconstructlon.com/shared/_SWIFT_FIN103_202_GPI_07_31_2025_RAVENFINANCE_GMBH_SINGMECH_ENGINEERING_pdf.msi