File name:

CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe

Full analysis: https://app.any.run/tasks/37d6891b-104a-42cf-9508-449cd55162da
Verdict: Malicious activity
Analysis date: December 04, 2024, 09:45:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

AB97274DFA0C17CC4BA0B7EED0301C84

SHA1:

DCD52422C474CA74F1F142D3CBE61420D0F54FD2

SHA256:

566321110E78480726F6AF1084A3BA900F5F49E57DE340E56F920D2139F9694A

SSDEEP:

98304:UtCWkQ+UrQh8YYLTZpCC/lL2HdfnoyVHiUpi9d52DGwsqv6lwYSXxKr2LF9Oo6SK:lMo9aqRm4ncaa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • IS.exe (PID: 3436)

    • Executing a file with an untrusted certificate

      • ISBEW64.exe (PID: 244)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 3992)
      • CheckVcamReg.exe (PID: 2144)

    • Starts CMD.EXE for commands execution

      • ExecuteBatch-Win.exe (PID: 4136)

    • Executable content was dropped or overwritten

      • CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe (PID: 6648)
      • IS.exe (PID: 3436)

    • Executes as Windows Service

      • XYNTService.exe (PID: 3224)
      • VSSVC.exe (PID: 6936)

    • The process deletes folder without confirmation

      • ExecuteBatch-Win.exe (PID: 4136)

    • Likely accesses (executes) a file from the Public directory

      • cmd.exe (PID: 5252)

    • The process drops C-runtime libraries

      • IS.exe (PID: 3436)

    • Process drops legitimate windows executable

      • IS.exe (PID: 3436)

  • INFO

    • Reads the computer name

      • CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe (PID: 6648)
      • SMIServiceWrapper.exe (PID: 5696)
      • XYNTService.exe (PID: 5256)
      • XYNTService.exe (PID: 1224)

    • Checks supported languages

      • CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe (PID: 6648)
      • ExecuteBatch-Win.exe (PID: 4864)
      • SMIServiceWrapper.exe (PID: 5696)
      • CheckVcamReg.exe (PID: 2144)
      • SMIServiceWrapper.exe (PID: 2744)
      • XYNTService.exe (PID: 1224)
      • ExecuteBatch-Win.exe (PID: 2828)
      • XYNTService.exe (PID: 5256)
      • setup.exe (PID: 3992)
      • SMIServiceWrapper.exe (PID: 5916)

    • Process checks computer location settings

      • SMIServiceWrapper.exe (PID: 5916)
      • SMIServiceWrapper.exe (PID: 5696)

    • The process uses the downloaded file

      • setup.exe (PID: 3992)

    • Sends debugging messages

      • setup.exe (PID: 3992)

    • Manages system restore points

      • SrTasks.exe (PID: 5076)

    • Create files in a temporary directory

      • IS.exe (PID: 3436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:10:17 19:35:08+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 77824
InitializedDataSize: 139264
UninitializedDataSize: -
EntryPoint: 0xedb2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.3.1.12
ProductVersionNumber: 1.3.1.12
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: -
FileVersion: 1.3.1.12
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
161
Monitored processes
34
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start camera_smi_w72_a05_setup-94rr4_zpe.exe setup.exe is.exe isbew64.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs executebatch-win.exe no specs executebatch-win.exe no specs SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs mptool.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs executebatch-win.exe no specs checkvcamreg.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs camera_smi_w72_a05_setup-94rr4_zpe.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
244C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{797D14F1-300B-4F5E-A662-E9442DC5F708}C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\ISBEW64.exe—IS.exe
User:
admin
Company:
Acresso Software Inc.
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Version:
15.0.498
Modules
Images
c:\users\admin\appdata\local\temp\{4f985272-fa88-446f-9b56-df532a884497}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
444"C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\XYNTService.exe" -i C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\XYNTService.exe—SMIServiceWrapper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{4f985272-fa88-446f-9b56-df532a884497}\{fe7ad27a-62b1-44f6-b69c-25d1eca94f5d}\xyntservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1224"C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\XYNTService.exe" -i C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\XYNTService.exe—SMIServiceWrapper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files (x86)\smi\virtual webcam\driverpackage\xyntservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1792C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\ExecuteBatch-Win.exe -delete_regC:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\ExecuteBatch-Win.exe—IS.exe
User:
admin
Company:
SiliconMotion Inc.
Integrity Level:
HIGH
Description:
ExecuteBatch-Win.exe
Exit code:
2
Version:
1, 0, 0, 17
Modules
Images
c:\users\admin\appdata\local\temp\{4f985272-fa88-446f-9b56-df532a884497}\{fe7ad27a-62b1-44f6-b69c-25d1eca94f5d}\executebatch-win.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2144CheckVcamReg.exe C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\CheckVcamReg.exe—IS.exe
User:
admin
Company:
Silicon Motion Technology Corp.
Integrity Level:
HIGH
Description:
CheckVcamReg
Version:
1.0.0.1
Modules
Images
c:\program files (x86)\smi\virtual webcam\driverpackage\checkvcamreg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—XYNTService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2744"C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\SMIServiceWrapper.exe" -i ExecuteBatch-Win.exeC:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\SMIServiceWrapper.exe—CheckVcamReg.exe
User:
admin
Company:
TODO: <公司名稱>
Integrity Level:
HIGH
Description:
TODO: <檔案說明>
Version:
1.0.0.1
Modules
Images
c:\program files (x86)\smi\virtual webcam\driverpackage\smiservicewrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2828ExecuteBatch-Win.exe -update_regC:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\ExecuteBatch-Win.exe—IS.exe
User:
admin
Company:
SiliconMotion Inc.
Integrity Level:
HIGH
Description:
ExecuteBatch-Win.exe
Exit code:
2
Version:
1, 1, 0, 18
Modules
Images
c:\program files (x86)\smi\virtual webcam\driverpackage\executebatch-win.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
3224C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\XYNTService.exeC:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\XYNTService.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{4f985272-fa88-446f-9b56-df532a884497}\{fe7ad27a-62b1-44f6-b69c-25d1eca94f5d}\xyntservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3436"C:\dell\drivers\94rr4\IS.exe" -w -hide_progress -removeonlyC:\Dell\Drivers\94RR4\IS.exe
setup.exe
User:
admin
Company:
Acresso Software Inc.
Integrity Level:
HIGH
Description:
Setup.exe
Version:
15.0.498
Modules
Images
c:\dell\drivers\94rr4\is.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
3 400
Read events
3 180
Write events
208
Delete events
12

Modification events

(PID) Process:(3436) IS.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000A388104F3146DB016C0D000020180000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6844) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000094E5504F3146DB01BC1A0000241A0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6844) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000C049534F3146DB01BC1A0000241A0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6844) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000004D53C34F3146DB01BC1A0000241A0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
Executable files
81
Suspicious files
25
Text files
43
Unknown types
1

Dropped files

PID
Process
Filename
Type
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\data1.cab —
MD5:—
SHA256:—
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\layout.binbinary
MD5:520CE0C35869439E5F9CD42CD4C72DDB
SHA256:10C6EB4CDBA191393C4F6F8D66C6BE55CD225E3C857473F11A2CFDE356FEA950
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\data2.cabcompressed
MD5:248EB0EA917B7D5AB68F811865C6459B
SHA256:EE7CE988DA80D07BD54CD2F6158B4C72A3DA662EBCE0E5875049927655003D46
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\ISSetup.dllexecutable
MD5:2DD1C4A68E2A8A401018F5EFDAB5ADDE
SHA256:7C173CDAEA8E3A3CC95B7196681CB904F3996F81289D5890B30F38C99EBA45AE
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\data1.hdrcompressed
MD5:213C055F423090D1C18BBDA2DD67AA95
SHA256:B8B2C8795451FAFF6541FBD6C6FF8B79865477DA5F356DC57F18EA9E1473C9EE
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\IS.exeexecutable
MD5:443FC0A0C449097D333CFED5DDFEF06F
SHA256:B44F5CC56CD948D0233E5D3B4D432F5A03FB90DC9407C5AD418EC97DDDDE1E5F
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\setup.initext
MD5:BFB8C63B75994E9DF511DE062C9773EA
SHA256:59BC3437FCBAC28C487D59B6FA0D928A0AD597E90F60AB8E69B6440669DEEAAF
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\_Setup.dllexecutable
MD5:7DE2D19C870587B8FFC5A446E9B6E29A
SHA256:35EEF33D1890A6E34D647F86F24C730B4F741C9D33FCCE01CFB12D2B8E55B5D1
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\setup.inxbinary
MD5:14D5453E87B3E181BFFDA442FC14EF3F
SHA256:00D77317D59C21A7639CCF187FB60B95D594731FE2AE84055BC61E8D5456DE05
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\setup.issbinary
MD5:C2ED7195993A9D2785E766B36778E9B1
SHA256:AF925E040C2516A694C2339F5715EB55A6709C4E51C38106602770AEE1FFF97C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
39
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
6304
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
7092
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
7092
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
1944
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
—
—
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
5064
SearchApp.exe
2.23.209.154:443
www.bing.com
Akamai International B.V.
GB
unknown
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
4
System
192.168.100.255:138
—
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
unknown
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.9
unknown
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
unknown
google.com
  • 216.58.206.78
unknown
www.bing.com
  • 2.23.209.154
  • 2.23.209.156
  • 2.23.209.166
  • 2.23.209.173
  • 2.23.209.167
  • 2.23.209.162
  • 2.23.209.153
  • 2.23.209.171
  • 2.23.209.168
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
login.live.com
  • 20.190.160.17
  • 40.126.32.134
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.74
unknown
go.microsoft.com
  • 23.32.186.57
unknown
arc.msn.com
  • 20.223.35.26
unknown
fd.api.iris.microsoft.com
  • 20.223.35.26
unknown

Threats

No threats detected
Process
Message
setup.exe
i=0 setup.exe"
setup.exe
Exe=c:\dell\drivers\94rr4\IS.exe
setup.exe
Open reg key fail in WOW64 platform (2)
setup.exe
ROUND <1> ID =3436
MPTool.exe
m_vecVID[0]=090c m_vecPID[0]=037c
MPTool.exe
m_vecVID[1]=090c m_vecPID[1]=037d
MPTool.exe
strParam=-s
MPTool.exe
ScanUSBProc--end
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe