File name:

JJSploit_8.10.15_x64_en-US.msi

Full analysis: https://app.any.run/tasks/0a4de060-073a-4a0c-a144-4b6fd01081be
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 12, 2025, 01:38:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
loader
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: JJSploit, Author: wearedevs, Keywords: Installer, Comments: This installer database contains the logic and data required to install JJSploit., Template: x64;0, Revision Number: {11619C15-6D7D-4951-9CF9-1136DA97AE6F}, Create Time/Date: Fri Dec 27 18:03:52 2024, Last Saved Time/Date: Fri Dec 27 18:03:52 2024, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
MD5:

CC9626B9EB05FCC4F0A12616E2C23504

SHA1:

70EF30A35C8CD3CF2DBAFF4DCDF47C33FEDBEC85

SHA256:

F468617180D78E999EAED9139FEF635874F0CB791D1CEB6642A364D7D366A32F

SSDEEP:

98304:miOoqqI3cH66jZM4G9JCN+QVJAfWtkXUgAS88yuCrY5zbpEQq0Ka4PR92naE8lIb:AdRLwElkGr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3260)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 3772)

  • SUSPICIOUS

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 6504)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 3260)

    • Starts process via Powershell

      • powershell.exe (PID: 3260)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 3260)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6900)

    • Manipulates environment variables

      • powershell.exe (PID: 3260)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 6504)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6504)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 3260)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2632)
      • MicrosoftEdgeUpdate.exe (PID: 3772)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3260)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2632)
      • MicrosoftEdgeUpdate.exe (PID: 3772)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 2632)
      • MicrosoftEdgeUpdate.exe (PID: 3772)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 3772)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4668)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6296)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6264)
      • MicrosoftEdgeUpdate.exe (PID: 4264)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 3772)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 3508)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 3260)

    • An automatically generated document

      • msiexec.exe (PID: 6396)

    • Reads the computer name

      • msiexec.exe (PID: 6504)
      • msiexec.exe (PID: 6636)
      • MicrosoftEdgeUpdate.exe (PID: 3772)
      • MicrosoftEdgeUpdate.exe (PID: 4264)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4668)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6296)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6264)
      • MicrosoftEdgeUpdate.exe (PID: 6220)
      • MicrosoftEdgeUpdate.exe (PID: 628)
      • MicrosoftEdgeUpdate.exe (PID: 6076)

    • Manages system restore points

      • SrTasks.exe (PID: 3732)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6396)
      • msiexec.exe (PID: 6504)

    • Checks supported languages

      • msiexec.exe (PID: 6504)
      • msiexec.exe (PID: 6636)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2632)
      • MicrosoftEdgeUpdate.exe (PID: 3772)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4668)
      • MicrosoftEdgeUpdate.exe (PID: 4264)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6264)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6296)
      • MicrosoftEdgeUpdate.exe (PID: 6220)
      • MicrosoftEdgeUpdate.exe (PID: 6076)
      • MicrosoftEdgeUpdate.exe (PID: 628)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6504)

    • Checks proxy server information

      • powershell.exe (PID: 3260)
      • MicrosoftEdgeUpdate.exe (PID: 6220)
      • MicrosoftEdgeUpdate.exe (PID: 628)

    • The sample compiled with english language support

      • powershell.exe (PID: 3260)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2632)
      • MicrosoftEdgeUpdate.exe (PID: 3772)

    • The process uses the downloaded file

      • powershell.exe (PID: 3260)

    • The executable file from the user directory is run by the Powershell process

      • MicrosoftEdgeWebview2Setup.exe (PID: 2632)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 2632)
      • MicrosoftEdgeUpdate.exe (PID: 3772)
      • svchost.exe (PID: 3508)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 3772)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 6220)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 3772)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 6220)
      • MicrosoftEdgeUpdate.exe (PID: 628)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 6220)
      • MicrosoftEdgeUpdate.exe (PID: 628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: JJSploit
Author: wearedevs
Keywords: Installer
Comments: This installer database contains the logic and data required to install JJSploit.
Template: x64;0
RevisionNumber: {11619C15-6D7D-4951-9CF9-1136DA97AE6F}
CreateDate: 2024:12:27 18:03:52
ModifyDate: 2024:12:27 18:03:52
Pages: 450
Words: 2
Software: Windows Installer XML Toolset (3.14.1.8722)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
18
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
628"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
2632"C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3260powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -WaitC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3508C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITSC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3732C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3772C:\Users\admin\AppData\Local\Temp\EUE959.tmp\MicrosoftEdgeUpdate.exe /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Users\admin\AppData\Local\Temp\EUE959.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\temp\eue959.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
4264"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
4668"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.43\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5592\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
20 752
Read events
17 209
Write events
3 500
Delete events
43

Modification events

(PID) Process:(6504) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000CDE4C0B39264DB0168190000E41A0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6504) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000CDE4C0B39264DB0168190000E41A0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6504) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000DEC10AB49264DB0168190000E41A0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6504) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000DEC10AB49264DB0168190000E41A0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6504) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000007F260DB49264DB0168190000E41A0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6504) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000E0ED11B49264DB0168190000E41A0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6504) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000009655C2B49264DB0168190000E41A0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6900) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000074AFD0B49264DB01F41A0000141B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6900) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000074AFD0B49264DB01F41A0000841B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6900) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000074AFD0B49264DB01F41A00007C1B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
204
Suspicious files
19
Text files
20
Unknown types
2

Dropped files

PID
Process
Filename
Type
6504msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6504msiexec.exeC:\Windows\Installer\13bebf.msi —
MD5:—
SHA256:—
6504msiexec.exeC:\Program Files\JJSploit\resources\luascripts\jailbreak\walkspeed.luabinary
MD5:76D6BC545A92D108FF8A18614A5DB4AD
SHA256:A7931EE89662C563637E1752228923D182F42F3A70286D4FD0A1FFF993C9766D
6504msiexec.exeC:\Windows\Installer\MSIC2D6.tmpbinary
MD5:3D890503032C8518D675A43996EE93F3
SHA256:4D8789E0DFDD8A9ECAF76770E90A64212E1C0D5193E0EA1651DE0E6AFFF344E4
6504msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:CF6E5EB70655B2717CE5DB75804CFF2D
SHA256:5D2896DB4A789EB50DEE459DA0044886128CCF53EEEA441D61DABA3003040E12
6396msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI741A.tmpexecutable
MD5:CFBB8568BD3711A97E6124C56FCFA8D9
SHA256:7F47D98AB25CFEA9B3A2E898C3376CC9BA1CD893B4948B0C27CAA530FD0E34CC
6504msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{c4b130c9-73aa-450b-9e51-fe2035faf5c9}_OnDiskSnapshotPropbinary
MD5:CF6E5EB70655B2717CE5DB75804CFF2D
SHA256:5D2896DB4A789EB50DEE459DA0044886128CCF53EEEA441D61DABA3003040E12
6504msiexec.exeC:\Windows\Temp\~DF604C9385E99C0237.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
6504msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:F9C4A518FD01BFA6577697A6510FD8FA
SHA256:80CAB0492396B7F4933BCDEE70A2BC7339485818F68CAD4658D50E88354896F5
6504msiexec.exeC:\Windows\Temp\~DFA8E24FF8AD2CBA43.TMPbinary
MD5:E74F434D84C2500538196CEFC83DA860
SHA256:4245B16FA6BAB0C286ACB4C2CC70F5111E953204E0F7A1683C5ED86B01A54D4E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
27
DNS requests
12
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
QA
binary
973 b
whitelisted
880
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
QA
binary
973 b
whitelisted
4864
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
QA
binary
973 b
whitelisted
—
—
GET
301
2.23.181.156:443
https://go.microsoft.com/fwlink/p/?LinkId=2124703
unknown
—
—
unknown
—
—
POST
204
2.16.204.161:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.14:443
https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/c1336fd6-a2eb-4669-9b03-949fc70ace0e/MicrosoftEdgeWebview2Setup.exe
US
executable
1.58 Mb
whitelisted
—
—
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.195.43?clientId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&appChannel_edgeupdate=6&appConsentState_edgeupdate=0&appDayOfInstall_edgeupdate=0&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeDuration_edgeupdate=0&appInstallTimeDiffSec_edgeupdate=0&appIsPinnedSystem_edgeupdate=false&appLastLaunchCount_edgeupdate=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appVersion_edgeupdate=1.3.195.43&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=4&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=DELL&oemProductName=DELL&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.4046&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=otherinstallcmd&requestIsMachine=false&requestOmahaShellVersion=1.3.195.43&requestOmahaVersion=1.3.195.43
US
binary
234 b
whitelisted
3508
svchost.exe
GET
—
2.22.242.227:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/7d9cd93c-1d5e-449b-9ad7-f1e8d6b90509?P1=1737250748&P2=404&P3=2&P4=AdMeWDtU%2fRbiTl4ODAmyTAGvWVKbpIlDsPI6xCvSb2Ihjp8zvwCthR2852OY1jlvakLx%2bhhg5wEvQrdIygecrA%3d%3d
DE
—
—
whitelisted
880
svchost.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
1.01 Kb
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
1.01 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
880
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4864
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
880
svchost.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4864
RUXIMICS.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
880
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.138
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 2.16.168.116
  • 2.16.168.117
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
msedge.api.cdp.microsoft.com
  • 172.169.87.222
whitelisted
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 2.22.242.227
  • 2.22.242.122
whitelisted

Threats

PID
Process
Class
Message
3508
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
JJSploit_8.10.15_x64_en-US.msi