File name:

Tester.msi

Full analysis: https://app.any.run/tasks/cba7dfbd-2d80-469b-a88c-2d7c538ba9b9
Verdict: Malicious activity
Analysis date: May 16, 2025, 17:34:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
pdqconnect
rmm-tool
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: PDQConnectAgent, Author: PDQ.com, Keywords: Installer, Comments: This installer database contains the logic and data required to install PDQConnectAgent., Template: x64;1033, Revision Number: {9467128F-9A42-4772-A694-2E935CC19876}, Create Time/Date: Mon Mar 31 03:03:18 2025, Last Saved Time/Date: Mon Mar 31 03:03:18 2025, Number of Pages: 200, Number of Words: 2, Name of Creating Application: WiX Toolset (5.0.0.0), Security: 2
MD5:

D198D98BF066283D5358FFD358C6C153

SHA1:

8B43DF84DFD91D89D2B7EB745D36289D6D089A85

SHA256:

B323ABBCF85BC5573994AEEAD3EEA6DF4EE7282D2E7C333B574914038730B485

SSDEEP:

98304:PGVlDd10yJLNadu3w9Gl+X8tTAgdZ2gqra/IUwcSX4PXLM41Z3WcxUvhuTtsuLAF:hfFv+m7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • pdq-connect-agent.exe (PID: 8016)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1852)
      • powershell.exe (PID: 8180)
      • powershell.exe (PID: 2800)
      • powershell.exe (PID: 5204)
      • powershell.exe (PID: 7528)
      • powershell.exe (PID: 5116)
      • powershell.exe (PID: 7388)
      • powershell.exe (PID: 2908)
      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 5056)
      • powershell.exe (PID: 6436)
      • powershell.exe (PID: 1240)

  • SUSPICIOUS

    • Starts SC.EXE for service management

      • rundll32.exe (PID: 5360)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7668)
      • pdq-connect-agent.exe (PID: 8016)

    • Application launched itself

      • msiexec.exe (PID: 7564)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 2244)
      • msiexec.exe (PID: 7280)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 4448)
      • rundll32.exe (PID: 6436)
      • rundll32.exe (PID: 664)
      • rundll32.exe (PID: 5360)
      • rundll32.exe (PID: 1388)

    • Windows service management via SC.EXE

      • sc.exe (PID: 856)

    • PDQConnect is probably used for system patching and software deployment

      • sc.exe (PID: 856)

    • The process hides Powershell's copyright startup banner

      • pdq-connect-agent.exe (PID: 8016)

    • The process hide an interactive prompt from the user

      • pdq-connect-agent.exe (PID: 8016)

    • Starts POWERSHELL.EXE for commands execution

      • pdq-connect-agent.exe (PID: 8016)

    • The process bypasses the loading of PowerShell profile settings

      • pdq-connect-agent.exe (PID: 8016)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 7564)

    • An automatically generated document

      • msiexec.exe (PID: 7488)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7488)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7488)

    • Reads the software policy settings

      • msiexec.exe (PID: 7488)

    • Reads the computer name

      • msiexec.exe (PID: 7564)

    • Manages system restore points

      • SrTasks.exe (PID: 5156)

    • The sample compiled with english language support

      • msiexec.exe (PID: 7564)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7564)

    • PDQCONNECT has been detected

      • msiexec.exe (PID: 7280)
      • rundll32.exe (PID: 5360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: PDQConnectAgent
Author: PDQ.com
Keywords: Installer
Comments: This installer database contains the logic and data required to install PDQConnectAgent.
Template: x64;1033
RevisionNumber: {9467128F-9A42-4772-A694-2E935CC19876}
CreateDate: 2025:04:30 03:03:18
ModifyDate: 2025:04:30 03:03:18
Pages: 200
Words: 2
Software: WiX Toolset (5.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
41
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs sppextcomobj.exe no specs slui.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe sc.exe no specs conhost.exe no specs pdq-connect-agent.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664rundll32.exe "C:\WINDOWS\Installer\MSI1FA1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1122296 38 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CreateEventSourceC:\Windows\System32\rundll32.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
672\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856"C:\WINDOWS\system32\sc.exe" start "PDQConnectAgent"C:\Windows\System32\sc.exe—rundll32.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1240"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1348\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388rundll32.exe "C:\WINDOWS\Installer\MSI235B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1123187 44 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.WriteTokenC:\Windows\System32\rundll32.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1852"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2244C:\Windows\System32\MsiExec.exe -Embedding 8415FE3D6C419AAD043110D8236A0756C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2800"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
63 600
Read events
63 320
Write events
263
Delete events
17

Modification events

(PID) Process:(7564) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000087F231C088C6DB018C1D0000E41D0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7564) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000087F231C088C6DB018C1D0000E41D0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7564) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000006B6485C088C6DB018C1D0000E41D0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7564) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000006B6485C088C6DB018C1D0000E41D0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7564) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000C0198AC088C6DB018C1D0000E41D0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7564) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000287D8CC088C6DB018C1D0000E41D0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7564) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(7564) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000248E1BC188C6DB018C1D0000E41D0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7564) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000007FF21DC188C6DB018C1D0000641E0000E8030000010000000000000000000000E94CBEAEFD01E94CACA43E6773FFDCA200000000000000000000000000000000
(PID) Process:(7668) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000DD1C25C188C6DB01F41D0000A41E0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
26
Suspicious files
31
Text files
56
Unknown types
0

Dropped files

PID
Process
Filename
Type
7564msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
7564msiexec.exeC:\Windows\Installer\1117fa.msi —
MD5:—
SHA256:—
7488msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:3B9EF015759E604E2BCD33F3B05153B2
SHA256:9F9429CEC12D8337B3717B0286D3F107D211CCFE20AF1880DF356B76F530FC8E
7488msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4binary
MD5:B05604061E3EC3AABDA184504B54FD61
SHA256:39C721D8D85211FAD5BAED20BDD88FC53F76BD1E4BC41611961DDE0812D396AE
7564msiexec.exeC:\Windows\Installer\MSI1DD8.tmpexecutable
MD5:44E75952B658FFE4869CD40DB1299C8F
SHA256:50BBF22DB97433456A4307211B99641740F20A6421BCEE32216FA888FEAA7B2C
6436rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA96A5A3069F4EC27BF8F2E96B8ACA2175\WixToolset.Dtf.WindowsInstaller.dllexecutable
MD5:7A9F5179EC8E7CC6AB0549CA2F840B93
SHA256:BED211704812A2A713992C8A1AECBF2DE355E1EACA8C90D11C468D6F26EBDD14
7488msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:9B779DDFD8F995CF996F5CB84D845ABE
SHA256:801E55B8E49D8DA4FE5E50F253B3BE63AB3B14E9617D21B4EF857AC1C2B449D9
4448rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA312912B2A74A426910389448D7E05CC3\pdqconnectagent-setup.exeexecutable
MD5:C863992E0C33657752864892225C8BE4
SHA256:80DC228BE0FFA323EE9303AEF53DC5164D2817577210462AAA377BA86D90FA33
4448rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA312912B2A74A426910389448D7E05CC3\CustomAction.configxml
MD5:C9C40AF1656F8531EAA647CACEB1E436
SHA256:1A67F60962CA1CBF19873B62A8518EFE8C701A09CD609AF4C50ECC7F0B468BB8
4448rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA312912B2A74A426910389448D7E05CC3\WixSharp.dllexecutable
MD5:86E26888F15860835A2FF1423F25A513
SHA256:4A05C81E1116C4CAC7269113FE50F3E20F9D247F20D6324F62B5C62A5D7B92A6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
29
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7488
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
7488
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhtVltVOu8OqBzmsd%2B%2FeFfks3xTQQUvGsiZZ2MaObmHgXx2HIl1LjgSMACEAvcoEuhCK%2FAlHGPdKmo6gs%3D
unknown
—
—
whitelisted
7488
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEA5NZ%2FZDFskqO3oXzEaXao8%3D
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2148
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2148
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.168:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7488
msiexec.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.168
  • 23.48.23.166
  • 23.48.23.162
  • 23.48.23.188
  • 23.48.23.176
  • 23.48.23.173
  • 23.48.23.185
  • 23.48.23.177
  • 23.48.23.174
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.110
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.129
  • 40.126.31.69
  • 20.190.159.128
  • 20.190.159.23
  • 40.126.31.130
  • 40.126.31.1
  • 40.126.31.73
  • 40.126.31.3
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Tester.msi