File name:

wiresock-vpn-client-x64-1.4.7.1.msi

Full analysis: https://app.any.run/tasks/2e77037a-6640-4fea-97e9-fa5542fdce2b
Verdict: Malicious activity
Analysis date: January 19, 2025, 12:34:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: WireSock VPN Client x64, Author: NT KERNEL, Keywords: Installer, Comments: This installer database contains the logic and data required to install WireSock VPN Client x64., Template: x64;1033, Revision Number: {4BF4FFCA-1CD5-409A-9285-57F90562602F}, Create Time/Date: Sat Jul 6 12:28:20 2024, Last Saved Time/Date: Sat Jul 6 12:28:20 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
MD5:

A484D8AE3BB52183E97ECBC2440E897A

SHA1:

7617B40C61603516AFF85CFFD65C521FD1E27CCA

SHA256:

FA3F483DA7EA1AE6C234F95BECB0AA6A18E7EB18B944D3FFB4518D40F4292F40

SSDEEP:

98304:0xuPHV9WIERfaFlrss5dqzRplR97QUgpRwlWLgmEAmIj5dlw1DB:Jx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6868)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6636)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 6636)
      • drvinst.exe (PID: 4708)
      • netcfg.exe (PID: 4604)
      • drvinst.exe (PID: 6392)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6636)
      • drvinst.exe (PID: 4708)
      • devcon.exe (PID: 5488)
      • drvinst.exe (PID: 6392)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6636)

    • Adds/modifies Windows certificates

      • certutil.exe (PID: 1412)
      • certutil.exe (PID: 3532)

    • Starts SC.EXE for service management

      • msiexec.exe (PID: 6096)

    • Windows service management via SC.EXE

      • sc.exe (PID: 4164)

    • Creates files in the driver directory

      • drvinst.exe (PID: 4708)
      • drvinst.exe (PID: 6392)
      • devcon.exe (PID: 5488)

    • Executable content was dropped or overwritten

      • netcfg.exe (PID: 4604)
      • drvinst.exe (PID: 4708)
      • drvinst.exe (PID: 6392)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 6320)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 6636)
      • msiexec.exe (PID: 6096)
      • drvinst.exe (PID: 4708)
      • drvinst.exe (PID: 6392)
      • drvinst.exe (PID: 6320)
      • devcon.exe (PID: 5488)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6464)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6464)

    • The sample compiled with english language support

      • msiexec.exe (PID: 6464)
      • msiexec.exe (PID: 6636)
      • drvinst.exe (PID: 6392)

    • Reads the software policy settings

      • msiexec.exe (PID: 6464)
      • msiexec.exe (PID: 6636)
      • drvinst.exe (PID: 4708)
      • devcon.exe (PID: 5488)
      • drvinst.exe (PID: 6392)

    • Checks supported languages

      • msiexec.exe (PID: 6636)
      • msiexec.exe (PID: 6096)
      • drvinst.exe (PID: 4708)
      • devcon.exe (PID: 5488)
      • drvinst.exe (PID: 6320)
      • drvinst.exe (PID: 6392)

    • Checks proxy server information

      • msiexec.exe (PID: 6464)

    • Manages system restore points

      • SrTasks.exe (PID: 7160)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6636)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6636)
      • drvinst.exe (PID: 4708)
      • devcon.exe (PID: 5488)
      • drvinst.exe (PID: 6392)

    • Creates files in the driver directory

      • netcfg.exe (PID: 4604)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: WireSock VPN Client x64
Author: NT KERNEL
Keywords: Installer
Comments: This installer database contains the logic and data required to install WireSock VPN Client x64.
Template: x64;1033
RevisionNumber: {4BF4FFCA-1CD5-409A-9285-57F90562602F}
CreateDate: 2024:07:06 12:28:20
ModifyDate: 2024:07:06 12:28:20
Pages: 200
Words: 2
Software: WiX Toolset (4.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
19
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs certutil.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs netcfg.exe conhost.exe no specs drvinst.exe devcon.exe no specs conhost.exe no specs drvinst.exe drvinst.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1412"C:\WINDOWS\system32\certutil.exe" -addstore -f "TrustedPublisher" "C:\Program Files\WireSock VPN Client\certificates\cert_ev.cer"C:\Windows\System32\certutil.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
1556\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—certutil.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3532"C:\WINDOWS\system32\certutil.exe" -addstore -f "TrustedPublisher" "C:\Program Files\WireSock VPN Client\certificates\cert_ip.cer"C:\Windows\System32\certutil.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
3724\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—certutil.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3988\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4164"C:\WINDOWS\system32\sc.exe" query ndiswgcC:\Windows\System32\sc.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
4604"C:\WINDOWS\system32\netcfg.exe" -v -l "C:\Program Files\WireSock VPN Client\drivers\ndiswgc_lwf.inf" -c s -i nt_ndiswgcC:\Windows\System32\netcfg.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WinPE network installer
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netcfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
4708DrvInst.exe "4" "1" "C:\Program Files\WireSock VPN Client\drivers\ndiswgc_lwf.inf" "9" "4d09c0fc7" "00000000000001CC" "WinSta0\Default" "00000000000001DC" "208" "C:\Program Files\WireSock VPN Client\drivers"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
4980\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netcfg.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
19 261
Read events
18 916
Write events
319
Delete events
26

Modification events

(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000051F69B8F6E6ADB01EC190000C41A0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000005917528F6E6ADB01EC190000C41A0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000005917528F6E6ADB01EC190000C41A0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000AA93998F6E6ADB01EC190000C41A0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000AA93998F6E6ADB01EC190000C41A0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6636) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000EF5A9E8F6E6ADB01EC190000C41A0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6868) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000DE3C26906E6ADB01D41A00004C1B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6868) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000DE3C26906E6ADB01D41A0000441B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6868) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
480000000000000087042B906E6ADB01D41A0000441B0000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6868) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
Executable files
21
Suspicious files
57
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6636msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6464msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41Cbinary
MD5:B762B9AA58BCE985E7C646362E6EEA22
SHA256:C55D9478C561BA2251021061BE4CDD8E06AB1C3E4AD635F9E638F6EC62E4B5FF
6464msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41Cbinary
MD5:B9B6746F499EC2B452CE87F05BD5C479
SHA256:6B3DAD3F7A93E90424C721528E7419F8791B62B7793B273B4829597A88EC71D2
6464msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81Bbinary
MD5:8D13CC06D7D90FAC67606507939BF8BE
SHA256:0C01E872F34971BEAA56C9BAF495879A871F96BE4082B33FE05872E66A47EF32
6464msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81Bbinary
MD5:A07A166656F412ADF29B9A955363725E
SHA256:9C5F792A6F442BE81D6EBEC8B1D6B619FB822D4A6864F2A6D33893FB1B72010B
6636msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:59C28924154CC8E89D0D74A5B67E1C18
SHA256:92329B197E5CB7B27E736F661CDB32F92E2340627CA25F68E90B6326554730D4
6464msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_CBBFF7A51C21E740C38443A74DDFD727binary
MD5:4BC8E6D289E9D17E28BD7959FCBF8343
SHA256:2FC741F093A13947C37FD2E00880037A25F3ED055472B147D0F3ADD8A140E996
6464msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:C6BB1CCD81E08919D45264702548CCB6
SHA256:B0235EEEAFE6E5E633EB173B2C090E54A7EAA5ED7A5AD40A6C2DBFA756E61CF3
6636msiexec.exeC:\Windows\Installer\MSID18C.tmpbinary
MD5:2028A55B0E35ED2BE1A1D1A99A6B88DA
SHA256:4F08A4889CA1D848C79EC2DE8375234FA568614875826AC24FFD24A0849CFBF0
6636msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{2f77bc80-cab8-4166-bcee-c63d3aaf92d2}_OnDiskSnapshotPropbinary
MD5:59C28924154CC8E89D0D74A5B67E1C18
SHA256:92329B197E5CB7B27E736F661CDB32F92E2340627CA25F68E90B6326554730D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
21
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
488
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6464
msiexec.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6464
msiexec.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHgDGEJFcIpBz28BuO60qVQ%3D
unknown
—
—
whitelisted
6464
msiexec.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
6464
msiexec.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDDIt6H%2BXfAETa93iEg%3D%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
488
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
488
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6464
msiexec.exe
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
whitelisted
3976
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
self.events.data.microsoft.com
  • 20.189.173.7
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wiresock-vpn-client-x64-1.4.7.1.msi