File name:

Splashtop_Business_Win_INSTALLER_v3.7.2.3.msi

Full analysis: https://app.any.run/tasks/e175a421-9519-4aeb-ab14-aff1cf01cfd5
Verdict: Malicious activity
Analysis date: April 29, 2025, 13:50:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 936, Title: Installation Database, Subject: Splashtop Remote Client, Author: Splashtop Inc., Keywords: Installer,MSI,Database, Comments: Splashtop Client Installer, Create Time/Date: Tue Oct 29 14:53:52 2024, Name of Creating Application: InstallShield?2021 27, Security: 1, Template: Intel;0,1033,2052,1028,1036,1031,1040,1041,1042,1046,1049,1034, Last Saved By: Intel;2052, Revision Number: {CE24147F-F177-4370-85CB-39DFC5E7F2C4}3.7.203.0;{CE24147F-F177-4370-85CB-39DFC5E7F2C4}3.7.203.0;{221C0F53-5ACA-4651-8CF7-17046364B94E}, Number of Pages: 200, Number of Characters: 1
MD5:

27487ED4FEFFFD6F8601C3D84D82F549

SHA1:

8D5CEC80A5E6A05339DA0C75ACD8C4FC071996FA

SHA256:

309D3C316D45B6E4A0C3E7A0CBC5686A450A6C74945FBADA0340A4EE8C5AD846

SSDEEP:

393216:CGGTedoatDPTc33WgmmvdFs4QkKGCmXZdkOR+5UMtMrQC+X3+q:CpTed7cxdFs4QkXCmXZCoItzxH+q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 8008)
      • SRUpdateService.exe (PID: 8044)

    • Stops a currently running service

      • sc.exe (PID: 7084)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 7200)
      • msiexec.exe (PID: 2564)
      • ClientUtil.exe (PID: 3976)
      • cmd.exe (PID: 6700)

    • Executing commands from a ".bat" file

      • msiexec.exe (PID: 2564)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 7852)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 7852)

    • Node.exe was dropped

      • msiexec.exe (PID: 7852)

    • Uses WEVTUTIL.EXE to remove publishers and event logs from the manifest

      • cmd.exe (PID: 7644)

    • Executable content was dropped or overwritten

      • ClientUtil.exe (PID: 3976)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • cmd.exe (PID: 904)

    • Application launched itself

      • cmd.exe (PID: 6700)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7580)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7580)

    • Reads the computer name

      • msiexec.exe (PID: 7852)
      • msiexec.exe (PID: 7908)

    • Checks supported languages

      • msiexec.exe (PID: 7852)
      • msiexec.exe (PID: 7908)

    • Reads the software policy settings

      • msiexec.exe (PID: 7580)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7908)
      • msiexec.exe (PID: 7580)
      • msiexec.exe (PID: 7200)
      • msiexec.exe (PID: 7852)
      • msiexec.exe (PID: 2564)

    • The sample compiled with english language support

      • msiexec.exe (PID: 7580)
      • msiexec.exe (PID: 7908)
      • msiexec.exe (PID: 7852)
      • msiexec.exe (PID: 7200)
      • msiexec.exe (PID: 2564)
      • ClientUtil.exe (PID: 3976)

    • Create files in a temporary directory

      • msiexec.exe (PID: 7908)

    • Manages system restore points

      • SrTasks.exe (PID: 2236)

    • Application launched itself

      • msedge.exe (PID: 540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (84.2)
.mst | Windows SDK Setup Transform Script (9.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Characters: -
LastModifiedBy: InstallShield
Words: -
Title: Installation Database
Comments: Splashtop Client Installer
Keywords: Installer,MSI,Database
Subject: Splashtop Remote Client
Author: Splashtop Inc.
Security: Password protected
Pages: 200
Software: InstallShield? 2021 27
ModifyDate: 2024:10:29 14:53:51
CreateDate: 2024:10:29 14:53:51
LastPrinted: 2024:10:29 14:53:51
RevisionNumber: {8BBE7D31-739E-4D59-B06B-48EC2A68B26D}
CodePage: Unknown (0)
Template: Intel;1033,1028,1031,1034,1036,1040,1041,1042,1046,1049,2052
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
324
Monitored processes
195
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe vssvc.exe no specs slui.exe srtasks.exe no specs conhost.exe no specs msiexec.exe _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _isd5cb.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs _ise03c.exe no specs clientutil.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs msiexec.exe _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isef10.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _isfa0e.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs _is2b50.exe no specs clientutil.exe no specs conhost.exe no specs clientutil.exe no specs conhost.exe no specs clientutil.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs _is4e2b.exe no specs ssu_clean.exe no specs clientutil.exe no specs conhost.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is5c16.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs _is607c.exe no specs srupdateservice.exe no specs conhost.exe no specs srupdateservice.exe no specs conhost.exe no specs srupdateservice.exe clientutil.exe no specs conhost.exe no specs strwinclt.exe _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs _is6aca.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132C:\Users\admin\AppData\Local\Temp\{953F008F-E2AF-4C0C-AA71-6ED6AF489061}\_is607C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{42A19ABC-C082-48A0-A4DC-52CCB97EC5B5}C:\Users\admin\AppData\Local\Temp\{953F008F-E2AF-4C0C-AA71-6ED6AF489061}\_is607C.exe—msiexec.exe
User:
SYSTEM
Company:
Flexera
Integrity Level:
SYSTEM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.122
Modules
Images
c:\users\admin\appdata\local\temp\{953f008f-e2af-4c0c-aa71-6ed6af489061}\_is607c.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
540"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.splashtop.com/stb-win-trialC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
strwinclt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616C:\Users\admin\AppData\Local\Temp\{C67B40AD-3060-4CEC-8759-B83A01C916A1}\_is5C16.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7A73275F-1E7B-4DF5-AED1-41FD2134443D}C:\Users\admin\AppData\Local\Temp\{C67B40AD-3060-4CEC-8759-B83A01C916A1}\_is5C16.exe—msiexec.exe
User:
SYSTEM
Company:
Flexera
Integrity Level:
SYSTEM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.122
Modules
Images
c:\users\admin\appdata\local\temp\{c67b40ad-3060-4cec-8759-b83a01c916a1}\_is5c16.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
632C:\Users\admin\AppData\Local\Temp\{FDFBC62B-5C04-400F-8F46-C34592DE06A6}\_isD5CB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A050ABE8-8362-433F-B908-8E94AF08ABEF}C:\Users\admin\AppData\Local\Temp\{FDFBC62B-5C04-400F-8F46-C34592DE06A6}\_isD5CB.exe—msiexec.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.122
Modules
Images
c:\users\admin\appdata\local\temp\{fdfbc62b-5c04-400f-8f46-c34592de06a6}\_isd5cb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
632C:\WINDOWS\system32\cmd.exe /S /D /c" CALL mklink "C:\Program Files (x86)\Splashtop\Splashtop Remote\Client for STB\V4\hotkeyproc.dll" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Client for STB\hotkeyproc.dll""C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
672C:\Users\admin\AppData\Local\Temp\{C67B40AD-3060-4CEC-8759-B83A01C916A1}\_is5C16.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8AACC01D-3085-40C7-8AC0-2CCE3764BCFE}C:\Users\admin\AppData\Local\Temp\{C67B40AD-3060-4CEC-8759-B83A01C916A1}\_is5C16.exe—msiexec.exe
User:
SYSTEM
Company:
Flexera
Integrity Level:
SYSTEM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.122
Modules
Images
c:\users\admin\appdata\local\temp\{c67b40ad-3060-4cec-8759-b83a01c916a1}\_is5c16.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
684C:\WINDOWS\system32\cmd.exe /S /D /c" ECHO F"C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
684\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SRUpdateService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7952 --field-trial-handle=2420,i,16856545727538391946,15450113472385769022,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2376 --field-trial-handle=2420,i,16856545727538391946,15450113472385769022,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
61 173
Read events
60 273
Write events
874
Delete events
26

Modification events

(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000F2994BD50DB9DB01AC1E0000381F0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000F2994BD50DB9DB01AC1E0000381F0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000FC5EF7D50DB9DB01AC1E0000381F0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000FC5EF7D50DB9DB01AC1E0000381F0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000005C1101D60DB9DB01AC1E0000381F0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000C6FE07D60DB9DB01AC1E0000381F0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7852) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000001EF8D4D60DB9DB01AC1E0000381F0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8008) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
48000000000000004A21FBD60DB9DB01481F0000641F0000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8008) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(8008) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
Executable files
196
Suspicious files
558
Text files
127
Unknown types
0

Dropped files

PID
Process
Filename
Type
7852msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
7852msiexec.exeC:\Windows\Installer\11bfe2.msi —
MD5:—
SHA256:—
7580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_9C79DA33A1711362E9D071D2706BB651binary
MD5:D1E040431AFD7E2379F64833898DA325
SHA256:560FF593291C1DBC1BC9A2E51D4A0CF3972A145AC51A1405223A69B68378E72A
7580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:F59BE0E1182F6E3F9D06C9E2B1BEE856
SHA256:BD4592F1B2D0F30332FE8F9989ECC69EC429E73BC9C59F59484ED5C4FA1C0277
7580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:CDB4CBF3BC6C2A316482E7B9ECD54454
SHA256:CA20962C42333B8D409C9D12963A1CAF11882998779319242028D4D03C6511E2
7200msiexec.exeC:\Users\admin\AppData\Local\Temp\{FDFBC62B-5C04-400F-8F46-C34592DE06A6}\ISRT.dllexecutable
MD5:85315AD538FA5AF8162F1CD2FCE1C99D
SHA256:70735B13F629F247D6AF2BE567F2DA8112039FBCED5FBB37961E53A2A3EC1EC7
7852msiexec.exeC:\Windows\Installer\MSID36A.tmpexecutable
MD5:86DD87C7ABD8582D9FA3906435F263EE
SHA256:537D1DBDBB95F90DE1F4E104D6E5D5A27D233B362AFF771E4C11660641803800
7200msiexec.exeC:\Users\admin\AppData\Local\Temp\{FDFBC62B-5C04-400F-8F46-C34592DE06A6}\setup.inxbinary
MD5:559E46B48ACE152340EFC790AF6E0DD0
SHA256:7C51262A10596420607732688E2AF0C6D4A3C0950701C22A17EA102720770F43
7852msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{5f09ceb9-65eb-4a1b-b945-841659990448}_OnDiskSnapshotPropbinary
MD5:3B72046F974A860F454F1467A95332E6
SHA256:7AFDF612E7F4917290AE71173BB62902A7858C2CFC3D627A67ECC220748A0F00
7200msiexec.exeC:\Users\admin\AppData\Local\Temp\{FDFBC62B-5C04-400F-8F46-C34592DE06A6}\IsConfig.initext
MD5:9FA2A198E47E353CAA603C795A8F9C1C
SHA256:1C403218FD0B2236C0E9FDEF576258619F44274ADF85D6C27E8F0C81B98C3B3E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
157
TCP/UDP connections
237
DNS requests
177
Threats
62

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
172.202.163.200:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
172.202.163.200:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7580
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
7580
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
7580
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAx%2B7MjF4dH7UpJWotMQ8HE%3D
unknown
—
—
whitelisted
7588
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7588
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
13.85.23.206:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.66
  • 20.190.160.67
  • 40.126.32.74
  • 40.126.32.76
  • 40.126.32.140
  • 20.190.160.130
  • 20.190.160.131
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO Splashtop Domain in DNS Lookup (splashtop .com)
7792
strwinclt.exe
Misc activity
ET INFO Splashtop Domain (splashtop .com) in TLS SNI
3028
msedge.exe
Misc activity
ET INFO Splashtop Domain in DNS Lookup (splashtop .com)
3028
msedge.exe
Misc activity
ET INFO Splashtop Domain in DNS Lookup (splashtop .com)
3028
msedge.exe
Misc activity
ET INFO Splashtop Domain (splashtop .com) in TLS SNI
7792
strwinclt.exe
Misc activity
ET INFO Splashtop Domain (splashtop .com) in TLS SNI
3028
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
3028
msedge.exe
Misc activity
ET INFO Splashtop Domain (splashtop .com) in TLS SNI
3028
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2196
svchost.exe
Misc activity
ET INFO Splashtop Domain in DNS Lookup (splashtop .com)
Process
Message
SRUpdateService.exe
[ClientService][8044:7964]2025-04-29 13:52:52 StartService Begin Err:0
SRUpdateService.exe
[ClientService][8044:3784]2025-04-29 13:52:52 SetStatus to 2, err(0) Err:0
SRUpdateService.exe
[ClientService][8044:3784]2025-04-29 13:52:52 Run! Err:3
SRUpdateService.exe
[ClientService][8044:3784]2025-04-29 13:52:52 SetStatus to 4, err(3) Err:3
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Splashtop_Business_Win_INSTALLER_v3.7.2.3.msi