File name:

EndpointBasecamp.exe

Full analysis: https://app.any.run/tasks/9f8c3e8c-8b6a-4b3e-84b2-7241dc47b558
Verdict: Malicious activity
Analysis date: November 13, 2024, 17:11:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

6C166849AB777F679B769F0F05150AE2

SHA1:

7F322C575822FF4EF4AB4EF3605CCA49DCB2B1FE

SHA256:

F2160C18F16EAD08B6A87A8C04CE9E3689C1F822DD0E268AD3903FD744A574E3

SSDEEP:

98304:m6/iWyEU9F2i+JlREUECWs/2sNKI9KLRWVt5NSdkF9IrfnLO7JRBa7YGBf+Zt:p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process verifies whether the antivirus software is installed

      • EndpointBasecamp.exe (PID: 5584)

    • Executable content was dropped or overwritten

      • TelemetryAgentServiceWebInstaller.exe (PID: 6392)
      • WSCommunicator.exe (PID: 7660)
      • ApexOneInspector.exe (PID: 7396)
      • VOMSvcWebInstaller.exe (PID: 7984)
      • EndpointBasecamp.exe (PID: 6028)
      • EndpointBasecamp.exe (PID: 5584)

    • Drops a system driver (possible attempt to evade defenses)

      • VOMSvcWebInstaller.exe (PID: 7984)

    • Executes as Windows Service

      • CETASvc.exe (PID: 7456)
      • WSCommunicator.exe (PID: 7760)
      • EndpointBasecamp.exe (PID: 6028)

    • Application launched itself

      • EndpointBasecamp.exe (PID: 6028)

  • INFO

    • Checks supported languages

      • EndpointBasecamp.exe (PID: 5584)

    • Reads the machine GUID from the registry

      • EndpointBasecamp.exe (PID: 5584)

    • Reads the computer name

      • EndpointBasecamp.exe (PID: 5584)

    • Reads the software policy settings

      • EndpointBasecamp.exe (PID: 5584)

    • Creates files in the program directory

      • EndpointBasecamp.exe (PID: 5584)

    • Checks proxy server information

      • EndpointBasecamp.exe (PID: 5584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:22 02:47:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 3406336
InitializedDataSize: 1072128
UninitializedDataSize: -
EntryPoint: 0x2ae622
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.1.0.4760
ProductVersionNumber: 1.1.0.4760
FileFlagsMask: 0x003f
FileFlags: Private build, Special build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Trend Micro Endpoint Basecamp
FileVersion: 1.1.0.4760
ProductVersion: 1.1
ProductName: Trend Micro Endpoint Basecamp
CompanyName: Trend Micro Inc.
LegalCopyright: Copyright (C) 2024 Trend Micro Incorporated. All rights reserved.
LegalTrademarks: Copyright (C) Trend Micro Inc.
OriginalFileName: EndpointBasecamp.exe
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
26
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start endpointbasecamp.exe conhost.exe no specs endpointbasecamp.exe telemetryagentservicewebinstaller.exe conhost.exe no specs endpointbasecampdebugger.exe conhost.exe no specs endpointbasecamp.exe no specs conhost.exe no specs apexoneinspector.exe conhost.exe no specs cetasvc.exe no specs endpointbasecamp.exe no specs conhost.exe no specs wscommunicator.exe conhost.exe no specs wscommunicator.exe endpointbasecamp.exe no specs conhost.exe no specs vomsvcwebinstaller.exe conhost.exe no specs endpointbasecamp.exe no specs conhost.exe no specs endpointbasecamp.exe no specs conhost.exe no specs endpointbasecamp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
528"C:\Program Files (x86)\Trend Micro\Endpoint Basecamp\EndpointBasecamp.exe" /svchost_vomC:\Program Files (x86)\Trend Micro\Endpoint Basecamp\EndpointBasecamp.exe—EndpointBasecamp.exe
User:
SYSTEM
Company:
Trend Micro Inc.
Integrity Level:
SYSTEM
Description:
Trend Micro Endpoint Basecamp
Version:
1.1.0.4760
Modules
Images
c:\program files (x86)\trend micro\endpoint basecamp\endpointbasecamp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\bcrypt.dll
c:\windows\syswow64\ws2_32.dll
1372"C:\WINDOWS\temp\yZhmIhcD5tJ\OMhBsMq7mPU\EndpointBasecampDebugger.exe" /device_id bae7bf2c-2970-438b-b28a-3c12d789ffc3 /collect_file "C:\Program Files (x86)\Trend Micro\Endpoint Basecamp\log\EndpointBasecamp.log" "XBC client" /collect_file "C:\windows\Temp\apo_preassess.log" "ES precheck" /collect_file "C:\windows\Temp\edr_indicator.log" "ES indicator" /collect_file "C:\Windows\Temp\ESE_Debug" "ES client" /collect_file "C:\windows\Temp\Cloud Endpoint" "MGCP client" /collect_file "C:\windows\Temp\TMER_Installer.log" "ER_Installer"C:\Windows\Temp\yZhmIhcD5tJ\OMhBsMq7mPU\EndpointBasecampDebugger.exe
EndpointBasecamp.exe
User:
SYSTEM
Company:
Trend Micro Inc.
Integrity Level:
SYSTEM
Description:
Trend Micro Endpoint Basecamp Debugger
Exit code:
0
Version:
1.1.0.4643
Modules
Images
c:\windows\temp\yzhmihcd5tj\omhbsmq7mpu\endpointbasecampdebugger.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3644"C:\Users\admin\AppData\Local\Temp\EndpointBasecamp.exe" C:\Users\admin\AppData\Local\Temp\EndpointBasecamp.exe—explorer.exe
User:
admin
Company:
Trend Micro Inc.
Integrity Level:
MEDIUM
Description:
Trend Micro Endpoint Basecamp
Exit code:
3221226540
Version:
1.1.0.4760
Modules
Images
c:\users\admin\appdata\local\temp\endpointbasecamp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5584"C:\Users\admin\AppData\Local\Temp\EndpointBasecamp.exe" C:\Users\admin\AppData\Local\Temp\EndpointBasecamp.exe
explorer.exe
User:
admin
Company:
Trend Micro Inc.
Integrity Level:
HIGH
Description:
Trend Micro Endpoint Basecamp
Exit code:
0
Version:
1.1.0.4760
Modules
Images
c:\users\admin\appdata\local\temp\endpointbasecamp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcrypt.dll
5592\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—EndpointBasecamp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6028"C:\\Program Files (x86)\\Trend Micro\\Endpoint Basecamp\\EndpointBasecamp.exe" /serviceC:\Program Files (x86)\Trend Micro\Endpoint Basecamp\EndpointBasecamp.exe
services.exe
User:
SYSTEM
Company:
Trend Micro Inc.
Integrity Level:
SYSTEM
Description:
Trend Micro Endpoint Basecamp
Version:
1.1.0.4760
Modules
Images
c:\windows\syswow64\ondemandconnroutehelper.dll
c:\windows\syswow64\webio.dll
c:\windows\syswow64\mswsock.dll
c:\windows\syswow64\winnsi.dll
c:\windows\syswow64\nsi.dll
c:\windows\syswow64\sspicli.dll
c:\windows\syswow64\dnsapi.dll
c:\windows\syswow64\rasadhlp.dll
c:\windows\syswow64\fwpuclnt.dll
c:\windows\syswow64\schannel.dll
6384\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—EndpointBasecampDebugger.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6392"C:\WINDOWS\temp\GdW2q7GnBJn\6FxteT8SvO9\TelemetryAgentServiceWebInstaller.exe" --install --env prod --region us1 --install-path "C:\Program Files (x86)\Trend Micro\Endpoint Basecamp\modules\ceta" --log-path "C:\Program Files (x86)\Trend Micro\Endpoint Basecamp\log"C:\Windows\Temp\GdW2q7GnBJn\6FxteT8SvO9\TelemetryAgentServiceWebInstaller.exe
EndpointBasecamp.exe
User:
SYSTEM
Company:
Trend Micro Inc.
Integrity Level:
SYSTEM
Description:
Trend Micro Cloud Endpoint Telemetry Service Web Installer
Exit code:
0
Version:
1.1.0.1341
Modules
Images
c:\windows\temp\gdw2q7gnbjn\6fxtet8svo9\telemetryagentservicewebinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6400\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—TelemetryAgentServiceWebInstaller.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6636\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—EndpointBasecamp.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
72 812
Read events
72 660
Write events
139
Delete events
13

Modification events

(PID) Process:(5584) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\OfficeScan\DE
Operation:writeName:InstallDateTime
Value:
2024111300171144
(PID) Process:(5584) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:runtime_stage
Value:
0
(PID) Process:(5584) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:device_id
Value:
bae7bf2c-2970-438b-b28a-3c12d789ffc3
(PID) Process:(5584) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:proxy_server
Value:
(PID) Process:(5584) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:proxy_bypass
Value:
(PID) Process:(5584) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:proxy_source
Value:
6
(PID) Process:(5584) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:runtime_proxy_source
Value:
0
(PID) Process:(5584) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:sg_proxy_source
Value:
0
(PID) Process:(5584) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\SecurityKeys
Operation:writeName:proxy_username
Value:
HOqtxg==
(PID) Process:(5584) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\SecurityKeys
Operation:writeName:proxy_password
Value:
dqe/bA==
Executable files
37
Suspicious files
23
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
6028EndpointBasecamp.exeC:\Windows\Temp\yZhmIhcD5tJ\xCzRNaSlVGi.zipcompressed
MD5:A3EED36523E4B289194069B7A6A2A62B
SHA256:8B2D0E7E8A696EFD9577325705749E4741EC7863A8B92053756997DF4C3355A7
5584EndpointBasecamp.exeC:\Program Files (x86)\Trend Micro\Endpoint Basecamp\EndpointBasecamp.exeexecutable
MD5:6C166849AB777F679B769F0F05150AE2
SHA256:F2160C18F16EAD08B6A87A8C04CE9E3689C1F822DD0E268AD3903FD744A574E3
5584EndpointBasecamp.exeC:\Program Files (x86)\Trend Micro\Endpoint Basecamp\log\EndpointBasecamp.logtext
MD5:43A17BA3AAD8E44FCCF91537EF163997
SHA256:320D946A2514725BAE22418AD6B5DB02F797F9B3EDE9B8F5D1F98BD090F56F62
1372EndpointBasecampDebugger.exeC:\Windows\Temp\yZhmIhcD5tJ\OMhBsMq7mPU\Log\XBC client\EndpointBasecamp.logtext
MD5:2ADD0B6ABE49BCDBCE5FBCD835C461CB
SHA256:6BEFCE40C8146CEBCE6303DE4E05BC7E99EBBBADE5F72FC8786C6BF1C39B6A43
6028EndpointBasecamp.exeC:\Windows\Temp\5l3EoLFwqza\LXzynuShIVo\DatFHS.dlxexecutable
MD5:FDA6F8D05A467DE0B919739E7ACF0112
SHA256:D0BB8DB3484B967B8D8EC023337752C4C9F19D6A3E7B3C85B17B0BC0990BF9E9
6028EndpointBasecamp.exeC:\Windows\Temp\yZhmIhcD5tJ\OMhBsMq7mPU\EndpointBasecampDebugger.exeexecutable
MD5:702F2AD26D2B35B6CA9D8DE6B3728F45
SHA256:6C92F327C9445B67C3FF0DE50528012455EA4B0B3274D0AB5BA1749670E406D6
6028EndpointBasecamp.exeC:\Windows\Temp\GdW2q7GnBJn\aL5LtD6Ivs7.zipcompressed
MD5:098166A7105FBBC7DFED3F8AFB1AADB6
SHA256:407E4542BE4D23136C41B2D99D33E352CC2AFED00B070936552DD06408E4371C
6028EndpointBasecamp.exeC:\Windows\Temp\GdW2q7GnBJn\6FxteT8SvO9\dllXbcSdk.dllexecutable
MD5:3DFB22ED3A8F325762BFE5C4D5E8E5AF
SHA256:7B6733744E775AE89802F2C78548CE45C7F165B6F28B1D4145A67F00B77C7790
6028EndpointBasecamp.exeC:\Windows\Temp\5l3EoLFwqza\LXzynuShIVo\ApexOneInspector.exeexecutable
MD5:7175DDF63063C537C43039CF3C5654CC
SHA256:4E338E82579B8411CBB82CC4ACF0FEA2033109CB8CA549FC78C4DC9AE4E55A5A
6028EndpointBasecamp.exeC:\Windows\Temp\5l3EoLFwqza\tudpQBYFOlD.zipcompressed
MD5:4D530DDC917EA004F27D7FCA62439469
SHA256:CB124B40EA7C78B663A56DD442B9606BF80B7EEAF53B896B1882D1113FDAA51E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
83
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7632
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
748
lsass.exe
GET
200
18.238.246.206:80
http://ocsp.r2m02.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEArx9zq3KEFMUHUTwkp5weM%3D
unknown
—
—
whitelisted
1588
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7632
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6028
EndpointBasecamp.exe
CONNECT
—
3.231.25.115:8080
http://api-us1.xbc.trendmicro.com:443
unknown
—
—
whitelisted
6028
EndpointBasecamp.exe
CONNECT
—
3.231.25.115:8080
http://api-us1.xbc.trendmicro.com:443
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.209.141:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5488
MoUsoCoreWorker.exe
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5488
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5584
EndpointBasecamp.exe
35.169.228.228:443
api-us1.xbc.trendmicro.com
AMAZON-AES
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
www.bing.com
  • 2.23.209.141
  • 2.23.209.135
  • 2.23.209.154
  • 2.23.209.133
  • 2.23.209.150
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.148
  • 2.23.209.137
  • 2.23.209.156
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.49
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
google.com
  • 172.217.16.206
whitelisted
api-us1.xbc.trendmicro.com
  • 35.169.228.228
  • 3.210.134.206
  • 3.212.31.225
  • 52.54.92.5
  • 3.209.5.209
  • 3.225.100.128
  • 3.229.24.84
  • 3.86.150.33
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.76
  • 20.190.160.22
  • 40.126.32.134
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
release-us1.mgcp.trendmicro.com
  • 108.138.26.88
  • 108.138.26.37
  • 108.138.26.12
  • 108.138.26.58
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EndpointBasecamp.exe