File name:

tailscale-setup-1.54.0.exe

Full analysis: https://app.any.run/tasks/6f9d2b9a-1bdc-4309-aef9-65af5ada5a5b
Verdict: Malicious activity
Analysis date: November 25, 2023, 10:21:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FE2A56EAC73563DCFCF017505D8089B0

SHA1:

904EAB2B7BBDFAEDC07CEE86C7741F864D2FAAE6

SHA256:

8B7B28BBB034125BB3850783AE9B7F06470CEF9ACD093C2A3A7A96B52E4360D6

SSDEEP:

24576:FbTqNta3ZSa5MqRyhbmrexxwcAUXFmifl4ilHOw:FbTqNta3ZH5MqRyhirexxwcAsFmifl4s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • tailscale-setup-1.54.0.exe (PID: 2708)
      • tailscale-setup-1.54.0.exe (PID: 128)
      • tailscale-setup-1.54.0.exe (PID: 824)
      • msiexec.exe (PID: 3588)
      • drvinst.exe (PID: 3900)
      • tailscaled.exe (PID: 2912)

    • Create files in the Startup directory

      • msiexec.exe (PID: 3588)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 3900)
      • tailscaled.exe (PID: 2912)

  • SUSPICIOUS

    • Searches for installed software

      • tailscale-setup-1.54.0.exe (PID: 128)
      • tailscale-setup-1.54.0.exe (PID: 824)

    • Starts itself from another location

      • tailscale-setup-1.54.0.exe (PID: 2708)
      • tailscale-setup-1.54.0.exe (PID: 128)

    • Reads the Internet Settings

      • tailscale-setup-1.54.0.exe (PID: 128)
      • msiexec.exe (PID: 1992)

    • Reads settings of System Certificates

      • tailscale-setup-1.54.0.exe (PID: 128)
      • tailscale-ipn.exe (PID: 3324)

    • Checks Windows Trust Settings

      • tailscale-setup-1.54.0.exe (PID: 128)
      • msiexec.exe (PID: 3588)
      • drvinst.exe (PID: 3900)

    • Reads security settings of Internet Explorer

      • tailscale-setup-1.54.0.exe (PID: 128)

    • Executes as Windows Service

      • VSSVC.exe (PID: 476)
      • tailscaled.exe (PID: 2100)

    • Application launched itself

      • tailscaled.exe (PID: 2100)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3588)

    • Starts SC.EXE for service management

      • msiexec.exe (PID: 3460)

    • Drops a system driver (possible attempt to evade defenses)

      • tailscaled.exe (PID: 2912)
      • drvinst.exe (PID: 3900)

    • Creates files in the driver directory

      • drvinst.exe (PID: 3900)
      • tailscaled.exe (PID: 2912)

    • Creates a software uninstall entry

      • tailscale-setup-1.54.0.exe (PID: 824)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • tailscaled.exe (PID: 2912)

    • Process uses IPCONFIG to clear DNS cache

      • tailscaled.exe (PID: 2912)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • tailscaled.exe (PID: 2912)

    • Process uses IPCONFIG to get network configuration information

      • tailscaled.exe (PID: 2912)

  • INFO

    • Checks supported languages

      • tailscale-setup-1.54.0.exe (PID: 128)
      • tailscale-setup-1.54.0.exe (PID: 2708)
      • tailscale-setup-1.54.0.exe (PID: 824)
      • wmpnscfg.exe (PID: 3280)
      • msiexec.exe (PID: 3588)
      • msiexec.exe (PID: 3460)
      • tailscaled.exe (PID: 2100)
      • tailscaled.exe (PID: 2912)
      • msiexec.exe (PID: 1992)
      • drvinst.exe (PID: 3900)
      • tailscale-ipn.exe (PID: 3324)
      • wmpnscfg.exe (PID: 3248)
      • wmpnscfg.exe (PID: 3264)

    • Reads the computer name

      • tailscale-setup-1.54.0.exe (PID: 128)
      • tailscale-setup-1.54.0.exe (PID: 824)
      • wmpnscfg.exe (PID: 3280)
      • msiexec.exe (PID: 3588)
      • tailscaled.exe (PID: 2100)
      • msiexec.exe (PID: 1992)
      • msiexec.exe (PID: 3460)
      • drvinst.exe (PID: 3900)
      • tailscale-ipn.exe (PID: 3324)
      • tailscaled.exe (PID: 2912)
      • wmpnscfg.exe (PID: 3248)
      • wmpnscfg.exe (PID: 3264)

    • Create files in a temporary directory

      • tailscale-setup-1.54.0.exe (PID: 2708)
      • tailscale-setup-1.54.0.exe (PID: 128)
      • tailscale-setup-1.54.0.exe (PID: 824)
      • msiexec.exe (PID: 3588)

    • Reads the machine GUID from the registry

      • tailscale-setup-1.54.0.exe (PID: 128)
      • tailscale-setup-1.54.0.exe (PID: 824)
      • wmpnscfg.exe (PID: 3280)
      • msiexec.exe (PID: 3588)
      • msiexec.exe (PID: 1992)
      • msiexec.exe (PID: 3460)
      • tailscaled.exe (PID: 2912)
      • drvinst.exe (PID: 3900)
      • tailscaled.exe (PID: 2100)
      • tailscale-ipn.exe (PID: 3324)
      • wmpnscfg.exe (PID: 3248)
      • wmpnscfg.exe (PID: 3264)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3280)
      • wmpnscfg.exe (PID: 3248)
      • wmpnscfg.exe (PID: 3264)

    • Checks proxy server information

      • tailscale-setup-1.54.0.exe (PID: 128)

    • Creates files or folders in the user directory

      • tailscale-setup-1.54.0.exe (PID: 128)
      • msiexec.exe (PID: 3588)
      • tailscale-ipn.exe (PID: 3324)

    • Creates files in the program directory

      • tailscale-setup-1.54.0.exe (PID: 824)
      • tailscaled.exe (PID: 2100)
      • tailscaled.exe (PID: 2912)

    • Application launched itself

      • msiexec.exe (PID: 3588)

    • Reads Environment values

      • tailscaled.exe (PID: 2912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:26 17:23:15+02:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.16
CodeSize: 313856
InitializedDataSize: 301568
UninitializedDataSize: -
EntryPoint: 0x2e082
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.54.0.0
ProductVersionNumber: 1.54.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Tailscale Inc.
FileDescription: Tailscale
FileVersion: 1.54.0
InternalName: setup
LegalCopyright: Copyright (c) Tailscale Inc.. All rights reserved.
OriginalFileName: tailscale-setup-1.54.0.exe
ProductName: Tailscale
ProductVersion: 1.54.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
65
Monitored processes
22
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start tailscale-setup-1.54.0.exe no specs tailscale-setup-1.54.0.exe tailscale-setup-1.54.0.exe wmpnscfg.exe no specs vssvc.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs sc.exe no specs tailscaled.exe tailscaled.exe drvinst.exe no specs tailscale-ipn.exe netsh.exe no specs ipconfig.exe no specs netsh.exe no specs netsh.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs ipconfig.exe no specs ipconfig.exe no specs ipconfig.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Users\admin\AppData\Local\Temp\{19C9BE63-B3F7-47C1-B9A1-4E3DE2677A06}\.cr\tailscale-setup-1.54.0.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\tailscale-setup-1.54.0.exe" -burn.filehandle.attached=152 -burn.filehandle.self=160 C:\Users\admin\AppData\Local\Temp\{19C9BE63-B3F7-47C1-B9A1-4E3DE2677A06}\.cr\tailscale-setup-1.54.0.exe
tailscale-setup-1.54.0.exe
User:
admin
Company:
Tailscale Inc.
Integrity Level:
MEDIUM
Description:
Tailscale
Exit code:
0
Version:
1.54.0
Modules
Images
c:\users\admin\appdata\local\temp\{19c9be63-b3f7-47c1-b9a1-4e3de2677a06}\.cr\tailscale-setup-1.54.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
476C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
824"C:\Users\admin\AppData\Local\Temp\{2835FF5A-E7FD-48B9-81EF-D5328C001FF2}\.be\tailscale-setup-1.54.0.exe" -q -burn.elevated BurnPipe.{7AE08305-1956-4F28-8ADE-5DB74C6ADA01} {79A919B1-8FC4-4E79-A9D4-3394A9FF15C2} 128C:\Users\admin\AppData\Local\Temp\{2835FF5A-E7FD-48B9-81EF-D5328C001FF2}\.be\tailscale-setup-1.54.0.exe
tailscale-setup-1.54.0.exe
User:
admin
Company:
Tailscale Inc.
Integrity Level:
HIGH
Description:
Tailscale
Exit code:
0
Version:
1.54.0
Modules
Images
c:\users\admin\appdata\local\temp\{2835ff5a-e7fd-48b9-81ef-d5328c001ff2}\.be\tailscale-setup-1.54.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1088ipconfig /registerdnsC:\Windows\System32\ipconfig.exe—tailscaled.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
1616netsh advfirewall firewall add rule name=Tailscale-Process dir=in action=allow edge=yes "program=C:\Program Files\Tailscale\tailscaled.exe" protocol=udp profile=any enable=yesC:\Windows\System32\netsh.exe—tailscaled.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1992C:\Windows\system32\MsiExec.exe -Embedding DDB699279FA5A4C10EE9DF03C0201629C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2004ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—tailscaled.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
2092netsh advfirewall firewall delete rule name=Tailscale-Process dir=inC:\Windows\System32\netsh.exe—tailscaled.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2100"C:\Program Files\Tailscale\tailscaled.exe"C:\Program Files\Tailscale\tailscaled.exe
services.exe
User:
SYSTEM
Company:
Tailscale Inc.
Integrity Level:
SYSTEM
Description:
Tailscale service
Exit code:
0
Version:
1.44.2-t7df0d6805-gf51944e99
Modules
Images
c:\program files\tailscale\tailscaled.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
2128ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—tailscaled.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
Total events
26 590
Read events
26 190
Write events
340
Delete events
60

Modification events

(PID) Process:(128) tailscale-setup-1.54.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(128) tailscale-setup-1.54.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(128) tailscale-setup-1.54.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(128) tailscale-setup-1.54.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3280) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{745C1717-B699-4BF6-A211-272C93F68B9A}\{D13F32CF-BE6C-4E73-9C74-F4D8C15DD573}
Operation:delete keyName:(default)
Value:
(PID) Process:(3280) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{745C1717-B699-4BF6-A211-272C93F68B9A}
Operation:delete keyName:(default)
Value:
(PID) Process:(3280) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{BCFE3CF1-C2EE-4CB2-BB8C-91624AA3D350}
Operation:delete keyName:(default)
Value:
(PID) Process:(824) tailscale-setup-1.54.0.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(824) tailscale-setup-1.54.0.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(824) tailscale-setup-1.54.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
72
Executable files
22
Suspicious files
54
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
824tailscale-setup-1.54.0.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
824tailscale-setup-1.54.0.exeC:\System Volume Information\SPP\OnlineMetadataCache\{209a940f-2c9b-49e2-ae42-60c0db27817b}_OnDiskSnapshotPropbinary
MD5:206555685672922781E9FB6E65389F34
SHA256:2E438AF3043AFA9E0B6FCA83E0E098CC01B194AA46DC00E0EC02C72E6B8543B4
128tailscale-setup-1.54.0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\436C3A4C147BABB0A5C512B3C1E21A20binary
MD5:014CCF0F717F41399FF9776D40405047
SHA256:D585CD070DD86D13F116AEED0787BF09C5337EDCCA682B1E5FAA57CD6F0EEF72
128tailscale-setup-1.54.0.exeC:\Users\admin\AppData\Local\Temp\{2835FF5A-E7FD-48B9-81EF-D5328C001FF2}\.ba\thm.wxlxml
MD5:FC0DB4142556D3F38B0744A12F5F9D3D
SHA256:8FBEB7F0B546D394D99B49D678D516402E8F54E5DEA590CC91733F502F288019
824tailscale-setup-1.54.0.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:206555685672922781E9FB6E65389F34
SHA256:2E438AF3043AFA9E0B6FCA83E0E098CC01B194AA46DC00E0EC02C72E6B8543B4
128tailscale-setup-1.54.0.exeC:\Users\admin\AppData\Local\Temp\{2835FF5A-E7FD-48B9-81EF-D5328C001FF2}\Msi7IA32 —
MD5:—
SHA256:—
128tailscale-setup-1.54.0.exeC:\Users\admin\AppData\Local\Temp\{2835FF5A-E7FD-48B9-81EF-D5328C001FF2}\.ba\logo.pngimage
MD5:D739DB7A35FC73CBC433B7D1C676EAB9
SHA256:5D990E6AC3757C43E8EC6E4E86A4ABD21CB1746AA9D518C0ED3C755EB6ABF63F
824tailscale-setup-1.54.0.exeC:\ProgramData\Package Cache\.unverified\Msi7IA32 —
MD5:—
SHA256:—
824tailscale-setup-1.54.0.exeC:\ProgramData\Package Cache\{86A843D7-EBD9-5742-8B1D-05604E16A4E4}v1.44.2\tailscale-setup-1.44.2-x86.msi —
MD5:—
SHA256:—
3588msiexec.exeC:\Windows\Installer\1c88a0.msi —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
34
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
128
tailscale-setup-1.54.0.exe
GET
200
184.24.77.62:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgT5%2BEAQtuGZeAf1IfKHR87kgw%3D%3D
unknown
binary
503 b
—
128
tailscale-setup-1.54.0.exe
GET
200
23.56.202.135:80
http://x1.c.lencr.org/
unknown
binary
717 b
—
128
tailscale-setup-1.54.0.exe
GET
200
23.53.41.250:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?92e1f2252e0118dc
unknown
compressed
4.66 Kb
—
1080
svchost.exe
GET
304
23.53.41.250:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8aef2fa3cb5e0a37
unknown
—
—
—
128
tailscale-setup-1.54.0.exe
GET
200
23.53.41.250:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c84a3a05d92f16bc
unknown
compressed
61.6 Kb
—
3588
msiexec.exe
GET
200
192.229.221.95:80
http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
unknown
binary
1.68 Kb
—
128
tailscale-setup-1.54.0.exe
GET
200
184.24.77.62:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgRCJrHwydf7KvnGSNzJbpbU5A%3D%3D
unknown
binary
503 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
unknown
868
svchost.exe
95.101.148.135:80
armmf.adobe.com
Akamai International B.V.
NL
unknown
128
tailscale-setup-1.54.0.exe
199.38.181.239:443
pkgs.tailscale.com
NETACTUATE
US
unknown
128
tailscale-setup-1.54.0.exe
23.53.41.250:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
128
tailscale-setup-1.54.0.exe
23.56.202.135:80
x1.c.lencr.org
AKAMAI-AS
GB
unknown
128
tailscale-setup-1.54.0.exe
184.24.77.62:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
1080
svchost.exe
23.53.41.250:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 95.101.148.135
unknown
pkgs.tailscale.com
  • 199.38.181.239
unknown
ctldl.windowsupdate.com
  • 23.53.41.250
  • 23.53.42.26
unknown
x1.c.lencr.org
  • 23.56.202.135
unknown
r3.o.lencr.org
  • 184.24.77.62
  • 184.24.77.61
  • 184.24.77.81
  • 184.24.77.77
  • 184.24.77.54
  • 184.24.77.48
  • 184.24.77.58
  • 184.24.77.76
unknown
dl.tailscale.com
  • 109.105.218.17
unknown
cacerts.digicert.com
  • 192.229.221.95
unknown
log.tailscale.io
  • 54.161.152.147
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
tailscale-setup-1.54.0.exe