File name:

tailscale-setup-1.82.5 (1).exe

Full analysis: https://app.any.run/tasks/b3fe03ec-9e0a-4899-93ab-f9e2d1a29ad6
Verdict: Malicious activity
Analysis date: May 19, 2025, 05:42:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

89853BC4158780D81EA21ECFE67CE1DB

SHA1:

3002461CC01BBE0E85CA02B696F8A82AF0833028

SHA256:

4C8281F93CE2AA1FE6E4AD220E454C8F768DA8DA7291431D1CDEBA79EF8BB033

SSDEEP:

49152:Plm5TWpJNg8NH02yKKqPlRcAwXzmKto6OtOU:PlyTSNHO/KX5Ammo6Ot

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • tailscale-setup-1.82.5 (1).exe (PID: 6564)
      • tailscale-setup-1.82.5.exe (PID: 6392)
      • tailscaled.exe (PID: 1512)
      • drvinst.exe (PID: 5556)

    • Searches for installed software

      • tailscale-setup-1.82.5 (1).exe (PID: 6564)
      • tailscale-setup-1.82.5.exe (PID: 6392)
      • dllhost.exe (PID: 6132)

    • Reads security settings of Internet Explorer

      • tailscale-setup-1.82.5 (1).exe (PID: 6564)

    • Starts itself from another location

      • tailscale-setup-1.82.5 (1).exe (PID: 6564)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1672)
      • tailscaled.exe (PID: 2040)

    • Starts SC.EXE for service management

      • msiexec.exe (PID: 5352)

    • Restarts service on failure

      • sc.exe (PID: 5204)

    • Application launched itself

      • tailscaled.exe (PID: 2040)
      • msiexec.exe (PID: 6540)

    • Drops a system driver (possible attempt to evade defenses)

      • tailscaled.exe (PID: 1512)
      • drvinst.exe (PID: 5556)

    • Process uses IPCONFIG to clear DNS cache

      • tailscaled.exe (PID: 1512)

    • Process uses IPCONFIG to get network configuration information

      • tailscaled.exe (PID: 1512)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • tailscaled.exe (PID: 1512)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • tailscaled.exe (PID: 1512)

  • INFO

    • The sample compiled with english language support

      • tailscale-setup-1.82.5 (1).exe (PID: 6564)
      • tailscale-setup-1.82.5.exe (PID: 6392)
      • msiexec.exe (PID: 6540)
      • tailscaled.exe (PID: 1512)
      • drvinst.exe (PID: 5556)

    • Checks supported languages

      • tailscale-setup-1.82.5 (1).exe (PID: 6564)
      • wixstdba.exe (PID: 4400)
      • tailscale-setup-1.82.5.exe (PID: 6392)

    • Create files in a temporary directory

      • tailscale-setup-1.82.5 (1).exe (PID: 6564)
      • tailscale-setup-1.82.5.exe (PID: 6392)

    • Reads the computer name

      • tailscale-setup-1.82.5 (1).exe (PID: 6564)
      • wixstdba.exe (PID: 4400)
      • tailscale-setup-1.82.5.exe (PID: 6392)

    • Process checks computer location settings

      • tailscale-setup-1.82.5 (1).exe (PID: 6564)

    • Manages system restore points

      • SrTasks.exe (PID: 6112)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6540)

    • Manual execution by a user

      • msedge.exe (PID: 8108)

    • Application launched itself

      • msedge.exe (PID: 7840)
      • msedge.exe (PID: 8108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:04 21:45:43+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.41
CodeSize: 486912
InitializedDataSize: 425984
UninitializedDataSize: -
EntryPoint: 0x51ce0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.82.5.0
ProductVersionNumber: 1.82.5.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: Tailscale Inc.
FileDescription: Tailscale
FileVersion: 1.82.5
InternalName: burn
OriginalFileName: tailscale-setup-1.82.5.exe
ProductName: Tailscale
ProductVersion: 1.82.5
LegalCopyright: Copyright (c) Tailscale Inc.. All rights reserved.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
221
Monitored processes
80
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start tailscale-setup-1.82.5 (1).exe wixstdba.exe no specs sppextcomobj.exe no specs slui.exe no specs tailscale-setup-1.82.5.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe msiexec.exe no specs tailscale-ipn.exe no specs msiexec.exe no specs sc.exe no specs conhost.exe no specs tailscaled.exe tailscaled.exe drvinst.exe drvinst.exe no specs tailscale-ipn.exe netsh.exe no specs wsl.exe no specs conhost.exe no specs ipconfig.exe no specs netsh.exe no specs ipconfig.exe no specs ipconfig.exe no specs netsh.exe no specs slui.exe ipconfig.exe no specs ipconfig.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs netsh.exe no specs ipconfig.exe no specs netsh.exe no specs ipconfig.exe no specs ipconfig.exe no specs ipconfig.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
928"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6148 --field-trial-handle=2464,i,12082114707657132487,15668166864261234204,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1184DrvInst.exe "1" "0" "SWD\Wintun\{37217669-42DA-4657-A55B-0D995D328250}" "" "" "43f7a302b" "0000000000000000"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1512"C:\Program Files\Tailscale\tailscaled.exe" /subproc ede63201d658cd58d94cbe05d9fecc9c1f8dbf0498efc37881d53349429dad3aC:\Program Files\Tailscale\tailscaled.exe
tailscaled.exe
User:
SYSTEM
Company:
Tailscale Inc.
Integrity Level:
SYSTEM
Description:
Tailscale service
Version:
1.82.5-tdec88625e-gec2eb9730
Modules
Images
c:\program files\tailscale\tailscaled.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
c:\windows\system32\secur32.dll
1540\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—wsl.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1660C:\WINDOWS\system32\netsh.exe advfirewall firewall add rule name=Tailscale-In dir=in action=allow localip=100.89.89.16/32 profile=private,domain enable=yesC:\Windows\System32\netsh.exe—tailscaled.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1672C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1852"C:\Program Files\Tailscale\tailscale-ipn.exe" C:\Program Files\Tailscale\tailscale-ipn.exe
msiexec.exe
User:
admin
Company:
Tailscale Inc.
Integrity Level:
HIGH
Description:
Tailscale GUI client
Version:
1.82.5-tdec88625e-gec2eb9730
Modules
Images
c:\program files\tailscale\tailscale-ipn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
c:\windows\system32\secur32.dll
2040"C:\Program Files\Tailscale\tailscaled.exe"C:\Program Files\Tailscale\tailscaled.exe
services.exe
User:
SYSTEM
Company:
Tailscale Inc.
Integrity Level:
SYSTEM
Description:
Tailscale service
Version:
1.82.5-tdec88625e-gec2eb9730
Modules
Images
c:\program files\tailscale\tailscaled.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
c:\windows\system32\secur32.dll
2772"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3004 --field-trial-handle=2464,i,12082114707657132487,15668166864261234204,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2896ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—tailscaled.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
IP Configuration Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\dhcpcsvc.dll
Total events
39 179
Read events
38 211
Write events
922
Delete events
46

Modification events

(PID) Process:(6392) tailscale-setup-1.82.5.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000F2A11ECE80C8DB01F8180000E4060000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6132) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000F2A11ECE80C8DB01F417000080180000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6132) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000C3B96FCE80C8DB01F417000080180000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6132) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000C3B96FCE80C8DB01F417000080180000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6132) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000A81C72CE80C8DB01F417000080180000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6132) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000005BD476CE80C8DB01F417000080180000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6132) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6132) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000002D0AEECE80C8DB01F417000080180000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6132) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000072C0F0CE80C8DB01F417000004180000E8030000010000000000000000000000CBB92D76C5F44A4B8C84A619A4CBF6EC00000000000000000000000000000000
(PID) Process:(1672) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
Executable files
23
Suspicious files
222
Text files
49
Unknown types
1

Dropped files

PID
Process
Filename
Type
6132dllhost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6564tailscale-setup-1.82.5 (1).exeC:\Users\admin\AppData\Local\Temp\{62C53E24-D0B2-4810-8792-E19DA3DF7C87}\MsiAMD64 —
MD5:—
SHA256:—
6392tailscale-setup-1.82.5.exeC:\ProgramData\Package Cache\.unverified\MsiAMD64 —
MD5:—
SHA256:—
6392tailscale-setup-1.82.5.exeC:\ProgramData\Package Cache\{FBEE31A9-B949-50D2-846E-8323048A6885}v1.82.5\tailscale-setup-1.82.5-amd64.msi —
MD5:—
SHA256:—
6540msiexec.exeC:\Windows\Installer\115205.msi —
MD5:—
SHA256:—
6564tailscale-setup-1.82.5 (1).exeC:\Users\admin\AppData\Local\Temp\{62C53E24-D0B2-4810-8792-E19DA3DF7C87}\.ba\wixstdba.exeexecutable
MD5:773CCB94EC7DB9F315A6ADEC1F2A55FF
SHA256:2F077592FD4B9799A23444B5CBB6E45995E97372BFFE6143411F5F2AE7FFC4C7
6564tailscale-setup-1.82.5 (1).exeC:\Users\admin\AppData\Local\Temp\{62C53E24-D0B2-4810-8792-E19DA3DF7C87}\.ba\logo.pngimage
MD5:0005BDF4D4008128DEF29442C0DE88C0
SHA256:3D2CE10E1F81C9EC4F4188E7622B4ED776DEEBB72B124362FD028B40BA53AAFA
6564tailscale-setup-1.82.5 (1).exeC:\Users\admin\AppData\Local\Temp\{62C53E24-D0B2-4810-8792-E19DA3DF7C87}\.ba\BootstrapperApplicationData.xmlxml
MD5:E383946599BEF8498D431E05062CC579
SHA256:1F01D5CF570E111959C4D73CD3BDB0CC3162BD7E0DE5816DE62FF998D448032C
6564tailscale-setup-1.82.5 (1).exeC:\Users\admin\AppData\Local\Temp\{62C53E24-D0B2-4810-8792-E19DA3DF7C87}\.ba\thm.xmlxml
MD5:2B1EC08EEF7ECFBE7BC2B4250A59F144
SHA256:90466C5E24EFFB000BC7C38A5A8D8B5C65442D8D16AFAC5A9938480846E50477
6132dllhost.exeC:\System Volume Information\SPP\OnlineMetadataCache\{762db9cb-f4c5-4b4a-8c84-a619a4cbf6ec}_OnDiskSnapshotPropbinary
MD5:A90D60277089FCF8104BA3E4209145E4
SHA256:33E04762972D88F217A16D4F997618F95E814F24D3103F896ABC09D6BE37E761
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
154
DNS requests
64
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6512
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6564
tailscale-setup-1.82.5 (1).exe
GET
200
2.23.197.184:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6512
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6564
tailscale-setup-1.82.5 (1).exe
GET
200
18.66.147.103:80
http://e6.c.lencr.org/48.crl
unknown
—
—
whitelisted
6564
tailscale-setup-1.82.5 (1).exe
GET
200
2.16.168.113:80
http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2ttjyD6VkMQQUDcXM%2FZvuFAWhTDCCpT5eisNYCdICEgZu2USyFmWnKfzGFk3cn6euoQ%3D%3D
unknown
—
—
whitelisted
6540
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
6540
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAGSuURxj1Rlh15b2U5S69o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.42
  • 23.216.77.20
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
google.com
  • 172.217.18.14
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.76
  • 20.190.160.4
  • 20.190.160.130
  • 20.190.160.20
  • 20.190.160.22
  • 20.190.160.132
  • 40.126.32.74
  • 40.126.31.130
  • 40.126.31.1
  • 20.190.159.130
  • 20.190.159.4
  • 40.126.31.3
  • 40.126.31.128
  • 20.190.159.68
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
1512
tailscaled.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
1512
tailscaled.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
1512
tailscaled.exe
Attempted Denial of Service
ET DOS Possible SSDP Amplification Scan in Progress
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
tailscale-setup-1.82.5 (1).exe