File name:

parsec-vdd-0.45.0.0.exe

Full analysis: https://app.any.run/tasks/9043de3e-d4b4-4b55-82b0-62a04a1b3f01
Verdict: Malicious activity
Analysis date: June 12, 2025, 17:39:25
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

4B9A3048286692A865187013B70F44E8

SHA1:

EEFE91D9702314341ACCCD828FE4EDB6EE570D7B

SHA256:

E23332448FDAF5AA017CB308DB5EF6855FAC526A7DED05D80C039404126D5362

SSDEEP:

24576:Rq1sg0R377IdjkRBLhBAtQdfiiWd9Ng5LCtuPhPYASZ13:Rq1sg0Rr7IdjkjLhBAtQdfiiWd9Ng5LI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • parsec-vdd-0.45.0.0.exe (PID: 516)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • parsec-vdd-0.45.0.0.exe (PID: 516)

    • The process creates files with name similar to system file names

      • parsec-vdd-0.45.0.0.exe (PID: 516)

    • Executable content was dropped or overwritten

      • parsec-vdd-0.45.0.0.exe (PID: 516)
      • drvinst.exe (PID: 984)
      • nefconw.exe (PID: 6936)

    • Creates a software uninstall entry

      • parsec-vdd-0.45.0.0.exe (PID: 516)

    • Uses WEVTUTIL.EXE to remove publishers and event logs from the manifest

      • parsec-vdd-0.45.0.0.exe (PID: 516)
      • wevtutil.exe (PID: 1520)

    • Starts CMD.EXE for commands execution

      • parsec-vdd-0.45.0.0.exe (PID: 516)

    • Creates files in the driver directory

      • drvinst.exe (PID: 984)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 1336)

    • Executes as Windows Service

      • WUDFHost.exe (PID: 7076)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • wevtutil.exe (PID: 2188)
      • parsec-vdd-0.45.0.0.exe (PID: 516)

  • INFO

    • Reads the computer name

      • nefconw.exe (PID: 2512)
      • parsec-vdd-0.45.0.0.exe (PID: 516)
      • nefconw.exe (PID: 6180)
      • nefconw.exe (PID: 6936)
      • drvinst.exe (PID: 984)
      • drvinst.exe (PID: 1336)

    • Checks supported languages

      • nefconw.exe (PID: 2512)
      • parsec-vdd-0.45.0.0.exe (PID: 516)
      • nefconw.exe (PID: 6180)
      • nefconw.exe (PID: 6936)
      • drvinst.exe (PID: 984)
      • drvinst.exe (PID: 1336)

    • Creates files in the program directory

      • parsec-vdd-0.45.0.0.exe (PID: 516)

    • Create files in a temporary directory

      • parsec-vdd-0.45.0.0.exe (PID: 516)
      • nefconw.exe (PID: 6936)

    • The sample compiled with english language support

      • parsec-vdd-0.45.0.0.exe (PID: 516)
      • nefconw.exe (PID: 6936)
      • drvinst.exe (PID: 984)

    • Reads the software policy settings

      • drvinst.exe (PID: 984)
      • slui.exe (PID: 1524)

    • Reads the machine GUID from the registry

      • drvinst.exe (PID: 984)

    • Checks proxy server information

      • slui.exe (PID: 1524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:57:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 186880
UninitializedDataSize: 2048
EntryPoint: 0x352d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.45.0.0
ProductVersionNumber: 0.45.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: Parsec Virtual Display Driver
CompanyName: Parsec Cloud Inc.
FileDescription: Parsec Virtual Display Driver
FileVersion: 0.45.0.0
LegalCopyright: Parsec Cloud Inc.
ProductName: Parsec Virtual Display Driver
ProductVersion: 0.45.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
17
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start parsec-vdd-0.45.0.0.exe wevtutil.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs nefconw.exe no specs nefconw.exe no specs nefconw.exe drvinst.exe drvinst.exe no specs wudfhost.exe no specs wevtutil.exe no specs conhost.exe no specs wevtutil.exe no specs slui.exe parsec-vdd-0.45.0.0.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Users\admin\Desktop\parsec-vdd-0.45.0.0.exe" C:\Users\admin\Desktop\parsec-vdd-0.45.0.0.exe
explorer.exe
User:
admin
Company:
Parsec Cloud Inc.
Integrity Level:
HIGH
Description:
Parsec Virtual Display Driver
Exit code:
0
Version:
0.45.0.0
Modules
Images
c:\users\admin\desktop\parsec-vdd-0.45.0.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
632"C:\Users\admin\Desktop\parsec-vdd-0.45.0.0.exe" C:\Users\admin\Desktop\parsec-vdd-0.45.0.0.exe—explorer.exe
User:
admin
Company:
Parsec Cloud Inc.
Integrity Level:
MEDIUM
Description:
Parsec Virtual Display Driver
Exit code:
3221226540
Version:
0.45.0.0
Modules
Images
c:\users\admin\desktop\parsec-vdd-0.45.0.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
984DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{a4efb3d0-9a06-754b-aecb-c1705cab387e}\mm.inf" "9" "484386e17" "00000000000001CC" "WinSta0\Default" "00000000000001DC" "208" "C:\Program Files\Parsec Virtual Display Driver\driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1336DrvInst.exe "2" "201" "ROOT\DISPLAY\0000" "C:\WINDOWS\System32\DriverStore\FileRepository\mm.inf_amd64_615d17457058f652\mm.inf" "oem1.inf:*:*:0.45.0.0:Root\Parsec\VDA," "484386e17" "00000000000001CC"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1520wevtutil um "C:\Program Files\Parsec Virtual Display Driver\mm.man"C:\Windows\SysWOW64\wevtutil.exe—parsec-vdd-0.45.0.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Eventing Command Line Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcp_win.dll
1524C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2148\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2188wevtutil im "C:\Program Files\Parsec Virtual Display Driver\mm.man"C:\Windows\SysWOW64\wevtutil.exe—parsec-vdd-0.45.0.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Eventing Command Line Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcp_win.dll
2512.\nefconw.exe --remove-device-node --hardware-id Root\Parsec\VDA --class-guid "4D36E968-E325-11CE-BFC1-08002BE10318"C:\Program Files\Parsec Virtual Display Driver\nefconw.exe—cmd.exe
User:
admin
Company:
Nefarius Software Solutions e.U.
Integrity Level:
HIGH
Description:
Nefarius' Device Console Utility
Exit code:
6
Version:
1.10.0.0
Modules
Images
c:\program files\parsec virtual display driver\nefconw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\version.dll
2648wevtutil um "C:\Program Files\Parsec Virtual Display Driver\mm.man" /fromwow64C:\Windows\System32\wevtutil.exe—wevtutil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Eventing Command Line Utility
Exit code:
2147942403
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\combase.dll
c:\windows\system32\sechost.dll
Total events
7 213
Read events
7 147
Write events
60
Delete events
6

Modification events

(PID) Process:(516) parsec-vdd-0.45.0.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ParsecVDD
Operation:writeName:Comments
Value:
Parsec Virtual Display Driver
(PID) Process:(516) parsec-vdd-0.45.0.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ParsecVDD
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Parsec Virtual Display Driver\uninstall.exe
(PID) Process:(516) parsec-vdd-0.45.0.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ParsecVDD
Operation:writeName:DisplayName
Value:
Parsec Virtual Display Driver
(PID) Process:(516) parsec-vdd-0.45.0.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ParsecVDD
Operation:writeName:DisplayVersion
Value:
0.45.0.0
(PID) Process:(516) parsec-vdd-0.45.0.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ParsecVDD
Operation:writeName:EstimatedSize
Value:
851
(PID) Process:(516) parsec-vdd-0.45.0.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ParsecVDD
Operation:writeName:HelpLink
Value:
https://support.parsec.app
(PID) Process:(516) parsec-vdd-0.45.0.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ParsecVDD
Operation:writeName:InstallLocation
Value:
C:\Program Files\Parsec Virtual Display Driver
(PID) Process:(516) parsec-vdd-0.45.0.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ParsecVDD
Operation:writeName:NoModify
Value:
1
(PID) Process:(516) parsec-vdd-0.45.0.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ParsecVDD
Operation:writeName:NoRepair
Value:
1
(PID) Process:(516) parsec-vdd-0.45.0.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ParsecVDD
Operation:writeName:Publisher
Value:
Parsec Cloud Inc.
Executable files
9
Suspicious files
0
Text files
5
Unknown types
11

Dropped files

PID
Process
Filename
Type
516parsec-vdd-0.45.0.0.exeC:\Users\admin\AppData\Local\Temp\nsh6E6A.tmp\nsExec.dllexecutable
MD5:675C4948E1EFC929EDCABFE67148EDDD
SHA256:1076CA39C449ED1A968021B76EF31F22A5692DFAFEEA29460E8D970A63C59906
516parsec-vdd-0.45.0.0.exeC:\Program Files\Parsec Virtual Display Driver\vdduninstall.battext
MD5:FBC8D5E19F89DFFCCD165F44ABF114B4
SHA256:8F503E40A32959D9D2EE5A9E2A3DA627F6ED158E6C87C47EF17F1E5D74F47B9A
516parsec-vdd-0.45.0.0.exeC:\Program Files\Parsec Virtual Display Driver\vddinstall.battext
MD5:EE1BFB5CCBB3949E3258155E141A68A5
SHA256:1E7C35EB6C296F96AEE5AE4BBBD40395E8019BDE95EF9BEF91260DD8EF03C6D1
516parsec-vdd-0.45.0.0.exeC:\Program Files\Parsec Virtual Display Driver\driver\mm.catcat
MD5:1FE1FC7CC73FB17E995D65835D51CA94
SHA256:136E64AC07DCE5A3B4935D5A9C5CFE03983C0B3065F46A30A45536D5B1681D5C
516parsec-vdd-0.45.0.0.exeC:\Program Files\Parsec Virtual Display Driver\nefconw.exeexecutable
MD5:E9F2BC8C82AC755F47C7F89D1530F1A1
SHA256:CF746D1B0BBB713993D4A90DCCD774C78D9FFF8C2BA5A054B6C8F56C77E1EEE1
516parsec-vdd-0.45.0.0.exeC:\Program Files\Parsec Virtual Display Driver\uninstall.exeexecutable
MD5:A8482B15BD93524520814369536FECFA
SHA256:1E30A0C0FB30C1B09007ABE48909FE05EFB055DBC0A917F4F29D37635319F243
6936nefconw.exeC:\Users\admin\AppData\Local\Temp\{a4efb3d0-9a06-754b-aecb-c1705cab387e}\SET707D.tmpcat
MD5:1FE1FC7CC73FB17E995D65835D51CA94
SHA256:136E64AC07DCE5A3B4935D5A9C5CFE03983C0B3065F46A30A45536D5B1681D5C
516parsec-vdd-0.45.0.0.exeC:\Program Files\Parsec Virtual Display Driver\mm.manxml
MD5:481369808B1B657547BCD92A897C58C0
SHA256:E6A9944CA554B25D67B47B4D0DFBADA6EA5AE7CB208B9EC09CFE6132BAB4600F
516parsec-vdd-0.45.0.0.exeC:\Users\admin\AppData\Local\Temp\nsh6E6A.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
6936nefconw.exeC:\Users\admin\AppData\Local\Temp\{a4efb3d0-9a06-754b-aecb-c1705cab387e}\mm.catcat
MD5:1FE1FC7CC73FB17E995D65835D51CA94
SHA256:136E64AC07DCE5A3B4935D5A9C5CFE03983C0B3065F46A30A45536D5B1681D5C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
43
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2028
RUXIMICS.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2028
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
403
95.101.149.131:443
https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409
unknown
html
384 b
whitelisted
—
—
POST
403
95.101.149.131:443
https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409
unknown
html
384 b
whitelisted
—
—
POST
403
95.101.149.131:443
https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409
unknown
html
384 b
whitelisted
—
—
POST
403
95.101.149.131:443
https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409
unknown
html
384 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2028
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2028
RUXIMICS.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2028
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.67
  • 20.190.159.75
  • 40.126.31.131
  • 20.190.159.130
  • 20.190.159.71
  • 20.190.159.131
  • 20.190.159.129
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
parsec-vdd-0.45.0.0.exe