File name:

CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe

Full analysis: https://app.any.run/tasks/37d6891b-104a-42cf-9508-449cd55162da
Verdict: Malicious activity
Analysis date: December 04, 2024, 09:45:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

AB97274DFA0C17CC4BA0B7EED0301C84

SHA1:

DCD52422C474CA74F1F142D3CBE61420D0F54FD2

SHA256:

566321110E78480726F6AF1084A3BA900F5F49E57DE340E56F920D2139F9694A

SSDEEP:

98304:UtCWkQ+UrQh8YYLTZpCC/lL2HdfnoyVHiUpi9d52DGwsqv6lwYSXxKr2LF9Oo6SK:lMo9aqRm4ncaa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • ISBEW64.exe (PID: 244)

    • Registers / Runs the DLL via REGSVR32.EXE

      • IS.exe (PID: 3436)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe (PID: 6648)
      • IS.exe (PID: 3436)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 3992)
      • CheckVcamReg.exe (PID: 2144)

    • Executes as Windows Service

      • XYNTService.exe (PID: 3224)
      • VSSVC.exe (PID: 6936)

    • The process deletes folder without confirmation

      • ExecuteBatch-Win.exe (PID: 4136)

    • Starts CMD.EXE for commands execution

      • ExecuteBatch-Win.exe (PID: 4136)

    • Likely accesses (executes) a file from the Public directory

      • cmd.exe (PID: 5252)

    • The process drops C-runtime libraries

      • IS.exe (PID: 3436)

    • Process drops legitimate windows executable

      • IS.exe (PID: 3436)

  • INFO

    • Checks supported languages

      • CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe (PID: 6648)
      • setup.exe (PID: 3992)
      • SMIServiceWrapper.exe (PID: 5916)
      • XYNTService.exe (PID: 5256)
      • SMIServiceWrapper.exe (PID: 5696)
      • ExecuteBatch-Win.exe (PID: 4864)
      • ExecuteBatch-Win.exe (PID: 2828)
      • CheckVcamReg.exe (PID: 2144)
      • SMIServiceWrapper.exe (PID: 2744)
      • XYNTService.exe (PID: 1224)

    • Reads the computer name

      • CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe (PID: 6648)
      • XYNTService.exe (PID: 5256)
      • SMIServiceWrapper.exe (PID: 5696)
      • XYNTService.exe (PID: 1224)

    • Sends debugging messages

      • setup.exe (PID: 3992)

    • The process uses the downloaded file

      • setup.exe (PID: 3992)

    • Create files in a temporary directory

      • IS.exe (PID: 3436)

    • Process checks computer location settings

      • SMIServiceWrapper.exe (PID: 5916)
      • SMIServiceWrapper.exe (PID: 5696)

    • Manages system restore points

      • SrTasks.exe (PID: 5076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:10:17 19:35:08+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 77824
InitializedDataSize: 139264
UninitializedDataSize: -
EntryPoint: 0xedb2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.3.1.12
ProductVersionNumber: 1.3.1.12
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: -
FileVersion: 1.3.1.12
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
161
Monitored processes
34
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start camera_smi_w72_a05_setup-94rr4_zpe.exe setup.exe is.exe isbew64.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs executebatch-win.exe no specs executebatch-win.exe no specs SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs mptool.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs executebatch-win.exe no specs checkvcamreg.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs camera_smi_w72_a05_setup-94rr4_zpe.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
244C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{797D14F1-300B-4F5E-A662-E9442DC5F708}C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\ISBEW64.exe—IS.exe
User:
admin
Company:
Acresso Software Inc.
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Version:
15.0.498
Modules
Images
c:\users\admin\appdata\local\temp\{4f985272-fa88-446f-9b56-df532a884497}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
444"C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\XYNTService.exe" -i C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\XYNTService.exe—SMIServiceWrapper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{4f985272-fa88-446f-9b56-df532a884497}\{fe7ad27a-62b1-44f6-b69c-25d1eca94f5d}\xyntservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1224"C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\XYNTService.exe" -i C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\XYNTService.exe—SMIServiceWrapper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files (x86)\smi\virtual webcam\driverpackage\xyntservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1792C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\ExecuteBatch-Win.exe -delete_regC:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\ExecuteBatch-Win.exe—IS.exe
User:
admin
Company:
SiliconMotion Inc.
Integrity Level:
HIGH
Description:
ExecuteBatch-Win.exe
Exit code:
2
Version:
1, 0, 0, 17
Modules
Images
c:\users\admin\appdata\local\temp\{4f985272-fa88-446f-9b56-df532a884497}\{fe7ad27a-62b1-44f6-b69c-25d1eca94f5d}\executebatch-win.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2144CheckVcamReg.exe C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\CheckVcamReg.exe—IS.exe
User:
admin
Company:
Silicon Motion Technology Corp.
Integrity Level:
HIGH
Description:
CheckVcamReg
Version:
1.0.0.1
Modules
Images
c:\program files (x86)\smi\virtual webcam\driverpackage\checkvcamreg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—XYNTService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2744"C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\SMIServiceWrapper.exe" -i ExecuteBatch-Win.exeC:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\SMIServiceWrapper.exe—CheckVcamReg.exe
User:
admin
Company:
TODO: <公司名稱>
Integrity Level:
HIGH
Description:
TODO: <檔案說明>
Version:
1.0.0.1
Modules
Images
c:\program files (x86)\smi\virtual webcam\driverpackage\smiservicewrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2828ExecuteBatch-Win.exe -update_regC:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\ExecuteBatch-Win.exe—IS.exe
User:
admin
Company:
SiliconMotion Inc.
Integrity Level:
HIGH
Description:
ExecuteBatch-Win.exe
Exit code:
2
Version:
1, 1, 0, 18
Modules
Images
c:\program files (x86)\smi\virtual webcam\driverpackage\executebatch-win.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
3224C:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\XYNTService.exeC:\Users\admin\AppData\Local\Temp\{4F985272-FA88-446F-9B56-DF532A884497}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\XYNTService.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{4f985272-fa88-446f-9b56-df532a884497}\{fe7ad27a-62b1-44f6-b69c-25d1eca94f5d}\xyntservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3436"C:\dell\drivers\94rr4\IS.exe" -w -hide_progress -removeonlyC:\Dell\Drivers\94RR4\IS.exe
setup.exe
User:
admin
Company:
Acresso Software Inc.
Integrity Level:
HIGH
Description:
Setup.exe
Version:
15.0.498
Modules
Images
c:\dell\drivers\94rr4\is.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
3 400
Read events
3 180
Write events
208
Delete events
12

Modification events

(PID) Process:(3436) IS.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000A388104F3146DB016C0D000020180000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6844) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000094E5504F3146DB01BC1A0000241A0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6844) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000C049534F3146DB01BC1A0000241A0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6844) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000004D53C34F3146DB01BC1A0000241A0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(6936) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
Executable files
81
Suspicious files
25
Text files
43
Unknown types
1

Dropped files

PID
Process
Filename
Type
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\data1.cab —
MD5:—
SHA256:—
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\data2.cabcompressed
MD5:248EB0EA917B7D5AB68F811865C6459B
SHA256:EE7CE988DA80D07BD54CD2F6158B4C72A3DA662EBCE0E5875049927655003D46
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\data1.hdrcompressed
MD5:213C055F423090D1C18BBDA2DD67AA95
SHA256:B8B2C8795451FAFF6541FBD6C6FF8B79865477DA5F356DC57F18EA9E1473C9EE
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\setup.issbinary
MD5:C2ED7195993A9D2785E766B36778E9B1
SHA256:AF925E040C2516A694C2339F5715EB55A6709C4E51C38106602770AEE1FFF97C
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\setup.inxbinary
MD5:14D5453E87B3E181BFFDA442FC14EF3F
SHA256:00D77317D59C21A7639CCF187FB60B95D594731FE2AE84055BC61E8D5456DE05
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\_Setup.dllexecutable
MD5:7DE2D19C870587B8FFC5A446E9B6E29A
SHA256:35EEF33D1890A6E34D647F86F24C730B4F741C9D33FCCE01CFB12D2B8E55B5D1
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\setup.exeexecutable
MD5:B633E0F7C3FEFF673F6E755877B009FE
SHA256:6A0FC35DC530FFEBD16FB7A47525DBC837DF1FC187E25459BD4B116DEC2A969F
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\SilentSetup.battext
MD5:173A04C8C96F2EA2B87B8512C8A1ACDD
SHA256:9EE167F680D9794576B62916DA84E5CB778AAF6AFE756263AE0D21D970A9DD03
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\unsetup.issbinary
MD5:F6298931D4AA8ADED569719FFD44C6B7
SHA256:B9CD21A577B59393331ABCF0EEE97DDA7E154AB68E2F588ACD06D0E8C5269BED
6648CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\Version.txttext
MD5:E9C215228416125801A367A81F4D10D8
SHA256:3F45FAFA7DAD728F616137BC87E97DE5B7CC301B7914DFDCDBA1576393B8BF8E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
39
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
6304
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
7092
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
7092
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
1944
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
—
—
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
5064
SearchApp.exe
2.23.209.154:443
www.bing.com
Akamai International B.V.
GB
unknown
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
4
System
192.168.100.255:138
—
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
unknown
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.9
unknown
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
unknown
google.com
  • 216.58.206.78
unknown
www.bing.com
  • 2.23.209.154
  • 2.23.209.156
  • 2.23.209.166
  • 2.23.209.173
  • 2.23.209.167
  • 2.23.209.162
  • 2.23.209.153
  • 2.23.209.171
  • 2.23.209.168
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
login.live.com
  • 20.190.160.17
  • 40.126.32.134
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.74
unknown
go.microsoft.com
  • 23.32.186.57
unknown
arc.msn.com
  • 20.223.35.26
unknown
fd.api.iris.microsoft.com
  • 20.223.35.26
unknown

Threats

No threats detected
Process
Message
setup.exe
i=0 setup.exe"
setup.exe
Exe=c:\dell\drivers\94rr4\IS.exe
setup.exe
Open reg key fail in WOW64 platform (2)
setup.exe
ROUND <1> ID =3436
MPTool.exe
m_vecVID[0]=090c m_vecPID[0]=037c
MPTool.exe
m_vecVID[1]=090c m_vecPID[1]=037d
MPTool.exe
strParam=-s
MPTool.exe
ScanUSBProc--end
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe