File name:

EZFN Launcher_1.2.7_x64_en-US.msi

Full analysis: https://app.any.run/tasks/90141d68-50ce-4a2f-b6d1-13537cc7ed7a
Verdict: Malicious activity
Analysis date: December 20, 2024, 17:12:06
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
qrcode
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: EZFN Launcher, Author: ezfn, Keywords: Installer, Comments: This installer database contains the logic and data required to install EZFN Launcher., Template: x64;0, Revision Number: {8E8ADF67-611A-418A-81D9-A15A7CD2D5D7}, Create Time/Date: Wed Nov 13 21:30:16 2024, Last Saved Time/Date: Wed Nov 13 21:30:16 2024, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

1425A73D9D6DB003B57BFC2134EA9D70

SHA1:

D31866A0CCC44F2DB6A17402F1219BF75E03B8E4

SHA256:

B244361E1DAC8D917BE21D8E8453112C461F69FF3EC00E1844F6536379B8CD7F

SSDEEP:

98304:QxIWsnjGEXs509D2E4ZlcXZ4qWav6MTvJs6O49zN0BFzdAFX+5UsgoUveJPg8EI2:+eD2Q3DKq//5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4500)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 5728)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 7092)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 6968)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6968)

    • Manipulates environment variables

      • powershell.exe (PID: 4500)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 4500)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 6968)

    • Starts process via Powershell

      • powershell.exe (PID: 4500)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 4500)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 4500)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5720)
      • MicrosoftEdgeUpdate.exe (PID: 5728)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 4500)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5720)
      • MicrosoftEdgeUpdate.exe (PID: 5728)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 5720)
      • MicrosoftEdgeUpdate.exe (PID: 5728)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 5728)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 648)
      • MicrosoftEdgeUpdate.exe (PID: 628)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2408)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2612)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 5728)

  • INFO

    • An automatically generated document

      • msiexec.exe (PID: 6832)

    • Reads the computer name

      • msiexec.exe (PID: 6968)
      • msiexec.exe (PID: 7036)
      • MicrosoftEdgeUpdate.exe (PID: 5728)
      • MicrosoftEdgeUpdate.exe (PID: 628)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1412)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6832)
      • msiexec.exe (PID: 6968)

    • Checks supported languages

      • msiexec.exe (PID: 7036)
      • msiexec.exe (PID: 6968)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5720)
      • MicrosoftEdgeUpdate.exe (PID: 5728)
      • MicrosoftEdgeUpdate.exe (PID: 628)

    • Manages system restore points

      • SrTasks.exe (PID: 5448)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6968)

    • The sample compiled with english language support

      • powershell.exe (PID: 4500)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5720)
      • MicrosoftEdgeUpdate.exe (PID: 5728)

    • The process uses the downloaded file

      • powershell.exe (PID: 4500)

    • The executable file from the user directory is run by the Powershell process

      • MicrosoftEdgeWebview2Setup.exe (PID: 5720)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 5720)
      • svchost.exe (PID: 2612)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 5728)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 7156)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 4052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: EZFN Launcher
Author: ezfn
Keywords: Installer
Comments: This installer database contains the logic and data required to install EZFN Launcher.
Template: x64;0
RevisionNumber: {8E8ADF67-611A-418A-81D9-A15A7CD2D5D7}
CreateDate: 2024:11:13 21:30:16
ModifyDate: 2024:11:13 21:30:16
Pages: 450
Words: 2
Software: Windows Installer XML Toolset (3.11.2.4516)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
18
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
628"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
648"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.39\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1412"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.39\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2408"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.39\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2612C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITSC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4024"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource otherinstallcmd /sessionid "{0F15A03F-ECBA-4079-9418-BDDC1632B480}"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.195.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
4052"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.195.39
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
4500powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ( '/install') -WaitC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5448C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5720"C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /install C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.195.39
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
12 671
Read events
11 462
Write events
1 166
Delete events
43

Modification events

(PID) Process:(6968) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000B03082540253DB01381B0000A41B0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6968) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000BBCE85540253DB01381B0000A41B0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6968) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000FBE2EF540253DB01381B0000A41B0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6968) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000FBE2EF540253DB01381B0000A41B0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6968) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000C797F4540253DB01381B0000A41B0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6968) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000D4FBF6540253DB01381B0000A41B0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6968) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6968) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000E07969550253DB01381B0000A41B0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6968) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000232E6E550253DB01381B000018180000E80300000100000000000000000000006331ECA963F8A54CB45807CBF0514BB000000000000000000000000000000000
(PID) Process:(7092) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
Executable files
204
Suspicious files
13
Text files
20
Unknown types
2

Dropped files

PID
Process
Filename
Type
6968msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6968msiexec.exeC:\Windows\Installer\13ad0c.msi —
MD5:—
SHA256:—
6968msiexec.exeC:\Program Files\EZFN Launcher\_up_\public\season_images\Season11.webpimage
MD5:335FB9C70F5039817BF345F77250FBD0
SHA256:D1ACF91F644BA1877832F3A8315305C6D49A2A140B66CBDED02C5017360786E4
6968msiexec.exeC:\Program Files\EZFN Launcher\_up_\public\season_images\Season2.webpimage
MD5:265393414B5BC850A63E3856D3158FD6
SHA256:CAF02B9121C474E6422A2FA674DF79BA1F35F60BD516A015D689CD01FDD80579
6968msiexec.exeC:\Program Files\EZFN Launcher\_up_\public\default_skin.pngimage
MD5:97EB02C682769364D8D31FF17CE9DCD1
SHA256:6FB348720BFF52358EF5410FDC50F1B05816FDF69EE46A8C90E644DAB7292AE5
6968msiexec.exeC:\Program Files\EZFN Launcher\EZFN Launcher.exeexecutable
MD5:31E71C821BD9EE93C135711542481840
SHA256:49BF997C7C1B051828AC8F30467EB0E5E12FEE50CEBE34C9B2F8C938A2A6481D
6968msiexec.exeC:\Program Files\EZFN Launcher\_up_\public\season_images\Season15.webpimage
MD5:B0B772A92DC56ECA1733BCF7CE9F15E9
SHA256:1FD3B2A990717B40657916C5E085D8E2AD81DA4B6813828AE7786307CD192F8F
6968msiexec.exeC:\Windows\Temp\~DF07436769FF7E596C.TMPbinary
MD5:830B186CD0842555B83ECF58C8588960
SHA256:222C86CFE5BF8F93B2B8C701B6515275A683520577202A1403C85986643F7EC6
6968msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:2951A72EFA661052104A9134A85D6606
SHA256:5568DA0BE66C0F7D376D6EB229874A1F8BB5483E2BC1608B92768E32998A6D66
6968msiexec.exeC:\Program Files\EZFN Launcher\_up_\public\season_images\Season9.webpimage
MD5:1FC5AFAD336EBAF0D613D556FD6DE9BC
SHA256:0D216CCC8196B2BDB8C2633257EEF40F80918459190B98BE069A9737C246CC84
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
39
DNS requests
20
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
2160
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
2160
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
314 b
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
6552
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
US
binary
471 b
whitelisted
1804
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
418 b
whitelisted
2612
svchost.exe
HEAD
200
2.22.242.227:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/7d9cd93c-1d5e-449b-9ad7-f1e8d6b90509?P1=1735319570&P2=404&P3=2&P4=PkXW4CzcwePIti5TUBjr8uRTt2JdaIwbWSPcxe5T54sx%2baJ5XWHPrvHr2UMWOdi4IdFV4OE%2f4jA0HdU3vpS94Q%3d%3d
DE
—
—
whitelisted
1804
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5988
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.23.209.150:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2160
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2160
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.23.209.150
  • 2.23.209.158
  • 2.23.209.144
  • 2.23.209.149
  • 2.23.209.177
  • 2.23.209.161
  • 2.23.209.133
  • 2.23.209.176
  • 2.23.209.193
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 172.217.18.14
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.138
  • 40.126.32.76
  • 20.190.160.20
  • 40.126.32.74
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.22
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

PID
Process
Class
Message
2612
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EZFN Launcher_1.2.7_x64_en-US.msi