File name:

ZeroTier One.msi

Full analysis: https://app.any.run/tasks/25503bec-0cf4-4d8c-92fe-24b1a89815f1
Verdict: Malicious activity
Analysis date: August 11, 2024, 20:14:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 14:06:51 2020, Security: 0, Code page: 1252, Revision Number: {10779326-4D29-4D6C-A2AE-45C16F135E92}, Number of Words: 2, Subject: ZeroTier One, Author: ZeroTier, Inc., Name of Creating Application: ZeroTier One, Template: ;1033, Comments: This installer database contains the logic and data required to install ZeroTier One., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Apr 18 00:45:42 2024, Number of Pages: 200
MD5:

316FC65318BD86FD3B71593501825DE6

SHA1:

6AE35FD08375D0FDA71816125A7D18B4678821C6

SHA256:

4F844EB5632CB7484499BA1B237D91FB2FD4E97176864EDE6E74AD33C599C135

SSDEEP:

98304:Q9IUoavvvM0KoIPEUfzRg01BDdEu4nndV2Sks/CtGjPoAXSiTSX5tGnDpUdqDQSR:2fUw/Qa4vsWWES

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • zerotier_desktop_ui.exe (PID: 1664)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6876)
      • zerotier-one_x64.exe (PID: 6728)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6604)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6604)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 6604)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • zerotier-one_x64.exe (PID: 6728)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • zerotier-one_x64.exe (PID: 6728)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6604)

    • Reads the date of Windows installation

      • zerotier_desktop_ui.exe (PID: 1664)
      • MSIBE6A.tmp (PID: 3268)

    • Reads security settings of Internet Explorer

      • MSIBE6A.tmp (PID: 3268)
      • zerotier_desktop_ui.exe (PID: 1664)

    • Application launched itself

      • zerotier_desktop_ui.exe (PID: 1664)

    • Uses ICACLS.EXE to modify access control lists

      • zerotier-one_x64.exe (PID: 6728)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6444)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6444)
      • zerotier_desktop_ui.exe (PID: 7016)

    • Reads the software policy settings

      • msiexec.exe (PID: 6444)
      • msiexec.exe (PID: 6604)

    • Checks supported languages

      • msiexec.exe (PID: 6604)
      • msiexec.exe (PID: 6676)
      • msiexec.exe (PID: 4292)
      • zerotier-one_x64.exe (PID: 6728)
      • msiexec.exe (PID: 6008)
      • zerotier_desktop_ui.exe (PID: 1664)
      • zerotier_desktop_ui.exe (PID: 7016)
      • TextInputHost.exe (PID: 5388)
      • MSIBE6A.tmp (PID: 3268)
      • zerotier_desktop_ui.exe (PID: 7392)

    • Reads the computer name

      • msiexec.exe (PID: 6604)
      • msiexec.exe (PID: 6676)
      • msiexec.exe (PID: 4292)
      • zerotier-one_x64.exe (PID: 6728)
      • msiexec.exe (PID: 6008)
      • MSIBE6A.tmp (PID: 3268)
      • zerotier_desktop_ui.exe (PID: 1664)
      • TextInputHost.exe (PID: 5388)
      • zerotier_desktop_ui.exe (PID: 7392)

    • Checks proxy server information

      • msiexec.exe (PID: 6444)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6444)
      • msiexec.exe (PID: 6604)

    • Reads Environment values

      • msiexec.exe (PID: 6676)
      • msiexec.exe (PID: 6008)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6604)
      • msiexec.exe (PID: 4292)
      • zerotier-one_x64.exe (PID: 6728)

    • Creates files in the program directory

      • zerotier-one_x64.exe (PID: 6728)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6604)

    • Create files in a temporary directory

      • zerotier_desktop_ui.exe (PID: 1664)

    • Process checks computer location settings

      • MSIBE6A.tmp (PID: 3268)
      • zerotier_desktop_ui.exe (PID: 1664)

    • Manual execution by a user

      • zerotier_desktop_ui.exe (PID: 7392)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 6604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2009:12:11 11:47:44
ModifyDate: 2020:09:18 14:06:51
Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {10779326-4D29-4D6C-A2AE-45C16F135E92}
Words: 2
Subject: ZeroTier One
Author: ZeroTier, Inc.
LastModifiedBy: -
Software: ZeroTier One
Template: ;1033
Comments: This installer database contains the logic and data required to install ZeroTier One.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2024:04:18 00:45:42
Pages: 200
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
184
Monitored processes
45
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs HNetCfg.FwPolicy2 no specs zerotier-one_x64.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs msibe6a.tmp no specs zerotier_desktop_ui.exe zerotier_desktop_ui.exe textinputhost.exe no specs zerotier_desktop_ui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
252\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
936C:\Windows\System32\icacls.exe "C:\ProgramData\ZeroTier\One\authtoken.secret" /remove *S-1-5-32-545 /QC:\Windows\System32\icacls.exe—zerotier-one_x64.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
1020C:\Windows\System32\icacls.exe "C:\ProgramData\ZeroTier\One\metricstoken.secret" /inheritance:d /QC:\Windows\System32\icacls.exe—zerotier-one_x64.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
1236C:\Windows\System32\icacls.exe "C:\ProgramData\ZeroTier\One\controller.d" /remove *S-1-5-32-545 /QC:\Windows\System32\icacls.exe—zerotier-one_x64.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
1536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1664C:\Windows\System32\icacls.exe "C:\ProgramData\ZeroTier\One\metricstoken.secret" /remove:g Everyone /t /c /QC:\Windows\System32\icacls.exe—zerotier-one_x64.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
1664"C:\Program Files (x86)\ZeroTier\One\zerotier_desktop_ui.exe" C:\Program Files (x86)\ZeroTier\One\zerotier_desktop_ui.exe
MSIBE6A.tmp
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files (x86)\zerotier\one\zerotier_desktop_ui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1748C:\Windows\System32\icacls.exe "C:\ProgramData\ZeroTier\One\authtoken.secret" /inheritance:d /QC:\Windows\System32\icacls.exe—zerotier-one_x64.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
2128C:\Windows\System32\icacls.exe "C:\ProgramData\ZeroTier\One\controller.d" /remove:g Everyone /t /c /QC:\Windows\System32\icacls.exe—zerotier-one_x64.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
2340C:\Windows\System32\netsh.exe advfirewall firewall add rule name="ZeroTier One" dir=in action=allow program="C:\ProgramData\ZeroTier\One\zerotier-one_x64.exe" enable=yesC:\Windows\System32\netsh.exe—zerotier-one_x64.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
21 668
Read events
21 304
Write events
341
Delete events
23

Modification events

(PID) Process:(6604) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000F4BF550B2BECDA01CC190000CC1A0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6604) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000F4BF550B2BECDA01CC190000CC1A0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6604) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000000D8B980B2BECDA01CC190000CC1A0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6604) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000000D8B980B2BECDA01CC190000CC1A0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6604) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000E41F9B0B2BECDA01CC190000CC1A0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6604) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000073AE9F0B2BECDA01CC190000CC1A0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6604) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6604) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000BA8F080C2BECDA01CC190000CC1A0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6604) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000052F30A0C2BECDA01CC190000681B0000E80300000100000000000000000000006BD312E3DCBBB6469DF5DE3B962A640700000000000000000000000000000000
(PID) Process:(6876) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000065DF160C2BECDA01DC1A00007C1B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
28
Suspicious files
23
Text files
13
Unknown types
2

Dropped files

PID
Process
Filename
Type
6604msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6604msiexec.exeC:\Windows\Installer\eaaa3.msi —
MD5:—
SHA256:—
6444msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5AF0.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
6444msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI58CA.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
6444msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_7BB3308594A3EB9AAE4C61EE21221196binary
MD5:BAD766D61F2A2F44DF23C4763B32025E
SHA256:798D7D580E5251A2EE2F82B43AAD51A2503F5D1672D65DF4258D667F3CF0167B
6444msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:B05AECFADDAD9B5F68D66C5F20E71CF9
SHA256:3B3FE512F3E1A3F27108E51E43F81EC23AA203E88658FC654C2D946FB74D640A
6444msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5B10.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
6444msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5A72.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
6604msiexec.exeC:\Windows\Installer\MSIB0E4.tmp —
MD5:—
SHA256:—
6444msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5B30.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
71
DNS requests
23
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6444
msiexec.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
6444
msiexec.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDGWP9qViJDHKVZCA5w%3D%3D
unknown
—
—
whitelisted
5540
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6212
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7148
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4576
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2872
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6444
msiexec.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
5336
SearchApp.exe
104.126.37.136:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5540
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.104.136.2
whitelisted
www.bing.com
  • 104.126.37.136
  • 104.126.37.145
  • 104.126.37.144
  • 104.126.37.137
  • 104.126.37.155
  • 104.126.37.154
  • 104.126.37.139
  • 104.126.37.153
  • 104.126.37.130
  • 184.86.251.9
  • 184.86.251.28
  • 184.86.251.14
  • 184.86.251.23
  • 184.86.251.24
  • 184.86.251.17
  • 184.86.251.21
  • 184.86.251.25
  • 184.86.251.11
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.73
  • 20.190.159.64
  • 40.126.31.71
  • 20.190.159.75
  • 20.190.159.4
  • 20.190.159.0
  • 40.126.31.69
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
th.bing.com
  • 184.86.251.9
  • 184.86.251.21
  • 184.86.251.25
  • 184.86.251.28
  • 184.86.251.14
  • 184.86.251.11
  • 184.86.251.23
  • 202.89.233.100
  • 202.89.233.101
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted

Threats

PID
Process
Class
Message
6728
zerotier-one_x64.exe
Potentially Bad Traffic
ET INFO ZeroTier Related Activity (udp)
6728
zerotier-one_x64.exe
Potentially Bad Traffic
INFO [ANY.RUN] Malformed TLS App-Layer Outbound Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZeroTier One.msi