File name:

CaptureBAT-Setup-2.0.0-5574.exe

Full analysis: https://app.any.run/tasks/bbc1fc7e-8605-4c38-b499-745159a79c02
Verdict: Malicious activity
Analysis date: May 25, 2025, 22:41:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

C1894E46FFE89BE6CA35729D9DAB6145

SHA1:

C507C1FEA3C550DC32D4B0238DF47115AB4CD8DE

SHA256:

C91E50A921F07EB7CE510441761DAF38F3E4E6340CF9FAF67E660A3D13BD88E8

SSDEEP:

24576:B4cDmEFhnydPdXKdNtxqD8gXdP0zUlsFXZRRh6:B4cDmEFhydPdXKdNtxqD8gXdMzUls5Zg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • WinPcap_4_1_3.exe (PID: 4988)
      • WinPcap_4_1_3.exe (PID: 5352)
      • WinPcap_4_1_3.exe (PID: 7032)
      • WinPcap_4_1_3.exe (PID: 2876)
      • WinPcap_4_1_3.exe (PID: 7820)
      • WinPcap_4_1_3.exe (PID: 7772)

    • Changes the autorun value in the registry

      • rundll32.exe (PID: 1300)
      • rundll32.exe (PID: 728)

    • Starts NET.EXE for service management

      • net.exe (PID: 5504)
      • WinPcap_4_1_3.exe (PID: 5352)
      • net.exe (PID: 1284)
      • WinPcap_4_1_3.exe (PID: 2876)
      • WinPcap_4_1_3.exe (PID: 7820)
      • net.exe (PID: 8180)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • WinPcap_4_1_3.exe (PID: 5352)
      • WinPcap_4_1_3.exe (PID: 2876)
      • WinPcap_4_1_3.exe (PID: 7820)
      • Au_.exe (PID: 7676)

    • The process creates files with name similar to system file names

      • WinPcap_4_1_3.exe (PID: 5352)

    • Creates a software uninstall entry

      • WinPcap_4_1_3.exe (PID: 5352)
      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)

    • There is functionality for taking screenshot (YARA)

      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)

    • Creates or modifies Windows services

      • WinPcap_4_1_3.exe (PID: 5352)

    • Drops a system driver (possible attempt to evade defenses)

      • WinPcap_4_1_3.exe (PID: 5352)
      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)
      • rundll32.exe (PID: 728)
      • WinPcap_4_1_3.exe (PID: 7820)

    • Drops 7-zip archiver for unpacking

      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)

    • Executable content was dropped or overwritten

      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)
      • rundll32.exe (PID: 728)
      • WinPcap_4_1_3.exe (PID: 5352)
      • WinPcap_4_1_3.exe (PID: 2876)
      • WinPcap_4_1_3.exe (PID: 7820)
      • Au_.exe (PID: 7676)
      • Uninstall.exe (PID: 7644)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 1672)

    • Creates files in the driver directory

      • WinPcap_4_1_3.exe (PID: 5352)

    • Starts itself from another location

      • Uninstall.exe (PID: 7644)

  • INFO

    • Reads the computer name

      • WinPcap_4_1_3.exe (PID: 5352)
      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)

    • Checks supported languages

      • WinPcap_4_1_3.exe (PID: 5352)
      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)

    • Creates files in the program directory

      • WinPcap_4_1_3.exe (PID: 5352)
      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)

    • Create files in a temporary directory

      • WinPcap_4_1_3.exe (PID: 5352)

    • Reads the time zone

      • runonce.exe (PID: 5244)
      • runonce.exe (PID: 6752)

    • Reads security settings of Internet Explorer

      • runonce.exe (PID: 6752)
      • runonce.exe (PID: 5244)

    • Manual execution by a user

      • cmd.exe (PID: 6972)
      • notepad.exe (PID: 6704)
      • msedge.exe (PID: 6604)
      • WinPcap_4_1_3.exe (PID: 5352)
      • WinPcap_4_1_3.exe (PID: 4988)
      • notepad.exe (PID: 6504)
      • WinPcap_4_1_3.exe (PID: 7032)
      • WinPcap_4_1_3.exe (PID: 2876)
      • WinPcap_4_1_3.exe (PID: 7772)
      • Uninstall.exe (PID: 7644)
      • Uninstall.exe (PID: 7584)
      • WinPcap_4_1_3.exe (PID: 7820)
      • CaptureBAT.exe (PID: 2624)
      • cmd.exe (PID: 4156)

    • Creates files in the driver directory

      • rundll32.exe (PID: 728)

    • Application launched itself

      • msedge.exe (PID: 6604)
      • msedge.exe (PID: 2748)

    • The sample compiled with english language support

      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)
      • WinPcap_4_1_3.exe (PID: 5352)
      • WinPcap_4_1_3.exe (PID: 2876)
      • Uninstall.exe (PID: 7644)
      • msedge.exe (PID: 4776)
      • WinPcap_4_1_3.exe (PID: 7820)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 4776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:07:14 15:12:54+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 23552
InitializedDataSize: 164864
UninitializedDataSize: 1024
EntryPoint: 0x30fb
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
391
Monitored processes
89
Malicious processes
4
Suspicious processes
5

Behavior graph

Click at the process to see the details
start capturebat-setup-2.0.0-5574.exe sppextcomobj.exe no specs slui.exe no specs winpcap_4_1_3.exe no specs winpcap_4_1_3.exe net.exe no specs conhost.exe no specs net1.exe no specs rundll32.exe runonce.exe no specs grpconv.exe no specs rundll32.exe runonce.exe no specs grpconv.exe no specs plugscheduler.exe no specs cmd.exe conhost.exe no specs capturebat.exe no specs notepad.exe no specs notepad.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs capturebat.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winpcap_4_1_3.exe no specs winpcap_4_1_3.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs uninstall.exe no specs uninstall.exe au_.exe winpcap_4_1_3.exe no specs winpcap_4_1_3.exe msedge.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs capturebat.exe no specs capturebat.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs capturebat.exe no specs conhost.exe no specs cmd.exe conhost.exe no specs msedge.exe no specs capturebat.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs capturebat.exe no specs msedge.exe no specs capturebat.exe no specs capturebat-setup-2.0.0-5574.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728rundll32 setupapi.dll,InstallHinfSection DefaultInstall 0 C:\Program Files (x86)\Capture\FileMonitorInstallation.infC:\Windows\SysWOW64\rundll32.exe
CaptureBAT-Setup-2.0.0-5574.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
968"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=2376,i,2543075071855483320,6295305684486182778,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1036CaptureBAT.exe -n -cC:\Program Files (x86)\Capture\CaptureBAT.exe—cmd.exe
User:
admin
Company:
Victoria University of Wellington and the New Zealand Honeynet Project
Integrity Level:
HIGH
Description:
Capture
Exit code:
3221225786
Version:
2.0.0
Modules
Images
c:\program files (x86)\capture\capturebat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
1072"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2640 --field-trial-handle=2344,i,4510956027799783386,5574344552688678864,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128"C:\Windows\System32\grpconv.exe" -oC:\Windows\SysWOW64\grpconv.exe—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1196"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5512 --field-trial-handle=2344,i,4510956027799783386,5574344552688678864,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1248CaptureBAT.exe -n -cC:\Program Files (x86)\Capture\CaptureBAT.exe—cmd.exe
User:
admin
Company:
Victoria University of Wellington and the New Zealand Honeynet Project
Integrity Level:
HIGH
Description:
Capture
Exit code:
3221225786
Version:
2.0.0
Modules
Images
c:\program files (x86)\capture\capturebat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1284net start npfC:\Windows\SysWOW64\net.exe—WinPcap_4_1_3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1300rundll32 setupapi.dll,InstallHinfSection DefaultUninstall 0 C:\Program Files (x86)\Capture\FileMonitorInstallation.infC:\Windows\SysWOW64\rundll32.exe
CaptureBAT-Setup-2.0.0-5574.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1672\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 230
Read events
9 161
Write events
65
Delete events
4

Modification events

(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:DisplayName
Value:
WinPcap 4.1.3
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\WinPcap\uninstall.exe
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:Publisher
Value:
Riverbed Technology, Inc.
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:URLInfoAbout
Value:
http://www.riverbed.com/
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:URLUpdateInfo
Value:
http://www.winpcap.org
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:VersionMajor
Value:
4
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:VersionMinor
Value:
1
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:DisplayVersion
Value:
4.1.0.2980
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\WinPcap\uninstall.exe
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NPF
Operation:writeName:Start
Value:
2
Executable files
92
Suspicious files
775
Text files
188
Unknown types
1

Dropped files

PID
Process
Filename
Type
5352WinPcap_4_1_3.exeC:\Users\admin\AppData\Local\Temp\nscEEE7.tmp\UserInfo.dllexecutable
MD5:7579ADE7AE1747A31960A228CE02E666
SHA256:564C80DEC62D76C53497C40094DB360FF8A36E0DC1BDA8383D0F9583138997F5
5352WinPcap_4_1_3.exeC:\Users\admin\AppData\Local\Temp\nscEEE7.tmp\modern-header.bmpimage
MD5:D8F59A707B2A5000C7903595EDDC3D48
SHA256:C0E284FDE834FE8A6F90504DBA7ABFF25B1E7DD4611483341203FD3EFC5DE8A6
5352WinPcap_4_1_3.exeC:\Users\admin\AppData\Local\Temp\nscEEE7.tmp\bootOptions.inibinary
MD5:9F64B7E590B32B5BA414F4301FB8B3D5
SHA256:F6F2E247226AB06E9B56AE2D10CCD02D9298ABCCAC85C56ABFA19E5587446D54
5352WinPcap_4_1_3.exeC:\Windows\SysWOW64\pthreadVC.dllexecutable
MD5:F04A90F917BA10AE2DCBE859870F4DEA
SHA256:99C61ABF41C3AEC38CAB3ED6270ADBCA9A247BBF5F9AA9D29ECB0659A5527F48
5352WinPcap_4_1_3.exeC:\Program Files (x86)\WinPcap\rpcapd.exeexecutable
MD5:83A6C2CAFE236652D1559640594A0EA8
SHA256:52360F17C9C70C9CEA3316560B40C4D89FD705ED7E6B6088C99FC54D4CC35EB5
5352WinPcap_4_1_3.exeC:\Users\admin\AppData\Local\Temp\nscEEE7.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
5352WinPcap_4_1_3.exeC:\Users\admin\AppData\Local\Temp\nscEEE7.tmp\ExecDos.dllexecutable
MD5:A7CD6206240484C8436C66AFB12BDFBF
SHA256:69AC56D2FDF3C71B766D3CC49B33B36F1287CC2503310811017467DFCB455926
5352WinPcap_4_1_3.exeC:\Program Files (x86)\WinPcap\install.logtext
MD5:D3A2BC3BA963A1C99679AADFE8BD4519
SHA256:2F8CB362E387E17AFCD55D982DB30F2BD5DB0AA8242C89BC35EF3EEA32AE4E08
5352WinPcap_4_1_3.exeC:\Program Files (x86)\WinPcap\WinPcapInstall.dllexecutable
MD5:E78291558CB803DFD091AD8FB56FEECC
SHA256:D9F4CD9F0E1BC9A138FB4DA6F83C92C3E86EB3DE4F988D5943D75C9B1DC6BB9D
5352WinPcap_4_1_3.exeC:\Windows\SysWOW64\Packet.dllexecutable
MD5:86316BE34481C1ED5B792169312673FD
SHA256:49656C178B17198470AD6906E9EE0865F16F01C1DBBF11C613B55A07246A7918
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
148
DNS requests
133
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5148
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6152
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6152
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4752
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5796
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
2708
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.3
  • 20.190.159.4
  • 20.190.159.128
  • 40.126.31.71
  • 40.126.31.67
  • 40.126.31.128
  • 40.126.31.130
  • 40.126.31.69
  • 20.190.159.130
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.131
  • 40.126.31.129
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
self.events.data.microsoft.com
  • 20.42.73.30
  • 20.189.173.6
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted

Threats

PID
Process
Class
Message
2308
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2308
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2308
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2308
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2308
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2308
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
3944
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
3944
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
3944
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
3944
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CaptureBAT-Setup-2.0.0-5574.exe