File name:

e8fd8860b62364f0c7f57934a4284fef79149bb6f00bbf8d71623cd32c79bd3d.msi

Full analysis: https://app.any.run/tasks/29c709e8-e411-4e21-8d99-9279e232ac6c
Verdict: Malicious activity
Analysis date: May 16, 2025, 08:48:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
pdqconnect
rmm-tool
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: PDQConnectAgent, Author: PDQ.com, Keywords: Installer, Comments: This installer database contains the logic and data required to install PDQConnectAgent., Template: x64;1033, Revision Number: {9467128F-9A42-4772-A694-2E935CC19876}, Create Time/Date: Mon Mar 31 03:03:18 2025, Last Saved Time/Date: Mon Mar 31 03:03:18 2025, Number of Pages: 200, Number of Words: 2, Name of Creating Application: WiX Toolset (5.0.0.0), Security: 2
MD5:

C25BAF48765F6DC4130994CFB7458411

SHA1:

0D1118AFFC0CEB38A76FAF9AEF5A8E779BF98576

SHA256:

E8FD8860B62364F0C7F57934A4284FEF79149BB6F00BBF8D71623CD32C79BD3D

SSDEEP:

98304:GGVlDd10yJLNadu3w9Gl+X8tTAgdZ2gqra/IUwcSX4PXLM41Z3WcxUvhuTtsuLA9:0fFv+mr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 8112)
      • powershell.exe (PID: 856)
      • powershell.exe (PID: 7984)
      • powershell.exe (PID: 7012)
      • powershell.exe (PID: 7580)
      • powershell.exe (PID: 8176)

    • Changes powershell execution policy (Bypass)

      • pdq-connect-agent.exe (PID: 6488)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6816)
      • pdq-connect-agent.exe (PID: 6488)
      • pdq-connect-updater.exe (PID: 5544)

    • Application launched itself

      • msiexec.exe (PID: 6708)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 8016)
      • rundll32.exe (PID: 8172)
      • rundll32.exe (PID: 8072)
      • rundll32.exe (PID: 1568)
      • rundll32.exe (PID: 4188)
      • rundll32.exe (PID: 7284)
      • pdq-connect-agent.exe (PID: 6488)
      • rundll32.exe (PID: 7020)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 7968)
      • msiexec.exe (PID: 8132)
      • msiexec.exe (PID: 7380)

    • PDQConnect is probably used for system patching and software deployment

      • sc.exe (PID: 6964)

    • Starts SC.EXE for service management

      • rundll32.exe (PID: 4188)

    • The process hides Powershell's copyright startup banner

      • pdq-connect-agent.exe (PID: 6488)

    • Starts POWERSHELL.EXE for commands execution

      • pdq-connect-agent.exe (PID: 6488)

    • The process bypasses the loading of PowerShell profile settings

      • pdq-connect-agent.exe (PID: 6488)

    • The process hide an interactive prompt from the user

      • pdq-connect-agent.exe (PID: 6488)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6964)

  • INFO

    • Checks proxy server information

      • msiexec.exe (PID: 3888)

    • An automatically generated document

      • msiexec.exe (PID: 3888)

    • Reads the software policy settings

      • msiexec.exe (PID: 3888)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3888)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 3888)

    • Reads the computer name

      • msiexec.exe (PID: 6708)

    • Checks supported languages

      • msiexec.exe (PID: 6708)

    • Manages system restore points

      • SrTasks.exe (PID: 7644)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6708)

    • PDQCONNECT has been detected

      • msiexec.exe (PID: 8132)
      • rundll32.exe (PID: 4188)
      • pdq-connect-agent.exe (PID: 6488)

    • The sample compiled with english language support

      • msiexec.exe (PID: 6708)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: PDQConnectAgent
Author: PDQ.com
Keywords: Installer
Comments: This installer database contains the logic and data required to install PDQConnectAgent.
Template: x64;1033
RevisionNumber: {9467128F-9A42-4772-A694-2E935CC19876}
CreateDate: 2025:04:30 03:03:18
ModifyDate: 2025:04:30 03:03:18
Pages: 200
Words: 2
Software: WiX Toolset (5.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
34
Malicious processes
3
Suspicious processes
4

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs sppextcomobj.exe no specs slui.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe sc.exe no specs conhost.exe no specs pdq-connect-agent.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe pdq-connect-updater.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
840\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568rundll32.exe "C:\WINDOWS\Installer\MSI28C9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1124593 44 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.WriteTokenC:\Windows\System32\rundll32.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3888"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\e8fd8860b62364f0c7f57934a4284fef79149bb6f00bbf8d71623cd32c79bd3d.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4188rundll32.exe "C:\WINDOWS\Installer\MSI2A70.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1125015 50 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.StartServiceC:\Windows\System32\rundll32.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5544"C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe" --serviceC:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
PDQ Connect Updater
Version:
5.6.16
Modules
Images
c:\program files\pdq\pdqconnectupdater\pdq-connect-updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5608C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6488"C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe" --serviceC:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
PDQ Connect Agent
Version:
5.8.1
Modules
Images
c:\program files\pdq\pdqconnectagent\pdq-connect-agent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6644"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
38 630
Read events
38 263
Write events
342
Delete events
25

Modification events

(PID) Process:(6708) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000002BF0725F3FC6DB01341A000050120000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6708) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000002BF0725F3FC6DB01341A000050120000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6708) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000005764C65F3FC6DB01341A000050120000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6708) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000005764C65F3FC6DB01341A000050120000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6708) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000182DCB5F3FC6DB01341A000050120000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6708) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000076E0CF5F3FC6DB01341A000050120000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6708) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6708) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000E6C544603FC6DB01341A000050120000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6708) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000BE7B49603FC6DB01341A000088140000E80300000100000000000000000000002C037F596744EE4A819BB4662CC584C900000000000000000000000000000000
(PID) Process:(6816) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000D66F55603FC6DB01A01A00008C190000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
39
Suspicious files
51
Text files
35
Unknown types
0

Dropped files

PID
Process
Filename
Type
6708msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6708msiexec.exeC:\Windows\Installer\111c8d.msi —
MD5:—
SHA256:—
3888msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:F5FB817195684D7A60C466E9A1003296
SHA256:25E4C42E64E68EF1E03950D7309468A2F6839E66C297A04263E132CAFC2C1C79
3888msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4binary
MD5:B05604061E3EC3AABDA184504B54FD61
SHA256:39C721D8D85211FAD5BAED20BDD88FC53F76BD1E4BC41611961DDE0812D396AE
3888msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:9B779DDFD8F995CF996F5CB84D845ABE
SHA256:801E55B8E49D8DA4FE5E50F253B3BE63AB3B14E9617D21B4EF857AC1C2B449D9
8016rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA217E2F79A14019EB491DE476DFB48E72\pdqconnectagent-setup.exeexecutable
MD5:C863992E0C33657752864892225C8BE4
SHA256:80DC228BE0FFA323EE9303AEF53DC5164D2817577210462AAA377BA86D90FA33
6708msiexec.exeC:\Windows\Installer\MSI2423.tmpexecutable
MD5:44E75952B658FFE4869CD40DB1299C8F
SHA256:50BBF22DB97433456A4307211B99641740F20A6421BCEE32216FA888FEAA7B2C
3888msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D9CB7DFFEEA63BAB482BD2705E7E24AB_D64C5BFAB2C28B4652E4AC7169A0D3DBbinary
MD5:56B72010F016BEA2AA864F3CCC92776A
SHA256:252C81AE1008019CCBF70C80A7837CCD9836DA0749D66F534339B2E3A5914F57
3888msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4binary
MD5:396CFF064EFAD5C32FF8E7311347FC02
SHA256:1202D6B1ED19F7BC78F7B09E3D62BC4E5F30AAA503083AB14A878775B4F4A1D9
6708msiexec.exeC:\Windows\Installer\MSI217F.tmpexecutable
MD5:7801A3BD89BB8500FA6543C3DF3ADA7D
SHA256:C5B4973BB1E510C8F3CD877F1C9ED5799D1325359341D9A151913431F8955EAD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
30
DNS requests
16
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3888
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
3888
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEA5NZ%2FZDFskqO3oXzEaXao8%3D
unknown
—
—
whitelisted
3888
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhtVltVOu8OqBzmsd%2B%2FeFfks3xTQQUvGsiZZ2MaObmHgXx2HIl1LjgSMACEAvcoEuhCK%2FAlHGPdKmo6gs%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7732
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7732
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.10:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
msiexec.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 23.216.77.10
  • 23.216.77.15
  • 23.216.77.19
  • 23.216.77.21
  • 23.216.77.17
  • 23.216.77.7
  • 23.216.77.22
  • 23.216.77.12
  • 23.216.77.11
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.130
  • 20.190.159.129
  • 40.126.31.131
  • 20.190.159.131
  • 20.190.159.68
  • 20.190.159.64
  • 40.126.31.71
  • 40.126.31.128
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
e8fd8860b62364f0c7f57934a4284fef79149bb6f00bbf8d71623cd32c79bd3d.msi