File name:

PDQConnectAgent-5.8.18.msi

Full analysis: https://app.any.run/tasks/8e4e6ea2-c519-42f9-8ce6-aef505564048
Verdict: Malicious activity
Analysis date: August 01, 2025, 05:39:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
pdqconnect
rmm-tool
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: PDQConnectAgent, Author: PDQ.com, Keywords: Installer, Comments: This installer database contains the logic and data required to install PDQConnectAgent., Template: x64;1033, Revision Number: {D0DE72FA-0CA1-4048-A672-61BD58D7BDD7}, Create Time/Date: Wed Jul 30 22:25:34 2025, Last Saved Time/Date: Wed Jul 30 22:25:34 2025, Number of Pages: 200, Number of Words: 2, Name of Creating Application: WiX Toolset (5.0.0.0), Security: 2
MD5:

B3D264D1395868DB7EF0191A4DFE3948

SHA1:

AC1AD864AE1DF8878116044948F629656D0478F7

SHA256:

CAE370F266517E69AF26AA2F8D1A7C7250071F14AC129AD479C9F83CE6EBF9CA

SSDEEP:

98304:BLb75ziLEYLrv3Y++iJvRwVicWtkQbrg45D2CV7sxO13H5MzlgUYa7yOZfobvLZ/:rAO7tNi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • pdq-connect-agent.exe (PID: 5968)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2612)
      • powershell.exe (PID: 2292)
      • powershell.exe (PID: 6104)
      • powershell.exe (PID: 5744)
      • powershell.exe (PID: 4832)
      • powershell.exe (PID: 3888)
      • powershell.exe (PID: 4676)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 1948)
      • pdq-connect-agent.exe (PID: 5968)
      • pdq-connect-updater.exe (PID: 3540)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 4544)

    • Application launched itself

      • msiexec.exe (PID: 4544)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 6648)
      • msiexec.exe (PID: 5460)
      • msiexec.exe (PID: 5236)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 5012)
      • rundll32.exe (PID: 1300)
      • rundll32.exe (PID: 5236)
      • rundll32.exe (PID: 6344)
      • rundll32.exe (PID: 304)
      • pdq-connect-agent.exe (PID: 5968)
      • rundll32.exe (PID: 3888)
      • rundll32.exe (PID: 5468)

    • Starts SC.EXE for service management

      • rundll32.exe (PID: 6344)

    • PDQConnect is probably used for system patching and software deployment

      • sc.exe (PID: 5032)

    • Windows service management via SC.EXE

      • sc.exe (PID: 5032)

    • The process hides Powershell's copyright startup banner

      • pdq-connect-agent.exe (PID: 5968)

    • Starts POWERSHELL.EXE for commands execution

      • pdq-connect-agent.exe (PID: 5968)

    • The process hide an interactive prompt from the user

      • pdq-connect-agent.exe (PID: 5968)

    • The process bypasses the loading of PowerShell profile settings

      • pdq-connect-agent.exe (PID: 5968)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 2612)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3936)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 3936)

    • Checks supported languages

      • msiexec.exe (PID: 4544)
      • msiexec.exe (PID: 6648)
      • msiexec.exe (PID: 5460)
      • pdq-connect-agent.exe (PID: 5968)
      • msiexec.exe (PID: 5236)
      • pdq-connect-updater.exe (PID: 3540)

    • An automatically generated document

      • msiexec.exe (PID: 3936)

    • Reads the computer name

      • msiexec.exe (PID: 4544)
      • msiexec.exe (PID: 6648)
      • msiexec.exe (PID: 5460)
      • pdq-connect-agent.exe (PID: 5968)
      • msiexec.exe (PID: 5236)
      • pdq-connect-updater.exe (PID: 3540)

    • Reads the software policy settings

      • msiexec.exe (PID: 3936)
      • msiexec.exe (PID: 4544)
      • pdq-connect-agent.exe (PID: 5968)
      • pdq-connect-updater.exe (PID: 3540)

    • Checks proxy server information

      • msiexec.exe (PID: 3936)

    • Manages system restore points

      • SrTasks.exe (PID: 3556)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 4544)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4544)

    • Create files in a temporary directory

      • rundll32.exe (PID: 5012)
      • rundll32.exe (PID: 304)

    • PDQCONNECT has been detected

      • msiexec.exe (PID: 5460)
      • rundll32.exe (PID: 6344)
      • pdq-connect-agent.exe (PID: 5968)

    • The sample compiled with english language support

      • msiexec.exe (PID: 4544)

    • Creates files in the program directory

      • rundll32.exe (PID: 5236)
      • pdq-connect-agent.exe (PID: 5968)
      • msiexec.exe (PID: 1936)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 4544)

    • Reads Environment values

      • pdq-connect-agent.exe (PID: 5968)

    • Process checks computer location settings

      • pdq-connect-agent.exe (PID: 5968)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 2612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: PDQConnectAgent
Author: PDQ.com
Keywords: Installer
Comments: This installer database contains the logic and data required to install PDQConnectAgent.
Template: x64;1033
RevisionNumber: {D0DE72FA-0CA1-4048-A672-61BD58D7BDD7}
CreateDate: 2025:07:30 22:25:34
ModifyDate: 2025:07:30 22:25:34
Pages: 200
Words: 2
Software: WiX Toolset (5.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
36
Malicious processes
3
Suspicious processes
4

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe sc.exe no specs conhost.exe no specs pdq-connect-agent.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe pdq-connect-updater.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs slui.exe no specs powershell.exe no specs conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
304rundll32.exe "C:\WINDOWS\Installer\MSIFE05.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1637921 16 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_ActionC:\Windows\System32\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1068\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1300rundll32.exe "C:\WINDOWS\Installer\MSIFF31.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1638250 38 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CreateEventSourceC:\Windows\System32\rundll32.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1800\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1936"msiexec" /i C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectUpdater-5.6.16.msi /quiet /qn /norestart /L*V C:\ProgramData\PDQ\PDQConnectAgent\Updates\updater_install.logC:\Windows\System32\msiexec.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1948C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2192\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2292"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
43 315
Read events
42 954
Write events
335
Delete events
26

Modification events

(PID) Process:(1948) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(1948) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(1948) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(1948) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
(PID) Process:(1948) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(1948) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(1948) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(1948) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Boot\Loader.efi
(PID) Process:(1948) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Description
Operation:delete keyName:(default)
Value:
(PID) Process:(1948) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\24000001
Operation:delete keyName:(default)
Value:
Executable files
39
Suspicious files
28
Text files
40
Unknown types
22

Dropped files

PID
Process
Filename
Type
4544msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
4544msiexec.exeC:\Windows\Installer\18f9ad.msi —
MD5:—
SHA256:—
3936msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBder
MD5:D87EFFE6C7ECB07A57B8104223379162
SHA256:F947FA5CCEC777A464D31C0073C2816E8124CCB7136BDD233F0FF8EF088B47F0
3936msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D9CB7DFFEEA63BAB482BD2705E7E24AB_D64C5BFAB2C28B4652E4AC7169A0D3DBder
MD5:714DE50643DE3BCA9090792096F1A6B3
SHA256:C6DFD56CF29B18F5C00026F84B502F52DF31CF507DCDC67F71AE774233843FC4
4544msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{49cfa773-3044-4673-b82a-2f5a1e1ef386}_OnDiskSnapshotPropbinary
MD5:F89740AD5365374FEB3F799C99503A7A
SHA256:FF1357036EDD3C44B720E93A9D61B904902023147DDB57445C36CE0C45B466D7
3936msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D9CB7DFFEEA63BAB482BD2705E7E24AB_D64C5BFAB2C28B4652E4AC7169A0D3DBbinary
MD5:483E645D4436A6B299D649D68C121641
SHA256:09D0D7EAE0553EE119DB53B04620DF9C7E394DCE8D8F5950340761EA5423850C
3936msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4binary
MD5:4AD8BB08EABC0E0B7B8F2DAE6B91506D
SHA256:7F2FEBAFE66180C95464C6C39D89198B42D1A5DDDE0079677012726ABA10683B
3936msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4der
MD5:7627C0EF5A8CC8F18723FD3565EC1F2B
SHA256:76F90AAF371E20113B99F3F2EB109074C5B026E824B4D3A463E6B88E917FFD7A
304rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCAFBFBC0030940D8C9ABB4CF4D6F032E7B\WixSharp.dllexecutable
MD5:86E26888F15860835A2FF1423F25A513
SHA256:4A05C81E1116C4CAC7269113FE50F3E20F9D247F20D6324F62B5C62A5D7B92A6
4544msiexec.exeC:\Windows\Installer\MSIFE05.tmpexecutable
MD5:65E86867B503485775864C25B8889A88
SHA256:CA23C29ACB6FA1D793C2E562EE424AD96771873EEFC763AE6D75784C15DDC749
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
37
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3936
msiexec.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
3936
msiexec.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhtVltVOu8OqBzmsd%2B%2FeFfks3xTQQUvGsiZZ2MaObmHgXx2HIl1LjgSMACEAvcoEuhCK%2FAlHGPdKmo6gs%3D
unknown
—
—
whitelisted
3936
msiexec.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEA5NZ%2FZDFskqO3oXzEaXao8%3D
unknown
—
—
whitelisted
6936
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5716
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5716
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6584
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3936
msiexec.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6936
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6936
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1740
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
5968
pdq-connect-agent.exe
34.54.45.198:443
app.pdq.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.174
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.2
  • 40.126.31.128
  • 40.126.31.1
  • 20.190.159.4
  • 40.126.31.129
  • 20.190.159.64
  • 20.190.159.128
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
app.pdq.com
  • 34.54.45.198
whitelisted
pdqinstallers.e9d69694c3d8f7465fd531512c22bd0f.r2.cloudflarestorage.com
  • 172.66.1.46
  • 162.159.141.50
malicious
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PDQConnectAgent-5.8.18.msi