File name:

PDQConnectAgent-5.6.7.msi

Full analysis: https://app.any.run/tasks/3021a267-7509-4fc7-a934-c87aff6aa1c5
Verdict: Malicious activity
Analysis date: December 10, 2024, 16:40:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: PDQConnectAgent, Author: PDQ.com, Keywords: Installer, Comments: This installer database contains the logic and data required to install PDQConnectAgent., Template: x64;1033, Revision Number: {85C6D84F-37EC-4D4B-94DE-DB23DEF61F1F}, Create Time/Date: Wed Nov 6 23:53:40 2024, Last Saved Time/Date: Wed Nov 6 23:53:40 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: WiX Toolset (5.0.0.0), Security: 2
MD5:

36BBF330E441DA1046ADB9203A63BEF2

SHA1:

F802FF488D5441962254F3E539712131E1B19E53

SHA256:

F72E3F0A3B410F9A8D51682DD21345ED2234BF7683AC86CD09E6139A46E2A6F5

SSDEEP:

98304:W3Q8NTtWfTSdT8sMAxt9QdQ80K6/ySxzgvb41t70DaPe/0sVHhD2xGKxkFA8g//u:fLb6M

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5092)
      • powershell.exe (PID: 644)
      • powershell.exe (PID: 4140)
      • powershell.exe (PID: 2680)
      • powershell.exe (PID: 4976)
      • powershell.exe (PID: 5640)
      • powershell.exe (PID: 3792)
      • powershell.exe (PID: 5968)
      • powershell.exe (PID: 432)
      • powershell.exe (PID: 6348)
      • powershell.exe (PID: 6396)
      • powershell.exe (PID: 1796)
      • powershell.exe (PID: 6004)
      • powershell.exe (PID: 4444)
      • powershell.exe (PID: 2012)
      • powershell.exe (PID: 7220)
      • powershell.exe (PID: 7272)
      • powershell.exe (PID: 1604)
      • powershell.exe (PID: 6176)
      • powershell.exe (PID: 6004)
      • powershell.exe (PID: 1668)
      • powershell.exe (PID: 7484)
      • powershell.exe (PID: 7288)
      • powershell.exe (PID: 7492)
      • powershell.exe (PID: 1172)
      • powershell.exe (PID: 3656)

    • Changes powershell execution policy (Bypass)

      • pdq-connect-agent.exe (PID: 1540)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 7048)
      • pdq-connect-agent.exe (PID: 1540)
      • pdq-connect-updater.exe (PID: 5320)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 3552)
      • msiexec.exe (PID: 5000)
      • msiexec.exe (PID: 2624)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 2972)
      • rundll32.exe (PID: 4164)
      • rundll32.exe (PID: 4320)
      • rundll32.exe (PID: 2796)
      • rundll32.exe (PID: 4388)
      • pdq-connect-agent.exe (PID: 1540)
      • rundll32.exe (PID: 6452)
      • rundll32.exe (PID: 6400)
      • csc.exe (PID: 7792)
      • powershell.exe (PID: 644)
      • csc.exe (PID: 3224)
      • powershell.exe (PID: 1668)

    • Starts SC.EXE for service management

      • rundll32.exe (PID: 4388)

    • PDQConnect is probably used for system patching and software deployment

      • sc.exe (PID: 5300)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6992)

    • The process hides Powershell's copyright startup banner

      • pdq-connect-agent.exe (PID: 1540)
      • powershell.exe (PID: 6176)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 7220)
      • powershell.exe (PID: 7944)
      • powershell.exe (PID: 6584)
      • powershell.exe (PID: 1080)
      • powershell.exe (PID: 2412)
      • powershell.exe (PID: 308)
      • powershell.exe (PID: 1448)
      • powershell.exe (PID: 7400)
      • powershell.exe (PID: 7292)

    • The process bypasses the loading of PowerShell profile settings

      • pdq-connect-agent.exe (PID: 1540)
      • powershell.exe (PID: 6176)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 7220)
      • powershell.exe (PID: 7944)
      • powershell.exe (PID: 6584)
      • powershell.exe (PID: 1080)
      • powershell.exe (PID: 2412)
      • powershell.exe (PID: 308)
      • powershell.exe (PID: 1448)
      • powershell.exe (PID: 7292)
      • powershell.exe (PID: 7400)

    • Starts POWERSHELL.EXE for commands execution

      • pdq-connect-agent.exe (PID: 1540)
      • powershell.exe (PID: 6176)
      • powershell.exe (PID: 7220)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 6584)
      • powershell.exe (PID: 7944)
      • powershell.exe (PID: 1080)
      • powershell.exe (PID: 2412)
      • powershell.exe (PID: 7292)
      • powershell.exe (PID: 7400)
      • powershell.exe (PID: 308)
      • powershell.exe (PID: 1448)

    • The process hide an interactive prompt from the user

      • pdq-connect-agent.exe (PID: 1540)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7792)
      • csc.exe (PID: 3224)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 644)
      • powershell.exe (PID: 1668)

    • Application launched itself

      • powershell.exe (PID: 6176)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 7220)
      • powershell.exe (PID: 6584)
      • powershell.exe (PID: 7944)
      • powershell.exe (PID: 2412)
      • powershell.exe (PID: 308)
      • powershell.exe (PID: 1080)
      • powershell.exe (PID: 1448)
      • powershell.exe (PID: 7292)
      • powershell.exe (PID: 7400)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 644)
      • powershell.exe (PID: 1668)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 4580)
      • DismHost.exe (PID: 628)

    • Receives information about network interfaces and IP addresses (POWERSHELL)

      • powershell.exe (PID: 7484)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6808)

    • An automatically generated document

      • msiexec.exe (PID: 6808)

    • Reads the computer name

      • msiexec.exe (PID: 6992)
      • pdq-connect-agent.exe (PID: 1540)
      • msiexec.exe (PID: 2624)
      • pdq-connect-updater.exe (PID: 5320)

    • Checks supported languages

      • msiexec.exe (PID: 6992)
      • msiexec.exe (PID: 5000)
      • msiexec.exe (PID: 3552)
      • pdq-connect-agent.exe (PID: 1540)
      • msiexec.exe (PID: 2624)
      • pdq-connect-updater.exe (PID: 5320)
      • csc.exe (PID: 7792)
      • cvtres.exe (PID: 7832)

    • Reads the software policy settings

      • msiexec.exe (PID: 6808)
      • msiexec.exe (PID: 6992)
      • pdq-connect-updater.exe (PID: 5320)
      • pdq-connect-agent.exe (PID: 1540)

    • Manages system restore points

      • SrTasks.exe (PID: 6468)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6992)

    • The sample compiled with english language support

      • msiexec.exe (PID: 6992)
      • powershell.exe (PID: 644)
      • powershell.exe (PID: 1668)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6992)
      • csc.exe (PID: 7792)

    • Application launched itself

      • msiexec.exe (PID: 6992)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6992)

    • Reads Environment values

      • pdq-connect-agent.exe (PID: 1540)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 432)
      • powershell.exe (PID: 644)
      • powershell.exe (PID: 7492)
      • powershell.exe (PID: 1668)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 432)
      • powershell.exe (PID: 7492)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4444)
      • powershell.exe (PID: 644)
      • powershell.exe (PID: 7484)
      • powershell.exe (PID: 1668)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4444)
      • powershell.exe (PID: 7484)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 644)
      • powershell.exe (PID: 1668)
      • powershell.exe (PID: 7484)

    • Sends debugging messages

      • powershell.exe (PID: 644)
      • DismHost.exe (PID: 4580)
      • powershell.exe (PID: 1668)
      • DismHost.exe (PID: 628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: PDQConnectAgent
Author: PDQ.com
Keywords: Installer
Comments: This installer database contains the logic and data required to install PDQConnectAgent.
Template: x64;1033
RevisionNumber: {85C6D84F-37EC-4D4B-94DE-DB23DEF61F1F}
CreateDate: 2024:11:06 23:53:40
ModifyDate: 2024:11:06 23:53:40
Pages: 200
Words: 2
Software: WiX Toolset (5.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
251
Monitored processes
119
Malicious processes
7
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe sc.exe no specs conhost.exe no specs pdq-connect-agent.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe pdq-connect-updater.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs dsregcmd.exe no specs tiworker.exe no specs csc.exe cvtres.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs dsregcmd.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs csc.exe powershell.exe no specs conhost.exe no specs cvtres.exe no specs powershell.exe no specs conhost.exe no specs dismhost.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs dismhost.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
308"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
432"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
448\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
628C:\WINDOWS\TEMP\AA017B21-D917-4423-8B89-3D026CF64749\dismhost.exe {8487EE6A-F9DD-48C1-96B3-B009BD0EAFD0}C:\Windows\Temp\AA017B21-D917-4423-8B89-3D026CF64749\DismHost.exe
powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\temp\aa017b21-d917-4423-8b89-3d026cf64749\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
644"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1080"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1172"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1448"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
253 023
Read events
252 639
Write events
354
Delete events
30

Modification events

(PID) Process:(6992) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000C6E6832D224BDB01501B0000781B0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6992) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000C6E6832D224BDB01501B0000781B0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6992) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000490CAA2D224BDB01501B0000781B0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6992) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000490CAA2D224BDB01501B0000781B0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6992) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000B16FAC2D224BDB01501B0000781B0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6992) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000009CD3AE2D224BDB01501B0000781B0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6992) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6992) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000F9F0E02D224BDB01501B0000781B0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6992) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000D141E32D224BDB01501B0000E41B0000E8030000010000000000000000000000E3C801CC874DBF4BBDFB7005650AD94C00000000000000000000000000000000
(PID) Process:(7048) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B26BEA2D224BDB01881B0000F81B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
141
Suspicious files
37
Text files
130
Unknown types
18

Dropped files

PID
Process
Filename
Type
6992msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6992msiexec.exeC:\Windows\Installer\13929e.msi —
MD5:—
SHA256:—
6808msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D9CB7DFFEEA63BAB482BD2705E7E24AB_D64C5BFAB2C28B4652E4AC7169A0D3DBder
MD5:16B84693F182C44DECF17C06403E447F
SHA256:6A5667EF3C95548EF04A73B4E09837C6F0605D55F3E060B7C10A0F50B018A08E
6808msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:D4570B65372DC962AF5A9223EC896409
SHA256:D124CC434C016F20E0AF814345DBB47FE4156795EDDDD134FC8EB90BE95324CB
6808msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBder
MD5:AB26636E53659787C83DE712294DA868
SHA256:EB5025D51F8D6FF2CCE8279D263BE7111D2444DA6709D19D3BA3DE865620E054
6808msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4binary
MD5:2D9A040584D8FAFF5F819F18E777CB92
SHA256:F6E1C7D45EC82E60A83C29FE50EB4D0E2C8A878CAD35D8977D6C7FA727B76628
2972rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA28E08DD76E470B580E13CCE80EF0A5DB\CustomAction.configxml
MD5:C9C40AF1656F8531EAA647CACEB1E436
SHA256:1A67F60962CA1CBF19873B62A8518EFE8C701A09CD609AF4C50ECC7F0B468BB8
4164rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA3B4E41F51D47CE995C0F360EF94BB53B\pdqconnectagent-setup.exeexecutable
MD5:75F16349CAFAE8F37BD1E207E2EC83D2
SHA256:F3BB2B9230B8A6066DFEEB172AD32AE3EA31D2D49C76BDCC8A1E2531FA61F5B7
4164rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA3B4E41F51D47CE995C0F360EF94BB53B\CustomAction.configxml
MD5:C9C40AF1656F8531EAA647CACEB1E436
SHA256:1A67F60962CA1CBF19873B62A8518EFE8C701A09CD609AF4C50ECC7F0B468BB8
6992msiexec.exeC:\Windows\Installer\MSI9967.tmpexecutable
MD5:E8DC682F2C486075C6ABA658971A62CC
SHA256:7AACD4C18710E9BC4FF2034895A0A0C8F80F21809FB177D520E93F7688216E6D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
43
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
314 b
whitelisted
6808
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
US
binary
471 b
whitelisted
6808
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhtVltVOu8OqBzmsd%2B%2FeFfks3xTQQUvGsiZZ2MaObmHgXx2HIl1LjgSMACEAvcoEuhCK%2FAlHGPdKmo6gs%3D
US
binary
727 b
whitelisted
6808
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEA5NZ%2FZDFskqO3oXzEaXao8%3D
US
binary
727 b
whitelisted
6560
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
2088
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
418 b
whitelisted
2088
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
1616
WmiPrvSE.exe
GET
200
2.21.20.133:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
DE
binary
824 b
whitelisted
1616
WmiPrvSE.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
DE
binary
564 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2736
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4140
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
92.123.104.63:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
  • 2.21.20.133
  • 2.21.20.137
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 88.221.169.152
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.bing.com
  • 92.123.104.63
  • 92.123.104.43
  • 92.123.104.42
  • 92.123.104.46
  • 92.123.104.56
  • 92.123.104.57
  • 92.123.104.39
  • 92.123.104.64
  • 92.123.104.62
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.23
  • 20.190.159.2
  • 20.190.159.4
  • 40.126.31.67
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
Process
Message
powershell.exe
PID=644 TID=7276 DismApi.dll: - DismInitializeInternal
powershell.exe
PID=644 TID=7276 DismApi.dll: - DismInitializeInternal
powershell.exe
PID=644 TID=7276 DismApi.dll: API Version 10.0.19041.3758 - DismInitializeInternal
powershell.exe
PID=644 TID=7276 DismApi.dll: <----- Starting DismApi.dll session -----> - DismInitializeInternal
powershell.exe
PID=644 TID=7276 Enter DismInitializeInternal - DismInitializeInternal
powershell.exe
PID=644 TID=7276 Input parameters: LogLevel: 2, LogFilePath: C:\WINDOWS\Logs\DISM\dism.log, ScratchDirectory: (null) - DismInitializeInternal
powershell.exe
PID=644 TID=7276 DismApi.dll: Host machine information: OS Version=10.0.19045, Running architecture=amd64, Number of processors=4 - DismInitializeInternal
powershell.exe
PID=644 TID=7276 DismApi.dll: Parent process command line: "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command - - DismInitializeInternal
powershell.exe
PID=644 TID=7276 Waiting for m_pInternalThread to start - CCommandThread::Start
powershell.exe
PID=644 TID=7276 Lookup in table by path failed for: DummyPath-2BA51B78-C7F7-4910-B99D-BB7345357CDC - CTransactionalImageTable::LookupImagePath
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PDQConnectAgent-5.6.7.msi