download:

/wdapp/WDDriveUtilities_WIN.zip

Full analysis: https://app.any.run/tasks/6b6175e1-fa99-448f-88e6-a6b1838d947e
Verdict: Malicious activity
Analysis date: January 22, 2025, 11:13:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

6065A8CBA1F6B928355A7114DDA02A2A

SHA1:

9AC156D6E86E762C62FA67A5B56BB1C0046CBC89

SHA256:

C3BB08F6D3602336F89913B84943815A0581A2D6DB0A19367A4EA2C80E6440F3

SSDEEP:

98304:Y/ubrfj5VttZn2kObZDdrzb5GtJH02vw6FrEuSTlQo2mYn3WId7l5972hizvOJQZ:BdZ3zYxzXrmVif16uFfLOJeT8M2r1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • WDDriveUtilitiesSetup.exe (PID: 6880)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WDDriveUtilitiesSetup.exe (PID: 6692)
      • WDDriveUtilitiesSetup.exe (PID: 6720)
      • WDDriveUtilitiesSetup.exe (PID: 6880)

    • The process creates files with name similar to system file names

      • WDDriveUtilitiesSetup.exe (PID: 6720)

    • Searches for installed software

      • WDDriveUtilitiesSetup.exe (PID: 6720)

    • Reads security settings of Internet Explorer

      • WDDriveUtilitiesSetup.exe (PID: 6720)

    • Creates a software uninstall entry

      • WDDriveUtilitiesSetup.exe (PID: 6880)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6948)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 6948)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6948)

    • There is functionality for taking screenshot (YARA)

      • WDDriveUtilitiesSetup.exe (PID: 6720)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 6948)

    • Starts itself from another location

      • WDDriveUtilitiesSetup.exe (PID: 6720)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4548)
      • msiexec.exe (PID: 6948)

    • Checks supported languages

      • WDDriveUtilitiesSetup.exe (PID: 6692)
      • WDDriveUtilitiesSetup.exe (PID: 6720)
      • msiexec.exe (PID: 7008)
      • msiexec.exe (PID: 6948)
      • WDDriveUtilitiesSetup.exe (PID: 6880)
      • MSIC633.tmp (PID: 5872)
      • MSIC6F0.tmp (PID: 4132)
      • MSIC7AC.tmp (PID: 4944)
      • MSIC9D2.tmp (PID: 6248)
      • MSIC925.tmp (PID: 4444)
      • MSICC56.tmp (PID: 6240)
      • MSICBB9.tmp (PID: 6268)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 4548)
      • WDDriveUtilitiesSetup.exe (PID: 6692)
      • WDDriveUtilitiesSetup.exe (PID: 6720)
      • WDDriveUtilitiesSetup.exe (PID: 6880)
      • msiexec.exe (PID: 6948)

    • Create files in a temporary directory

      • WDDriveUtilitiesSetup.exe (PID: 6692)
      • WDDriveUtilitiesSetup.exe (PID: 6720)
      • WDDriveUtilitiesSetup.exe (PID: 6880)

    • Manual execution by a user

      • WDDriveUtilitiesSetup.exe (PID: 6692)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 4548)
      • WDDriveUtilitiesSetup.exe (PID: 6720)

    • Reads the machine GUID from the registry

      • WDDriveUtilitiesSetup.exe (PID: 6720)
      • WDDriveUtilitiesSetup.exe (PID: 6880)
      • MSIC7AC.tmp (PID: 4944)
      • MSIC6F0.tmp (PID: 4132)
      • MSIC869.tmp (PID: 836)
      • MSIC925.tmp (PID: 4444)
      • MSIC9D2.tmp (PID: 6248)
      • MSIC633.tmp (PID: 5872)

    • Reads the computer name

      • WDDriveUtilitiesSetup.exe (PID: 6720)
      • WDDriveUtilitiesSetup.exe (PID: 6880)
      • msiexec.exe (PID: 6948)
      • msiexec.exe (PID: 7008)

    • Process checks computer location settings

      • WDDriveUtilitiesSetup.exe (PID: 6720)

    • Creates files in the program directory

      • WDDriveUtilitiesSetup.exe (PID: 6880)

    • Reads the software policy settings

      • MSIC6F0.tmp (PID: 4132)
      • MSIC7AC.tmp (PID: 4944)
      • MSIC925.tmp (PID: 4444)
      • MSIC633.tmp (PID: 5872)
      • MSIC9D2.tmp (PID: 6248)

    • The sample compiled with arabic language support

      • msiexec.exe (PID: 6948)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 6948)

    • Displays MAC addresses of computer network adapters

      • getmac.exe (PID: 3988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:01:03 09:40:18
ZipCRC: 0x9cce45ac
ZipCompressedSize: 131
ZipUncompressedSize: 200
ZipFileName: manifest.json
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
24
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe wddriveutilitiessetup.exe wddriveutilitiessetup.exe wddriveutilitiessetup.exe msiexec.exe msiexec.exe no specs msic633.tmp no specs msic6f0.tmp no specs msic7ac.tmp no specs msic869.tmp no specs msic925.tmp no specs msic9d2.tmp no specs msica9e.tmp no specs cmd.exe no specs conhost.exe msicbb9.tmp no specs msicc56.tmp no specs drvinst.exe no specs msid187.tmp no specs wddriveservice.exe no specs wddriveutilitieshelper.exe no specs wddriveutilities.exe no specs getmac.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
836"C:\WINDOWS\Installer\MSIC869.tmp" /U "C:\Program Files (x86)\Western Digital\WDCSAM_1.0.9.0\wdcsam.inf" /SW /DC:\Windows\Installer\MSIC869.tmp—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
2147483648
Version:
2.1
Modules
Images
c:\windows\installer\msic869.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3808\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—getmac.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
3988"getmac"C:\Windows\SysWOW64\getmac.exe—WDDriveUtilities.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Displays NIC MAC information
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
4132"C:\WINDOWS\Installer\MSIC6F0.tmp" /U "C:\Program Files (x86)\Western Digital\WDCSAM_prev\wdcsam.inf" /SW /DC:\Windows\Installer\MSIC6F0.tmp—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
2147483648
Version:
2.1
Modules
Images
c:\windows\installer\msic6f0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4136"C:\WINDOWS\Installer\MSICA9E.tmp" /U "C:\Program Files (x86)\Western Digital\WDCSAM_1.0.7.1\wdcsam.inf" /SW /DC:\Windows\Installer\MSICA9E.tmp—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
2147483648
Version:
2.1
Modules
Images
c:\windows\installer\msica9e.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4444"C:\WINDOWS\Installer\MSIC925.tmp" /U "C:\Program Files (x86)\Western Digital\WDCSAM_1.0.8.0\wdcsam.inf" /SW /DC:\Windows\Installer\MSIC925.tmp—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
2147483648
Version:
2.1
Modules
Images
c:\windows\installer\msic925.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4548"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\WDDriveUtilities_WIN.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4944"C:\WINDOWS\Installer\MSIC7AC.tmp" /U "C:\Program Files (x86)\Western Digital\WDCSAM_1.1.0.0\wdcsam.inf" /SW /DC:\Windows\Installer\MSIC7AC.tmp—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
2147483648
Version:
2.1
Modules
Images
c:\windows\installer\msic7ac.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5872"C:\WINDOWS\Installer\MSIC633.tmp" /U "C:\Program Files (x86)\Western Digital\WDCSAM\wdcsam.inf" /SW /DC:\Windows\Installer\MSIC633.tmp—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
2147483648
Version:
2.1
Modules
Images
c:\windows\installer\msic633.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6220cmd.exe /c "del drivers\wdcsam64.sys"C:\Windows\System32\cmd.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
25 747
Read events
25 019
Write events
726
Delete events
2

Modification events

(PID) Process:(4548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\WDDriveUtilities_WIN.zip
(PID) Process:(4548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(4548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
219
Suspicious files
28
Text files
291
Unknown types
0

Dropped files

PID
Process
Filename
Type
4548WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4548.24515\WDDriveUtilitiesSetup.exeexecutable
MD5:50BD1511D22BAB0165908E61C747B6D5
SHA256:9BCDF9D04632A71F264294760D0B4269CF70E91A78C9E9F56BBB8B72098F86D5
6692WDDriveUtilitiesSetup.exeC:\Users\admin\AppData\Local\Temp\{CE66B742-1D7E-4DF4-8F27-6D92FB1B9AC6}\.cr\WDDriveUtilitiesSetup.exeexecutable
MD5:573901EC7A0DAEC97A1F26EAE15AA515
SHA256:B85B7516B8A6B80CB7E1EE90D60E05839F9D792100B8E958F7DE6788CCDDFEEA
6720WDDriveUtilitiesSetup.exeC:\Users\admin\AppData\Local\Temp\{E652D2F1-8DA7-40E9-8878-F36CDEDAB133}\.ba\mbapreq.wxlxml
MD5:4D2C8D10C5DCCA6B938B71C8F02CA8A8
SHA256:C63DE5F309502F9272402587A6BE22624D1BC2FEACD1BD33FB11E44CD6614B96
6720WDDriveUtilitiesSetup.exeC:\Users\admin\AppData\Local\Temp\{E652D2F1-8DA7-40E9-8878-F36CDEDAB133}\.ba\BootstrapperCore.dllexecutable
MD5:B0D10A2A622A322788780E7A3CBB85F3
SHA256:F2C2B3CE2DF70A3206F3111391FFC7B791B32505FA97AEF22C0C2DBF6F3B0426
4548WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4548.24515\manifest.jsontext
MD5:C44D4E1D87CB60DDB585D73E2995906C
SHA256:52D1421CCF2CE708B3A734C79020B9C2B79D5779510B28731876ED9D02B4D4BC
6720WDDriveUtilitiesSetup.exeC:\Users\admin\AppData\Local\Temp\{E652D2F1-8DA7-40E9-8878-F36CDEDAB133}\.ba\1032\mbapreq.wxlxml
MD5:074D5921AF07E6126049CB45814246ED
SHA256:B8E90E20EDF110AAAAEA54FBC8533872831777BE5589E380CFDD17E1F93147B5
6720WDDriveUtilitiesSetup.exeC:\Users\admin\AppData\Local\Temp\{E652D2F1-8DA7-40E9-8878-F36CDEDAB133}\.ba\1043\mbapreq.wxlxml
MD5:67F28BCDB3BA6774CD66AA198B06FF38
SHA256:226B778604236931B4AE45F6F272586C884A11517444A34BF45CD5CAE49BE62E
6720WDDriveUtilitiesSetup.exeC:\Users\admin\AppData\Local\Temp\{E652D2F1-8DA7-40E9-8878-F36CDEDAB133}\.ba\1060\mbapreq.wxlxml
MD5:5836F0C655BDD97093F68AAF69AB2BAB
SHA256:C015247D022BDC108B4FFCAE89CB55D1E313034D7E6EED18744C1BB55F108F8C
6720WDDriveUtilitiesSetup.exeC:\Users\admin\AppData\Local\Temp\{E652D2F1-8DA7-40E9-8878-F36CDEDAB133}\.ba\1038\mbapreq.wxlxml
MD5:17FB605A2F02DA203DF06F714D1CC6DE
SHA256:55CF62D54EFB79801A9D94B24B3C9BA221C2465417A068950D40A67C52BA66EF
6720WDDriveUtilitiesSetup.exeC:\Users\admin\AppData\Local\Temp\{E652D2F1-8DA7-40E9-8878-F36CDEDAB133}\.ba\1051\mbapreq.wxlxml
MD5:016C278E515F87F589AD22C856B201F7
SHA256:4A7FDF4A9033FE05C31F565ED3AE5B8C67D324B7AEADB737CE95DBB416D46868
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
42
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1200
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
23.218.210.69:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
6068
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7064
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7064
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7064
SIHClient.exe
40.69.42.241:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.14
  • 40.126.32.136
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.68
  • 40.126.32.133
  • 20.190.160.17
  • 40.126.32.138
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
downloads.mycloud.com
  • 108.138.26.23
  • 108.138.26.106
  • 108.138.26.114
  • 108.138.26.43
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/wdapp/WDDriveUtilities_WIN.zip