File name:

setup.msi

Full analysis: https://app.any.run/tasks/0e31c039-2591-47db-80a9-f7c8fef96a11
Verdict: Malicious activity
Analysis date: December 04, 2024, 02:51:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
ateraagent
atera
tool
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AteraAgent, Author: Atera networks, Keywords: Installer, Comments: This installer database contains the logic and data required to install AteraAgent., Template: Intel;1033, Revision Number: {721AD955-79FD-4019-BBF5-9DCC4C1175BB}, Create Time/Date: Wed Feb 28 10:52:02 2024, Last Saved Time/Date: Wed Feb 28 10:52:02 2024, Number of Pages: 200, Number of Words: 6, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

0FF7380978D99A4CC05437261753A4F9

SHA1:

B889C0BA4A260C0769C440154D578AB1619B54DE

SHA256:

DB2B39529DFCAB48614EDDB8D5EF60416E8D74D6F05CFCF3A945AE25832D67DF

SSDEEP:

98304:+IZTffzvns6eLKLdpRwznfsJb+7J7ERXndiWaKzPtSjXmbABY/lT8vjkZBvrePVv:/3XP9No

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ATERAAGENT has been detected (YARA)

      • msiexec.exe (PID: 1580)
      • msiexec.exe (PID: 6216)

    • Starts NET.EXE for service management

      • net.exe (PID: 6616)
      • msiexec.exe (PID: 6468)

    • Changes powershell execution policy (Bypass)

      • AgentPackageAgentInformation.exe (PID: 6060)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5748)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 1580)
      • AteraAgent.exe (PID: 7060)
      • msiexec.exe (PID: 6216)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 3420)
      • rundll32.exe (PID: 4512)
      • rundll32.exe (PID: 3732)
      • rundll32.exe (PID: 5680)
      • AteraAgent.exe (PID: 7060)
      • SplashtopStreamer.exe (PID: 5156)
      • PreVerCheck.exe (PID: 3876)

    • ATERAAGENT has been detected

      • AteraAgent.exe (PID: 6644)
      • AteraAgent.exe (PID: 7060)
      • AteraAgent.exe (PID: 6180)

    • Uses TASKKILL.EXE to kill process

      • msiexec.exe (PID: 6468)
      • cmd.exe (PID: 5616)
      • cmd.exe (PID: 4648)
      • cmd.exe (PID: 1916)
      • cmd.exe (PID: 7284)
      • cmd.exe (PID: 6540)
      • cmd.exe (PID: 5788)
      • cmd.exe (PID: 6680)
      • cmd.exe (PID: 7380)
      • cmd.exe (PID: 7188)
      • cmd.exe (PID: 7480)

    • Executes as Windows Service

      • AteraAgent.exe (PID: 7060)
      • AteraAgent.exe (PID: 6180)
      • VSSVC.exe (PID: 6268)

    • Starts SC.EXE for service management

      • AteraAgent.exe (PID: 7060)
      • AteraAgent.exe (PID: 6180)

    • Starts CMD.EXE for commands execution

      • AgentPackageAgentInformation.exe (PID: 6060)
      • msiexec.exe (PID: 6584)

    • The process executes VB scripts

      • cmd.exe (PID: 4648)

    • Executes application which crashes

      • cscript.exe (PID: 5684)

    • Starts POWERSHELL.EXE for commands execution

      • AgentPackageAgentInformation.exe (PID: 6060)
      • cmd.exe (PID: 2164)

    • The process executes Powershell scripts

      • cmd.exe (PID: 2164)

    • Potential Corporate Privacy Violation

      • rundll32.exe (PID: 3420)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1580)

    • Reads the computer name

      • msiexec.exe (PID: 6216)

    • Reads the software policy settings

      • msiexec.exe (PID: 1580)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6216)
      • msiexec.exe (PID: 6584)

    • Checks supported languages

      • msiexec.exe (PID: 6216)

    • Manages system restore points

      • SrTasks.exe (PID: 4320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: AteraAgent
Author: Atera networks
Keywords: Installer
Comments: This installer database contains the logic and data required to install AteraAgent.
Template: Intel;1033
RevisionNumber: {721AD955-79FD-4019-BBF5-9DCC4C1175BB}
CreateDate: 2024:02:28 10:52:02
ModifyDate: 2024:02:28 10:52:02
Pages: 200
Words: 6
Software: Windows Installer XML Toolset (3.11.2.4516)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
225
Monitored processes
97
Malicious processes
3
Suspicious processes
5

Behavior graph

Click at the process to see the details
start #ATERAAGENT msiexec.exe #ATERAAGENT msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe msiexec.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs taskkill.exe no specs conhost.exe no specs THREAT ateraagent.exe no specs THREAT ateraagent.exe rundll32.exe sc.exe no specs conhost.exe no specs agentpackageagentinformation.exe no specs conhost.exe no specs agentpackageagentinformation.exe no specs conhost.exe no specs agentpackageagentinformation.exe no specs conhost.exe no specs agentpackageagentinformation.exe no specs conhost.exe no specs THREAT ateraagent.exe no specs sc.exe no specs conhost.exe no specs agentpackagestremote.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe agentpackagemonitoring.exe no specs conhost.exe no specs werfault.exe no specs powershell.exe no specs conhost.exe no specs agentpackagemonitoring.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs splashtopstreamer.exe prevercheck.exe msiexec.exe no specs msiexec.exe _is348b.exe no specs _is348b.exe no specs _is348b.exe no specs _is348b.exe no specs _is348b.exe no specs _is348b.exe no specs _is348b.exe no specs _is348b.exe no specs _is348b.exe no specs _is348b.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs _is40c1.exe no specs _is40c1.exe no specs _is40c1.exe no specs _is40c1.exe no specs _is40c1.exe no specs _is40c1.exe no specs _is40c1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
396C:\WINDOWS\TEMP\{F0B769B5-548E-4155-9744-DF5068959711}\_is348B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D86FCF08-B710-4D96-86AE-82CB5E1B3743}C:\Windows\Temp\{F0B769B5-548E-4155-9744-DF5068959711}\_is348B.exe—msiexec.exe
User:
SYSTEM
Company:
Flexera
Integrity Level:
SYSTEM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.122
396\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
628\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1488\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AgentPackageAgentInformation.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1580"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\setup.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1592taskkill.exe /F /IM SRFeature.exe /TC:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
1604\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AgentPackageAgentInformation.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
1684\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AgentPackageMonitoring.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1916C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"C:\Windows\SysWOW64\cmd.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
2164"cmd.exe" /c powershell.exe -File "C:\Program Files\Microsoft Office\Office16\vNextDiag.ps1"C:\Windows\System32\cmd.exe—AgentPackageAgentInformation.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
10 321
Read events
10 061
Write events
251
Delete events
9

Modification events

(PID) Process:(6216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000FF667C6FF745DB014818000068180000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000FF667C6FF745DB014818000068180000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000F5B85770F745DB014818000068180000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000F5B85770F745DB014818000068180000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000003E825C70F745DB014818000068180000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000BAE55E70F745DB014818000068180000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000F5C0E670F745DB014818000068180000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000007225E970F745DB0148180000EC180000E803000001000000000000000000000062C409C500EC0F40B0A10FF623B9005600000000000000000000000000000000
(PID) Process:(6268) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000880EF570F745DB017C18000000190000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
113
Suspicious files
62
Text files
43
Unknown types
6

Dropped files

PID
Process
Filename
Type
6216msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:D37259A105A8A9FA5E63A8D863F152A6
SHA256:B5D601495328CA32E03923EB980DA71ABC893D08726A07F620B2510A16C5D9FE
6216msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{c509c462-ec00-400f-b0a1-0ff623b90056}_OnDiskSnapshotPropbinary
MD5:D801E56CF9727D6874CB305FF15AFDF4
SHA256:7569985E8CB29ABAD847A911E1F578F79C20E657676F01D2F8DC6F6DDE94273C
1580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944der
MD5:D2BA9640EC8CAD3488524BF52D6A928D
SHA256:57AD6FE89E50E3FAF7366114EB4C16BA6E1419AF4A1AC5342B68346FF537BBD6
1580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBder
MD5:B422DA6009B649F280C67169B7C724D9
SHA256:7124869DFB944B74C27271D296DF32B6680AB3344FB80ED92803D49290B8188A
4512rundll32.exeC:\Users\admin\AppData\Local\Temp\MSIBD39.tmp-\CustomAction.configxml
MD5:BC17E956CDE8DD5425F2B2A68ED919F8
SHA256:E4FF538599C2D8E898D7F90CCF74081192D5AFA8040E6B6C180F3AA0F46AD2C5
1580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944binary
MD5:F57700BA71D54EC20D7750F8EEE8CD79
SHA256:93A05AC5FA8159C0E352B29FC3935BD9DCABD3889FDC0756B195936D1107A457
1580msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:A94B7BF97C47FEE6E4D66BC51D4AE6D1
SHA256:FF465A6F7838DF414567256B15ECFE9CF9373B19D2A0B0A55F9D5CCE0637041D
4512rundll32.exeC:\Users\admin\AppData\Local\Temp\MSIBD39.tmp-\Microsoft.Deployment.WindowsInstaller.dllexecutable
MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
SHA256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
6216msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:D801E56CF9727D6874CB305FF15AFDF4
SHA256:7569985E8CB29ABAD847A911E1F578F79C20E657676F01D2F8DC6F6DDE94273C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
59
DNS requests
26
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.117.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1580
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1580
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAooSZl45YmN9AojjrilUug%3D
unknown
—
—
whitelisted
1580
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
3688
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
3688
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.23.209.140:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
2.19.117.18:80
crl.microsoft.com
Akamai International B.V.
GB
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3976
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1580
msiexec.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1228
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
2.23.209.133:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.23.209.140
  • 2.23.209.133
  • 2.23.209.187
  • 2.23.209.149
  • 2.23.209.182
whitelisted
crl.microsoft.com
  • 2.19.117.18
  • 2.19.117.22
  • 2.16.164.49
  • 2.16.164.9
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.110
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.68
  • 40.126.32.76
  • 40.126.32.134
  • 20.190.160.22
  • 40.126.32.136
  • 20.190.160.20
  • 40.126.32.72
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
agent-api.atera.com
  • 40.119.152.241
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Splashtop Domain in DNS Lookup (splashtop .com)
—
—
Misc activity
ET INFO Splashtop Domain (splashtop .com) in TLS SNI
—
—
Misc activity
ET INFO Splashtop Domain in DNS Lookup (splashtop .com)
—
—
Misc activity
ET INFO Splashtop Domain (splashtop .com) in TLS SNI
19 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.msi