analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Arixcel_Explorer_v8.8.9004.msi

Full analysis: https://app.any.run/tasks/8cdcb7b7-b96c-4e2e-8483-256c514ac34e
Verdict: Malicious activity
Analysis date: September 01, 2024, 13:38:36
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Arixcel Explorer Installer, Author: Arixcel Ltd, Keywords: Arixcel Installer, Comments: Arixcel Explorer is a spreadsheet analysis add-in for Microsoft Excel., Template: x64;1033, Revision Number: {58E50600-62F9-417E-9646-2D1E39DE0C4E}, Create Time/Date: Mon Aug 26 20:44:50 2024, Last Saved Time/Date: Mon Aug 26 20:44:50 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
MD5:

013115D323C7D99EB686A75B46ECC55D

SHA1:

F6544344E1063DD6F50F32BD25A3C47822B42821

SHA256:

D9D36B9AE78DF5EE308594219F87D30F68CFF8841D409C68E87D17B6B48A492C

SSDEEP:

98304:sKLHZssiMr0ypgWqk4g8BdEclY65XewtV7xRFQfGl85xH31rysFK6oLPdpkB0a+v:vk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6296)
      • msiexec.exe (PID: 5000)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2128)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 1224)
      • rundll32.exe (PID: 3812)
      • rundll32.exe (PID: 5544)
      • rundll32.exe (PID: 3812)
      • rundll32.exe (PID: 5544)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 5000)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 5000)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5000)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 5000)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6296)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6296)
      • msiexec.exe (PID: 5000)

    • Checks supported languages

      • msiexec.exe (PID: 5000)
      • msiexec.exe (PID: 4680)
      • msiexec.exe (PID: 1156)

    • Create files in a temporary directory

      • rundll32.exe (PID: 5544)
      • rundll32.exe (PID: 1224)
      • rundll32.exe (PID: 3812)
      • rundll32.exe (PID: 5544)
      • rundll32.exe (PID: 3812)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6296)
      • msiexec.exe (PID: 5000)

    • Checks proxy server information

      • msiexec.exe (PID: 6296)

    • Reads the computer name

      • msiexec.exe (PID: 5000)
      • msiexec.exe (PID: 4680)
      • msiexec.exe (PID: 1156)

    • Reads the software policy settings

      • msiexec.exe (PID: 6296)
      • msiexec.exe (PID: 5000)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 5000)

    • Reads Microsoft Office registry keys

      • msiexec.exe (PID: 5000)
      • rundll32.exe (PID: 3812)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (93)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: Read-only recommended
Software: Windows Installer XML Toolset (3.14.0.5722)
Words: 2
Pages: 200
ModifyDate: 2024:08:26 20:44:50
CreateDate: 2024:08:26 20:44:50
RevisionNumber: {58E50600-62F9-417E-9646-2D1E39DE0C4E}
Template: x64;1033
Comments: Arixcel Explorer is a spreadsheet analysis add-in for Microsoft Excel.
Keywords: Arixcel Installer
Author: Arixcel Ltd
Subject: Arixcel Explorer Installer
Title: Installation Database
CodePage: Windows Latin 1 (Western European)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
15
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe sppextcomobj.exe no specs slui.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6296"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\Arixcel_Explorer_v8.8.9004.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5000C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4680C:\Windows\syswow64\MsiExec.exe -Embedding EC117F56D6F8EF68209AFD29229DE726 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5544rundll32.exe "C:\Users\admin\AppData\Local\Temp\MSIA4D4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1221859 16 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.CheckSystemRequirementsC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3812rundll32.exe "C:\Users\admin\AppData\Local\Temp\MSIA92B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1222953 22 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.ResetAllUsersC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1224rundll32.exe "C:\Users\admin\AppData\Local\Temp\MSIA9D8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1223125 28 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.SetDefaultInstallFoldersC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2128C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1840C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4080\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1156C:\Windows\syswow64\MsiExec.exe -Embedding D0E835D98221D46914587E9BB669B674C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
13 812
Read events
13 504
Write events
289
Delete events
19

Modification events

(PID) Process:(5000) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000DF57464874FCDA0188130000FC130000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5000) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000DF57464874FCDA0188130000FC130000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5000) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000003E868B4874FCDA0188130000FC130000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5000) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000BDE98D4874FCDA0188130000FC130000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5000) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000924E904874FCDA0188130000FC130000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5000) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000C8B1924874FCDA0188130000FC130000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5000) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(5000) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000002C64134974FCDA0188130000FC130000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5000) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B0C7154974FCDA0188130000280C0000E8030000010000000000000000000000BA4D045B304FE24D95D8F38977229BC000000000000000000000000000000000
(PID) Process:(2128) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000DBBA214974FCDA01500800003C0F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
33
Suspicious files
24
Text files
10
Unknown types
1

Dropped files

PID
Process
Filename
Type
6296msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBder
MD5:2CE3D39222D618BF5596652E33E58BAF
SHA256:C5A5D9F55EEE596175BF6BAFF15C9D2D6A45248E18ECB2EF465A44BD7E753289
5544rundll32.exeC:\Users\admin\AppData\Local\Temp\MSIA4D4.tmp-\ArixcelSetup.dllexecutable
MD5:4FF69ED8185F696FDA88354EECD98E05
SHA256:4B51D6C18F637744CAB477FE2C5E2D8BCB0A1D84C948E37121CA15086FB88E87
6296msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA9D8.tmpexecutable
MD5:2ED0557A2E2EB2690FBCCCBD2471D5DF
SHA256:27976425F7A1F98F79D96E7838403E01EFCA8369CEB50FC5B217ED2B78E4F3B5
1224rundll32.exeC:\Users\admin\AppData\Local\Temp\MSIA9D8.tmp-\ArixcelSetup.dllexecutable
MD5:4FF69ED8185F696FDA88354EECD98E05
SHA256:4B51D6C18F637744CAB477FE2C5E2D8BCB0A1D84C948E37121CA15086FB88E87
6296msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA92B.tmpexecutable
MD5:2ED0557A2E2EB2690FBCCCBD2471D5DF
SHA256:27976425F7A1F98F79D96E7838403E01EFCA8369CEB50FC5B217ED2B78E4F3B5
6296msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:2E04D35A6CBDA50CABFE5A1E3EA0B90A
SHA256:9846E84EABAEFC2D1F2FD1783E3D1BDD565ED0917089F44EDDD590A09AFA2722
6296msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141der
MD5:AB63B58AFE69B563E1A24AA4ED2393AA
SHA256:AFE944ED02A43F7DB86DC3DEB3AFD72DDE1F7768D11708AE18E4541A60B98AF7
5000msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6296msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_8B6426B6690101B521CAF68DCFDCB929binary
MD5:DFC4C036BC2A097429491430F8CA84AA
SHA256:4CDCF1AFD4DD9A3F145EF8C00818F1C5340D512B13FCBA7D9193F9E3080CFF41
6296msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:52DEB4388DD1249AD71F417A91E7FF6D
SHA256:A4A5F81743251D1A99CBEF4D9C21FA7D0F465E7294895375FE8A4C6745146B35
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
56
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1752
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
6592
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6296
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
unknown
6592
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6296
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
unknown
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
6296
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAEzhWDJk%2Fozlbna9gYAnv0%3D
unknown
—
—
unknown
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
unknown
—
—
GET
200
163.181.92.233:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA%2FgMquETQMxBsUMjhPIsGg%3D
unknown
—
—
unknown
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4760
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6424
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6296
msiexec.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4760
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1752
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1752
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4820
svchost.exe
23.218.210.69:443
go.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.78
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.133
  • 40.126.32.136
  • 40.126.32.140
  • 40.126.32.74
  • 40.126.32.68
  • 40.126.32.138
  • 40.126.32.134
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.123
  • 104.126.37.144
  • 104.126.37.129
  • 104.126.37.153
  • 104.126.37.137
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.136
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Arixcel_Explorer_v8.8.9004.msi