File name:

wiresock-vpn-client-x64-1.4.7.1.msi

Full analysis: https://app.any.run/tasks/2e77037a-6640-4fea-97e9-fa5542fdce2b
Verdict: Malicious activity
Analysis date: January 19, 2025, 12:34:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: WireSock VPN Client x64, Author: NT KERNEL, Keywords: Installer, Comments: This installer database contains the logic and data required to install WireSock VPN Client x64., Template: x64;1033, Revision Number: {4BF4FFCA-1CD5-409A-9285-57F90562602F}, Create Time/Date: Sat Jul 6 12:28:20 2024, Last Saved Time/Date: Sat Jul 6 12:28:20 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
MD5:

A484D8AE3BB52183E97ECBC2440E897A

SHA1:

7617B40C61603516AFF85CFFD65C521FD1E27CCA

SHA256:

FA3F483DA7EA1AE6C234F95BECB0AA6A18E7EB18B944D3FFB4518D40F4292F40

SSDEEP:

98304:0xuPHV9WIERfaFlrss5dqzRplR97QUgpRwlWLgmEAmIj5dlw1DB:Jx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6868)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6636)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6636)
      • drvinst.exe (PID: 4708)
      • devcon.exe (PID: 5488)
      • drvinst.exe (PID: 6392)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6636)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 6636)
      • drvinst.exe (PID: 4708)
      • netcfg.exe (PID: 4604)
      • drvinst.exe (PID: 6392)

    • Adds/modifies Windows certificates

      • certutil.exe (PID: 1412)
      • certutil.exe (PID: 3532)

    • Windows service management via SC.EXE

      • sc.exe (PID: 4164)

    • Starts SC.EXE for service management

      • msiexec.exe (PID: 6096)

    • Creates files in the driver directory

      • drvinst.exe (PID: 4708)
      • drvinst.exe (PID: 6392)
      • devcon.exe (PID: 5488)

    • Executable content was dropped or overwritten

      • netcfg.exe (PID: 4604)
      • drvinst.exe (PID: 6392)
      • drvinst.exe (PID: 4708)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 6320)

  • INFO

    • Reads the software policy settings

      • msiexec.exe (PID: 6464)
      • msiexec.exe (PID: 6636)
      • drvinst.exe (PID: 4708)
      • devcon.exe (PID: 5488)
      • drvinst.exe (PID: 6392)

    • The sample compiled with english language support

      • msiexec.exe (PID: 6464)
      • msiexec.exe (PID: 6636)
      • drvinst.exe (PID: 6392)

    • Reads the computer name

      • msiexec.exe (PID: 6636)
      • msiexec.exe (PID: 6096)
      • drvinst.exe (PID: 4708)
      • devcon.exe (PID: 5488)
      • drvinst.exe (PID: 6392)
      • drvinst.exe (PID: 6320)

    • Checks proxy server information

      • msiexec.exe (PID: 6464)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6464)

    • Checks supported languages

      • msiexec.exe (PID: 6636)
      • msiexec.exe (PID: 6096)
      • drvinst.exe (PID: 4708)
      • devcon.exe (PID: 5488)
      • drvinst.exe (PID: 6392)
      • drvinst.exe (PID: 6320)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6464)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6636)
      • devcon.exe (PID: 5488)
      • drvinst.exe (PID: 6392)
      • drvinst.exe (PID: 4708)

    • Manages system restore points

      • SrTasks.exe (PID: 7160)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6636)

    • Creates files in the driver directory

      • netcfg.exe (PID: 4604)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: WireSock VPN Client x64
Author: NT KERNEL
Keywords: Installer
Comments: This installer database contains the logic and data required to install WireSock VPN Client x64.
Template: x64;1033
RevisionNumber: {4BF4FFCA-1CD5-409A-9285-57F90562602F}
CreateDate: 2024:07:06 12:28:20
ModifyDate: 2024:07:06 12:28:20
Pages: 200
Words: 2
Software: WiX Toolset (4.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
19
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs certutil.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs netcfg.exe conhost.exe no specs drvinst.exe devcon.exe no specs conhost.exe no specs drvinst.exe drvinst.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1412"C:\WINDOWS\system32\certutil.exe" -addstore -f "TrustedPublisher" "C:\Program Files\WireSock VPN Client\certificates\cert_ev.cer"C:\Windows\System32\certutil.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
1556\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—certutil.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3532"C:\WINDOWS\system32\certutil.exe" -addstore -f "TrustedPublisher" "C:\Program Files\WireSock VPN Client\certificates\cert_ip.cer"C:\Windows\System32\certutil.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
3724\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—certutil.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3988\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4164"C:\WINDOWS\system32\sc.exe" query ndiswgcC:\Windows\System32\sc.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
4604"C:\WINDOWS\system32\netcfg.exe" -v -l "C:\Program Files\WireSock VPN Client\drivers\ndiswgc_lwf.inf" -c s -i nt_ndiswgcC:\Windows\System32\netcfg.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WinPE network installer
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netcfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
4708DrvInst.exe "4" "1" "C:\Program Files\WireSock VPN Client\drivers\ndiswgc_lwf.inf" "9" "4d09c0fc7" "00000000000001CC" "WinSta0\Default" "00000000000001DC" "208" "C:\Program Files\WireSock VPN Client\drivers"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
4980\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netcfg.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
19 261
Read events
18 916
Write events
319
Delete events
26

Modification events

(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000051F69B8F6E6ADB01EC190000C41A0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000005917528F6E6ADB01EC190000C41A0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000005917528F6E6ADB01EC190000C41A0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000AA93998F6E6ADB01EC190000C41A0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000AA93998F6E6ADB01EC190000C41A0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000EF5A9E8F6E6ADB01EC190000C41A0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6868) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000DE3C26906E6ADB01D41A00004C1B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6868) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000DE3C26906E6ADB01D41A0000441B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6868) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
480000000000000087042B906E6ADB01D41A0000441B0000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6868) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
Executable files
21
Suspicious files
57
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6636msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6464msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:9144D78E4DF88A48EC5846F4ACE498F4
SHA256:88918F5BEF18B2AE78867FA79A6BE10AE65BB7F0F7FDECFA2DB8A2296802C186
6464msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_CBBFF7A51C21E740C38443A74DDFD727binary
MD5:10E5E63DF9E0168D3BC174B38E1A92F7
SHA256:EFA43942E5DF1711C5FE3F0D2AEAB4F2614CE3E47A82C11340779B12B55128B9
6636msiexec.exeC:\Program Files\WireSock VPN Client\bin\wgbooster.dllexecutable
MD5:45A70A9B0F8C09CEBCB9455527BEC7FE
SHA256:6B7152ACA4222CAF214B2AD4C5089C39F7EDC0F9BF9CFDE36D3EC2628595759B
6636msiexec.exeC:\Windows\Temp\~DF8022F7936377FAEA.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
6636msiexec.exeC:\Windows\Installer\13cdb3.msiexecutable
MD5:A484D8AE3BB52183E97ECBC2440E897A
SHA256:FA3F483DA7EA1AE6C234F95BECB0AA6A18E7EB18B944D3FFB4518D40F4292F40
6636msiexec.exeC:\Windows\Installer\MSID18C.tmpbinary
MD5:2028A55B0E35ED2BE1A1D1A99A6B88DA
SHA256:4F08A4889CA1D848C79EC2DE8375234FA568614875826AC24FFD24A0849CFBF0
6636msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:59C28924154CC8E89D0D74A5B67E1C18
SHA256:92329B197E5CB7B27E736F661CDB32F92E2340627CA25F68E90B6326554730D4
6636msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:72FFE5DE3443FB98305DBC76EDEA4088
SHA256:B3998B0BE6C62C3882B13ED6E3C803C77036A208EFE7FD1AC481B5FF8180A1CB
6636msiexec.exeC:\Program Files\WireSock VPN Client\drivers\win10\ndiswgc.catbinary
MD5:1F4E60DAF89A03E991935793802654D9
SHA256:5D09B4BAF0895178073E69C975E193E30B839E00F6AAD8D417CAE580C203F741
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
21
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
488
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6464
msiexec.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
unknown
—
—
whitelisted
6464
msiexec.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHgDGEJFcIpBz28BuO60qVQ%3D
unknown
—
—
whitelisted
6464
msiexec.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
6464
msiexec.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDDIt6H%2BXfAETa93iEg%3D%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
488
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
488
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6464
msiexec.exe
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
whitelisted
3976
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
self.events.data.microsoft.com
  • 20.189.173.7
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wiresock-vpn-client-x64-1.4.7.1.msi