File name:

TesseraReplicationInstaller.exe

Full analysis: https://app.any.run/tasks/113192d6-ce30-444d-b328-24437d415513
Verdict: Malicious activity
Analysis date: May 30, 2025, 14:16:28
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

BE34A3F32D757E519DBE2CBBBB0F730E

SHA1:

EAD2B1B6B3D0E4F27C08F0A8431E80EFB888401C

SHA256:

2551BFD8E9040178190E58065CE224D9CF7535C94717C77CA0B2BC308FDCAEFD

SSDEEP:

768:Vux/JqbIwoUQnioUQ8/wfagStbjkNkkLjEni8JvmaXn0kls09JytBJoAfb3:c6bOtaVhWkkFKm+0ku09JoBJx3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 7752)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 7752)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • powershell.exe (PID: 7752)

    • Executing commands from a ".bat" file

      • TesseraReplicationInstaller.exe (PID: 7524)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 7752)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 7752)

    • Creates a directory (POWERSHELL)

      • powershell.exe (PID: 7752)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7752)

    • Starts CMD.EXE for commands execution

      • TesseraReplicationInstaller.exe (PID: 7524)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 7752)
      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)

    • Searches for installed software

      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)
      • choco.exe (PID: 5036)

    • Reads security settings of Internet Explorer

      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)

    • The system shut down or reboot

      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)
      • choco.exe (PID: 5036)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 7752)

    • Drops 7-zip archiver for unpacking

      • powershell.exe (PID: 7752)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 7752)

  • INFO

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7752)

    • The sample compiled with english language support

      • powershell.exe (PID: 7752)

    • Creates files in the program directory

      • powershell.exe (PID: 7752)
      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)
      • choco.exe (PID: 5036)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7752)

    • Disables trace logs

      • powershell.exe (PID: 7752)
      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)

    • Checks proxy server information

      • powershell.exe (PID: 7752)
      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)
      • choco.exe (PID: 5036)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7752)

    • Checks supported languages

      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)
      • choco.exe (PID: 8188)
      • choco.exe (PID: 5036)

    • Reads the software policy settings

      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)
      • choco.exe (PID: 5036)

    • Reads Environment values

      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)
      • choco.exe (PID: 5036)

    • Create files in a temporary directory

      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)
      • choco.exe (PID: 5036)

    • Reads the machine GUID from the registry

      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)
      • choco.exe (PID: 5036)

    • Reads the computer name

      • choco.exe (PID: 4724)
      • choco.exe (PID: 7512)
      • choco.exe (PID: 5036)

    • Process checks Powershell version

      • choco.exe (PID: 4724)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 7752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:11:18 18:41:55+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 22016
InitializedDataSize: 13312
UninitializedDataSize: -
EntryPoint: 0x643f
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.20.0.0
ProductVersionNumber: 9.20.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Igor Pavlov
FileDescription: 7z Setup SFX small
FileVersion: 9.2
InternalName: 7zS2.sfx
LegalCopyright: Copyright (c) 1999-2010 Igor Pavlov
OriginalFileName: 7zS2.sfx.exe
ProductName: 7-Zip
ProductVersion: 9.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
19
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start tesserareplicationinstaller.exe cmd.exe no specs sppextcomobj.exe no specs slui.exe powershell.exe choco.exe choco.exe choco.exe no specs choco.exe shutdown.exe no specs conhost.exe no specs shutdown.exe no specs conhost.exe no specs shutdown.exe no specs conhost.exe no specs shutdown.exe no specs conhost.exe no specs slui.exe no specs tesserareplicationinstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2064"C:\WINDOWS\System32\shutdown.exe" /aC:\Windows\System32\shutdown.exe—choco.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Shutdown and Annotation Tool
Exit code:
1116
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shutdownext.dll
3100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—shutdown.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4192"C:\WINDOWS\System32\shutdown.exe" /aC:\Windows\System32\shutdown.exe—choco.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Shutdown and Annotation Tool
Exit code:
1116
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shutdownext.dll
4724"C:\ProgramData\chocolatey\choco.exe" install -y dotnetfxC:\ProgramData\chocolatey\choco.exe
choco.exe
User:
admin
Company:
Chocolatey Software, Inc.
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
2.4.3.0
Modules
Images
c:\programdata\chocolatey\choco.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5036"C:\ProgramData\chocolatey\choco.exe" install -y python --version=3.8.10C:\ProgramData\chocolatey\choco.exe
choco.exe
User:
admin
Company:
Chocolatey Software, Inc.
Integrity Level:
HIGH
Description:
Exit code:
4294967295
Version:
2.4.3.0
Modules
Images
c:\programdata\chocolatey\choco.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5728"C:\WINDOWS\System32\shutdown.exe" /aC:\Windows\System32\shutdown.exe—choco.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Shutdown and Annotation Tool
Exit code:
1116
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shutdownext.dll
6944\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—shutdown.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7000C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7316\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—shutdown.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7444"C:\Users\admin\AppData\Local\Temp\TesseraReplicationInstaller.exe" C:\Users\admin\AppData\Local\Temp\TesseraReplicationInstaller.exe—explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7z Setup SFX small
Exit code:
3221226540
Version:
9.20
Modules
Images
c:\users\admin\appdata\local\temp\tesserareplicationinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
72 252
Read events
72 223
Write events
28
Delete events
1

Modification events

(PID) Process:(7752) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7752) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7752) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7752) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7752) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7752) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7752) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7752) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7752) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7752) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
15
Suspicious files
34
Text files
384
Unknown types
22

Dropped files

PID
Process
Filename
Type
7524TesseraReplicationInstaller.exeC:\Users\admin\AppData\Local\Temp\7z0DC1ED64\install.ps1text
MD5:EEA1F038D28A1AD90A2508F8C961BCFE
SHA256:79AFADE7D85069EB7FCD61675E5EBB414690CD89AE281A90E025C9A7A139969D
7524TesseraReplicationInstaller.exeC:\Users\admin\AppData\Local\Temp\7z0DC1ED64\config\.DS_Storeds_store
MD5:194577A7E20BDCC7AFBB718F502C134C
SHA256:D65165279105CA6773180500688DF4BDC69A2C7B771752F0A46EF120B7FD8EC3
7524TesseraReplicationInstaller.exeC:\Users\admin\AppData\Local\Temp\7z0DC1ED64\scripts\query_and_write_tessera_data.pytext
MD5:D2A37582601FF6A79D6F8D7DE4E75AA9
SHA256:B65E0C4B77B5BF732359C87F95E9368D906E1F196F9CE101CF58E83779FAD14F
7524TesseraReplicationInstaller.exeC:\Users\admin\AppData\Local\Temp\7z0DC1ED64\scripts\adhoc_process_tessera_ticket_queue.pytext
MD5:A4F04057E20AEABB764B9C0F3342B7F6
SHA256:9D817316F6123162AE39BC8B91B436A16A9868970649AEF70E53A82F83746EDB
7524TesseraReplicationInstaller.exeC:\Users\admin\AppData\Local\Temp\7z0DC1ED64\install.battext
MD5:BABA9133212C1AA4F4746EA95DF42E8A
SHA256:E6931681FABEA51836093EE8126C809242A09F4831F15A921136A8A9CC15691C
7524TesseraReplicationInstaller.exeC:\Users\admin\AppData\Local\Temp\7z0DC1ED64\requirements.txttext
MD5:D62AE5A9D67F305CEBAF1531CB817D48
SHA256:5C1E465E8EB66EF52DBD65DDB87480E284939BCC51F3DCB2D034042DE1C35AF4
7524TesseraReplicationInstaller.exeC:\Users\admin\AppData\Local\Temp\7z0DC1ED64\scripts\.DS_Storeds_store
MD5:194577A7E20BDCC7AFBB718F502C134C
SHA256:D65165279105CA6773180500688DF4BDC69A2C7B771752F0A46EF120B7FD8EC3
7524TesseraReplicationInstaller.exeC:\Users\admin\AppData\Local\Temp\7z0DC1ED64\scripts\adhoc_query_and_write_tessera_data.pytext
MD5:85A7410D5E291E5397145E9911D2C04D
SHA256:630AE7E0CC0A3E2473B57CF648326808991D912F1C67267F72BCA5D539F4A24D
7524TesseraReplicationInstaller.exeC:\Users\admin\AppData\Local\Temp\7z0DC1ED64\scripts\process_tessera_ticket_queue.pytext
MD5:2788B25A96C1945DF4F009FDB022C210
SHA256:D18499A41CC0A7F62DFCA5BA07F700863B92066262E450CD48464566841F21B8
7524TesseraReplicationInstaller.exeC:\Users\admin\AppData\Local\Temp\7z0DC1ED64\scripts\generate_queue_and_messages.pytext
MD5:EE0D8FAE39A54F1B5EA10756332C9DF4
SHA256:74FBEEC4C7DE6B7CD39ECDF8A63DE4935C826D7FB86C77CBAD10CCB5472A2495
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
30
DNS requests
14
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4724
choco.exe
GET
301
104.18.21.76:80
http://community.chocolatey.org/api/v2/FindPackagesById?id='chocolatey-dotnetfx.extension'&$skiptoken='1746589763233','1.0.0','chocolatey-dotnetfx.extension'
unknown
—
—
whitelisted
4724
choco.exe
GET
301
104.18.21.76:80
http://community.chocolatey.org/api/v2/FindPackagesById?id='kb2919355'&$skiptoken='1747307069917','1.0.20160719','kb2919355'
unknown
—
—
whitelisted
4724
choco.exe
GET
301
104.18.21.76:80
http://community.chocolatey.org/api/v2/FindPackagesById?id='kb2919442'&$skiptoken='1747307069917','1.0.20160719','kb2919442'
unknown
—
—
whitelisted
7428
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7512
choco.exe
GET
301
104.18.21.76:80
http://community.chocolatey.org/api/v2/FindPackagesById?id='erlang'&$skiptoken='1743261558977','19.1.0','erlang'
unknown
—
—
whitelisted
7512
choco.exe
GET
301
104.18.21.76:80
http://community.chocolatey.org/api/v2/FindPackagesById?id='erlang'&$skiptoken='1746502468693','17.1.0','erlang'
unknown
—
—
whitelisted
5036
choco.exe
GET
301
104.18.21.76:80
http://community.chocolatey.org/api/v2/FindPackagesById?id='vcredist2015'&$skiptoken='1746654570820','14.0.23918','vcredist2015'
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2112
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7752
powershell.exe
104.18.21.76:443
community.chocolatey.org
CLOUDFLARENET
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7752
powershell.exe
104.18.20.76:443
community.chocolatey.org
CLOUDFLARENET
—
whitelisted
6544
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
google.com
  • 142.250.185.110
whitelisted
community.chocolatey.org
  • 104.18.21.76
  • 104.18.20.76
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
packages.chocolatey.org
  • 104.18.20.76
  • 104.18.21.76
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.5
  • 40.126.32.136
  • 40.126.32.134
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.72
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

PID
Process
Class
Message
7752
powershell.exe
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
4724
choco.exe
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
7512
choco.exe
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
5036
choco.exe
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TesseraReplicationInstaller.exe