File name:

Splashtop_Business_Win_INSTALLER_v3.7.2.3.msi

Full analysis: https://app.any.run/tasks/e175a421-9519-4aeb-ab14-aff1cf01cfd5
Verdict: Malicious activity
Analysis date: April 29, 2025, 13:50:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 936, Title: Installation Database, Subject: Splashtop Remote Client, Author: Splashtop Inc., Keywords: Installer,MSI,Database, Comments: Splashtop Client Installer, Create Time/Date: Tue Oct 29 14:53:52 2024, Name of Creating Application: InstallShield?2021 27, Security: 1, Template: Intel;0,1033,2052,1028,1036,1031,1040,1041,1042,1046,1049,1034, Last Saved By: Intel;2052, Revision Number: {CE24147F-F177-4370-85CB-39DFC5E7F2C4}3.7.203.0;{CE24147F-F177-4370-85CB-39DFC5E7F2C4}3.7.203.0;{221C0F53-5ACA-4651-8CF7-17046364B94E}, Number of Pages: 200, Number of Characters: 1
MD5:

27487ED4FEFFFD6F8601C3D84D82F549

SHA1:

8D5CEC80A5E6A05339DA0C75ACD8C4FC071996FA

SHA256:

309D3C316D45B6E4A0C3E7A0CBC5686A450A6C74945FBADA0340A4EE8C5AD846

SSDEEP:

393216:CGGTedoatDPTc33WgmmvdFs4QkKGCmXZdkOR+5UMtMrQC+X3+q:CpTed7cxdFs4QkXCmXZCoItzxH+q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 8008)
      • SRUpdateService.exe (PID: 8044)

    • Starts CMD.EXE for commands execution

      • ClientUtil.exe (PID: 3976)
      • msiexec.exe (PID: 7200)
      • msiexec.exe (PID: 2564)
      • cmd.exe (PID: 6700)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 7852)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 7852)

    • Node.exe was dropped

      • msiexec.exe (PID: 7852)

    • Uses WEVTUTIL.EXE to remove publishers and event logs from the manifest

      • cmd.exe (PID: 7644)

    • Executable content was dropped or overwritten

      • ClientUtil.exe (PID: 3976)

    • Stops a currently running service

      • sc.exe (PID: 7084)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • cmd.exe (PID: 904)

    • Executing commands from a ".bat" file

      • msiexec.exe (PID: 2564)

    • Application launched itself

      • cmd.exe (PID: 6700)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7580)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7580)

    • Reads the computer name

      • msiexec.exe (PID: 7852)
      • msiexec.exe (PID: 7908)

    • Reads the software policy settings

      • msiexec.exe (PID: 7580)

    • Checks supported languages

      • msiexec.exe (PID: 7852)
      • msiexec.exe (PID: 7908)

    • The sample compiled with english language support

      • msiexec.exe (PID: 7580)
      • msiexec.exe (PID: 7908)
      • msiexec.exe (PID: 2564)
      • ClientUtil.exe (PID: 3976)
      • msiexec.exe (PID: 7852)
      • msiexec.exe (PID: 7200)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7908)
      • msiexec.exe (PID: 7580)
      • msiexec.exe (PID: 7852)
      • msiexec.exe (PID: 7200)
      • msiexec.exe (PID: 2564)

    • Create files in a temporary directory

      • msiexec.exe (PID: 7908)

    • Manages system restore points

      • SrTasks.exe (PID: 2236)

    • Application launched itself

      • msedge.exe (PID: 540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (84.2)
.mst | Windows SDK Setup Transform Script (9.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Characters: -
LastModifiedBy: InstallShield
Words: -
Title: Installation Database
Comments: Splashtop Client Installer
Keywords: Installer,MSI,Database
Subject: Splashtop Remote Client
Author: Splashtop Inc.
Security: Password protected
Pages: 200
Software: InstallShield? 2021 27
ModifyDate: 2024:10:29 14:53:51
CreateDate: 2024:10:29 14:53:51
LastPrinted: 2024:10:29 14:53:51
RevisionNumber: {8BBE7D31-739E-4D59-B06B-48EC2A68B26D}
CodePage: Unknown (0)
Template: Intel;1033,1028,1031,1034,1036,1040,1041,1042,1046,1049,2052
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
324
Monitored processes
195
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe vssvc.exe no specs slui.exe srtasks.exe no specs conhost.exe no specs msiexec.exe _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs clientutil.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs msiexec.exe _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs clientutil.exe no specs conhost.exe no specs clientutil.exe no specs conhost.exe no specs clientutil.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs ssu_clean.exe no specs clientutil.exe no specs conhost.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs srupdateservice.exe no specs conhost.exe no specs srupdateservice.exe no specs conhost.exe no specs srupdateservice.exe clientutil.exe no specs conhost.exe no specs strwinclt.exe _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132C:\Users\admin\AppData\Local\Temp\{953F008F-E2AF-4C0C-AA71-6ED6AF489061}\_is607C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{42A19ABC-C082-48A0-A4DC-52CCB97EC5B5}C:\Users\admin\AppData\Local\Temp\{953F008F-E2AF-4C0C-AA71-6ED6AF489061}\_is607C.exe—msiexec.exe
User:
SYSTEM
Company:
Flexera
Integrity Level:
SYSTEM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.122
Modules
Images
c:\users\admin\appdata\local\temp\{953f008f-e2af-4c0c-aa71-6ed6af489061}\_is607c.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
540"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.splashtop.com/stb-win-trialC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
strwinclt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616C:\Users\admin\AppData\Local\Temp\{C67B40AD-3060-4CEC-8759-B83A01C916A1}\_is5C16.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7A73275F-1E7B-4DF5-AED1-41FD2134443D}C:\Users\admin\AppData\Local\Temp\{C67B40AD-3060-4CEC-8759-B83A01C916A1}\_is5C16.exe—msiexec.exe
User:
SYSTEM
Company:
Flexera
Integrity Level:
SYSTEM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.122
Modules
Images
c:\users\admin\appdata\local\temp\{c67b40ad-3060-4cec-8759-b83a01c916a1}\_is5c16.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
632C:\Users\admin\AppData\Local\Temp\{FDFBC62B-5C04-400F-8F46-C34592DE06A6}\_isD5CB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A050ABE8-8362-433F-B908-8E94AF08ABEF}C:\Users\admin\AppData\Local\Temp\{FDFBC62B-5C04-400F-8F46-C34592DE06A6}\_isD5CB.exe—msiexec.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.122
Modules
Images
c:\users\admin\appdata\local\temp\{fdfbc62b-5c04-400f-8f46-c34592de06a6}\_isd5cb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
632C:\WINDOWS\system32\cmd.exe /S /D /c" CALL mklink "C:\Program Files (x86)\Splashtop\Splashtop Remote\Client for STB\V4\hotkeyproc.dll" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Client for STB\hotkeyproc.dll""C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
672C:\Users\admin\AppData\Local\Temp\{C67B40AD-3060-4CEC-8759-B83A01C916A1}\_is5C16.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8AACC01D-3085-40C7-8AC0-2CCE3764BCFE}C:\Users\admin\AppData\Local\Temp\{C67B40AD-3060-4CEC-8759-B83A01C916A1}\_is5C16.exe—msiexec.exe
User:
SYSTEM
Company:
Flexera
Integrity Level:
SYSTEM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.122
Modules
Images
c:\users\admin\appdata\local\temp\{c67b40ad-3060-4cec-8759-b83a01c916a1}\_is5c16.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
684C:\WINDOWS\system32\cmd.exe /S /D /c" ECHO F"C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
684\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SRUpdateService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7952 --field-trial-handle=2420,i,16856545727538391946,15450113472385769022,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2376 --field-trial-handle=2420,i,16856545727538391946,15450113472385769022,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
61 173
Read events
60 273
Write events
874
Delete events
26

Modification events

(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000F2994BD50DB9DB01AC1E0000381F0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000F2994BD50DB9DB01AC1E0000381F0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000FC5EF7D50DB9DB01AC1E0000381F0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000FC5EF7D50DB9DB01AC1E0000381F0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000005C1101D60DB9DB01AC1E0000381F0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000C6FE07D60DB9DB01AC1E0000381F0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000001EF8D4D60DB9DB01AC1E0000381F0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8008) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
48000000000000004A21FBD60DB9DB01481F0000641F0000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8008) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(8008) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
Executable files
196
Suspicious files
558
Text files
127
Unknown types
0

Dropped files

PID
Process
Filename
Type
7852msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
7852msiexec.exeC:\Windows\Installer\11bfe2.msi —
MD5:—
SHA256:—
7580msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI3779.tmpexecutable
MD5:E80F90724939D4F85FC49DE2460B94B5
SHA256:8041D3CCBAFA491D35F70030C3AFEBA683B0235BED24F242878D04C7E87B8687
7580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_9C79DA33A1711362E9D071D2706BB651binary
MD5:D1E040431AFD7E2379F64833898DA325
SHA256:560FF593291C1DBC1BC9A2E51D4A0CF3972A145AC51A1405223A69B68378E72A
7908msiexec.exeC:\Users\admin\AppData\Local\Temp\{18C75354-A84E-4B0D-B1C0-4E033A4E8408}\Description.xmlxml
MD5:DB652FE052A41D46E204117799D3B613
SHA256:A45FB14A4BA17E523DA67995B052EA15176261DC65A12B2E875F9F4EE845BB32
7580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:2ED561D953559FC6459EDB2AD1276254
SHA256:73CEEB2CBA87C800169DFE2B114F2265D8D8E9707CA2B009F2DE131B8386DE9A
7580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_9C79DA33A1711362E9D071D2706BB651binary
MD5:86FFC8D93B8A6E5AB36728DD34B0F070
SHA256:1D1964277B161147460B0E15AE47FF9CD90D34097622BF1F23A34721BD61B54B
7852msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:3B72046F974A860F454F1467A95332E6
SHA256:7AFDF612E7F4917290AE71173BB62902A7858C2CFC3D627A67ECC220748A0F00
7580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:CDB4CBF3BC6C2A316482E7B9ECD54454
SHA256:CA20962C42333B8D409C9D12963A1CAF11882998779319242028D4D03C6511E2
7852msiexec.exeC:\Windows\Installer\MSID36A.tmpexecutable
MD5:86DD87C7ABD8582D9FA3906435F263EE
SHA256:537D1DBDBB95F90DE1F4E104D6E5D5A27D233B362AFF771E4C11660641803800
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
157
TCP/UDP connections
237
DNS requests
177
Threats
62

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
172.202.163.200:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
—
—
GET
200
172.202.163.200:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
7580
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
7580
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
7580
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAx%2B7MjF4dH7UpJWotMQ8HE%3D
unknown
—
—
whitelisted
7588
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7588
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
200
172.202.163.200:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.66
  • 20.190.160.67
  • 40.126.32.74
  • 40.126.32.76
  • 40.126.32.140
  • 20.190.160.130
  • 20.190.160.131
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO Splashtop Domain in DNS Lookup (splashtop .com)
7792
strwinclt.exe
Misc activity
ET INFO Splashtop Domain (splashtop .com) in TLS SNI
3028
msedge.exe
Misc activity
ET INFO Splashtop Domain in DNS Lookup (splashtop .com)
3028
msedge.exe
Misc activity
ET INFO Splashtop Domain in DNS Lookup (splashtop .com)
3028
msedge.exe
Misc activity
ET INFO Splashtop Domain (splashtop .com) in TLS SNI
7792
strwinclt.exe
Misc activity
ET INFO Splashtop Domain (splashtop .com) in TLS SNI
3028
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
3028
msedge.exe
Misc activity
ET INFO Splashtop Domain (splashtop .com) in TLS SNI
3028
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2196
svchost.exe
Misc activity
ET INFO Splashtop Domain in DNS Lookup (splashtop .com)
Process
Message
SRUpdateService.exe
[ClientService][8044:7964]2025-04-29 13:52:52 StartService Begin Err:0
SRUpdateService.exe
[ClientService][8044:3784]2025-04-29 13:52:52 SetStatus to 2, err(0) Err:0
SRUpdateService.exe
[ClientService][8044:3784]2025-04-29 13:52:52 Run! Err:3
SRUpdateService.exe
[ClientService][8044:3784]2025-04-29 13:52:52 SetStatus to 4, err(3) Err:3
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Splashtop_Business_Win_INSTALLER_v3.7.2.3.msi