File name:

CaptureBAT-Setup-2.0.0-5574.exe

Full analysis: https://app.any.run/tasks/bbc1fc7e-8605-4c38-b499-745159a79c02
Verdict: Malicious activity
Analysis date: May 25, 2025, 22:41:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

C1894E46FFE89BE6CA35729D9DAB6145

SHA1:

C507C1FEA3C550DC32D4B0238DF47115AB4CD8DE

SHA256:

C91E50A921F07EB7CE510441761DAF38F3E4E6340CF9FAF67E660A3D13BD88E8

SSDEEP:

24576:B4cDmEFhnydPdXKdNtxqD8gXdP0zUlsFXZRRh6:B4cDmEFhydPdXKdNtxqD8gXdMzUls5Zg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • WinPcap_4_1_3.exe (PID: 4988)
      • WinPcap_4_1_3.exe (PID: 5352)
      • WinPcap_4_1_3.exe (PID: 7032)
      • WinPcap_4_1_3.exe (PID: 2876)
      • WinPcap_4_1_3.exe (PID: 7772)
      • WinPcap_4_1_3.exe (PID: 7820)

    • Starts NET.EXE for service management

      • WinPcap_4_1_3.exe (PID: 5352)
      • net.exe (PID: 5504)
      • WinPcap_4_1_3.exe (PID: 2876)
      • net.exe (PID: 1284)
      • net.exe (PID: 8180)
      • WinPcap_4_1_3.exe (PID: 7820)

    • Changes the autorun value in the registry

      • rundll32.exe (PID: 728)
      • rundll32.exe (PID: 1300)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)

    • Executable content was dropped or overwritten

      • WinPcap_4_1_3.exe (PID: 5352)
      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)
      • rundll32.exe (PID: 728)
      • WinPcap_4_1_3.exe (PID: 2876)
      • Uninstall.exe (PID: 7644)
      • Au_.exe (PID: 7676)
      • WinPcap_4_1_3.exe (PID: 7820)

    • The process creates files with name similar to system file names

      • WinPcap_4_1_3.exe (PID: 5352)

    • Creates files in the driver directory

      • WinPcap_4_1_3.exe (PID: 5352)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • WinPcap_4_1_3.exe (PID: 5352)
      • WinPcap_4_1_3.exe (PID: 2876)
      • Au_.exe (PID: 7676)
      • WinPcap_4_1_3.exe (PID: 7820)

    • Drops a system driver (possible attempt to evade defenses)

      • WinPcap_4_1_3.exe (PID: 5352)
      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)
      • rundll32.exe (PID: 728)
      • WinPcap_4_1_3.exe (PID: 7820)

    • Creates or modifies Windows services

      • WinPcap_4_1_3.exe (PID: 5352)

    • Creates a software uninstall entry

      • WinPcap_4_1_3.exe (PID: 5352)
      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)

    • Drops 7-zip archiver for unpacking

      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 1672)

    • Starts itself from another location

      • Uninstall.exe (PID: 7644)

  • INFO

    • Checks supported languages

      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)
      • WinPcap_4_1_3.exe (PID: 5352)

    • Reads the computer name

      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)
      • WinPcap_4_1_3.exe (PID: 5352)

    • Manual execution by a user

      • WinPcap_4_1_3.exe (PID: 4988)
      • WinPcap_4_1_3.exe (PID: 5352)
      • cmd.exe (PID: 6972)
      • notepad.exe (PID: 6504)
      • notepad.exe (PID: 6704)
      • msedge.exe (PID: 6604)
      • WinPcap_4_1_3.exe (PID: 7032)
      • WinPcap_4_1_3.exe (PID: 2876)
      • Uninstall.exe (PID: 7644)
      • Uninstall.exe (PID: 7584)
      • WinPcap_4_1_3.exe (PID: 7772)
      • WinPcap_4_1_3.exe (PID: 7820)
      • CaptureBAT.exe (PID: 2624)
      • cmd.exe (PID: 4156)

    • Create files in a temporary directory

      • WinPcap_4_1_3.exe (PID: 5352)

    • Creates files in the program directory

      • WinPcap_4_1_3.exe (PID: 5352)
      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)

    • The sample compiled with english language support

      • WinPcap_4_1_3.exe (PID: 5352)
      • CaptureBAT-Setup-2.0.0-5574.exe (PID: 6876)
      • WinPcap_4_1_3.exe (PID: 2876)
      • Uninstall.exe (PID: 7644)
      • WinPcap_4_1_3.exe (PID: 7820)
      • msedge.exe (PID: 4776)

    • Reads the time zone

      • runonce.exe (PID: 5244)
      • runonce.exe (PID: 6752)

    • Reads security settings of Internet Explorer

      • runonce.exe (PID: 5244)
      • runonce.exe (PID: 6752)

    • Creates files in the driver directory

      • rundll32.exe (PID: 728)

    • Application launched itself

      • msedge.exe (PID: 6604)
      • msedge.exe (PID: 2748)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 4776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:07:14 15:12:54+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 23552
InitializedDataSize: 164864
UninitializedDataSize: 1024
EntryPoint: 0x30fb
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
391
Monitored processes
89
Malicious processes
4
Suspicious processes
5

Behavior graph

Click at the process to see the details
start capturebat-setup-2.0.0-5574.exe sppextcomobj.exe no specs slui.exe no specs winpcap_4_1_3.exe no specs winpcap_4_1_3.exe net.exe no specs conhost.exe no specs net1.exe no specs rundll32.exe runonce.exe no specs grpconv.exe no specs rundll32.exe runonce.exe no specs grpconv.exe no specs plugscheduler.exe no specs cmd.exe conhost.exe no specs capturebat.exe no specs notepad.exe no specs notepad.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs capturebat.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winpcap_4_1_3.exe no specs winpcap_4_1_3.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs uninstall.exe no specs uninstall.exe au_.exe winpcap_4_1_3.exe no specs winpcap_4_1_3.exe msedge.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs capturebat.exe no specs capturebat.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs capturebat.exe no specs conhost.exe no specs cmd.exe conhost.exe no specs msedge.exe no specs capturebat.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs capturebat.exe no specs msedge.exe no specs capturebat.exe no specs capturebat-setup-2.0.0-5574.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728rundll32 setupapi.dll,InstallHinfSection DefaultInstall 0 C:\Program Files (x86)\Capture\FileMonitorInstallation.infC:\Windows\SysWOW64\rundll32.exe
CaptureBAT-Setup-2.0.0-5574.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
968"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=2376,i,2543075071855483320,6295305684486182778,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1036CaptureBAT.exe -n -cC:\Program Files (x86)\Capture\CaptureBAT.exe—cmd.exe
User:
admin
Company:
Victoria University of Wellington and the New Zealand Honeynet Project
Integrity Level:
HIGH
Description:
Capture
Exit code:
3221225786
Version:
2.0.0
Modules
Images
c:\program files (x86)\capture\capturebat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
1072"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2640 --field-trial-handle=2344,i,4510956027799783386,5574344552688678864,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128"C:\Windows\System32\grpconv.exe" -oC:\Windows\SysWOW64\grpconv.exe—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1196"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5512 --field-trial-handle=2344,i,4510956027799783386,5574344552688678864,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1248CaptureBAT.exe -n -cC:\Program Files (x86)\Capture\CaptureBAT.exe—cmd.exe
User:
admin
Company:
Victoria University of Wellington and the New Zealand Honeynet Project
Integrity Level:
HIGH
Description:
Capture
Exit code:
3221225786
Version:
2.0.0
Modules
Images
c:\program files (x86)\capture\capturebat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1284net start npfC:\Windows\SysWOW64\net.exe—WinPcap_4_1_3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1300rundll32 setupapi.dll,InstallHinfSection DefaultUninstall 0 C:\Program Files (x86)\Capture\FileMonitorInstallation.infC:\Windows\SysWOW64\rundll32.exe
CaptureBAT-Setup-2.0.0-5574.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1672\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 230
Read events
9 161
Write events
65
Delete events
4

Modification events

(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:DisplayName
Value:
WinPcap 4.1.3
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\WinPcap\uninstall.exe
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:Publisher
Value:
Riverbed Technology, Inc.
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:URLInfoAbout
Value:
http://www.riverbed.com/
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:URLUpdateInfo
Value:
http://www.winpcap.org
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:VersionMajor
Value:
4
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:VersionMinor
Value:
1
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:DisplayVersion
Value:
4.1.0.2980
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\WinPcap\uninstall.exe
(PID) Process:(5352) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NPF
Operation:writeName:Start
Value:
2
Executable files
92
Suspicious files
775
Text files
188
Unknown types
1

Dropped files

PID
Process
Filename
Type
5352WinPcap_4_1_3.exeC:\Program Files (x86)\WinPcap\install.logtext
MD5:D3A2BC3BA963A1C99679AADFE8BD4519
SHA256:2F8CB362E387E17AFCD55D982DB30F2BD5DB0AA8242C89BC35EF3EEA32AE4E08
5352WinPcap_4_1_3.exeC:\Users\admin\AppData\Local\Temp\nscEEE7.tmp\modern-header.bmpimage
MD5:D8F59A707B2A5000C7903595EDDC3D48
SHA256:C0E284FDE834FE8A6F90504DBA7ABFF25B1E7DD4611483341203FD3EFC5DE8A6
5352WinPcap_4_1_3.exeC:\Users\admin\AppData\Local\Temp\nscEEE7.tmp\ioSpecial.initext
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
5352WinPcap_4_1_3.exeC:\Users\admin\AppData\Local\Temp\nscEEE7.tmp\UserInfo.dllexecutable
MD5:7579ADE7AE1747A31960A228CE02E666
SHA256:564C80DEC62D76C53497C40094DB360FF8A36E0DC1BDA8383D0F9583138997F5
5352WinPcap_4_1_3.exeC:\Users\admin\AppData\Local\Temp\nscEEE7.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
5352WinPcap_4_1_3.exeC:\Users\admin\AppData\Local\Temp\nscEEE7.tmp\bootOptions.inibinary
MD5:9F64B7E590B32B5BA414F4301FB8B3D5
SHA256:F6F2E247226AB06E9B56AE2D10CCD02D9298ABCCAC85C56ABFA19E5587446D54
5352WinPcap_4_1_3.exeC:\Users\admin\AppData\Local\Temp\nscEEE7.tmp\InstallOptions.dllexecutable
MD5:325B008AEC81E5AAA57096F05D4212B5
SHA256:C9CD5C9609E70005926AE5171726A4142FFBCCCC771D307EFCD195DAFC1E6B4B
5352WinPcap_4_1_3.exeC:\Program Files (x86)\WinPcap\WinPcapInstall.dllexecutable
MD5:E78291558CB803DFD091AD8FB56FEECC
SHA256:D9F4CD9F0E1BC9A138FB4DA6F83C92C3E86EB3DE4F988D5943D75C9B1DC6BB9D
5352WinPcap_4_1_3.exeC:\Program Files (x86)\WinPcap\rpcapd.exeexecutable
MD5:83A6C2CAFE236652D1559640594A0EA8
SHA256:52360F17C9C70C9CEA3316560B40C4D89FD705ED7E6B6088C99FC54D4CC35EB5
5352WinPcap_4_1_3.exeC:\Windows\SysWOW64\Packet.dllexecutable
MD5:86316BE34481C1ED5B792169312673FD
SHA256:49656C178B17198470AD6906E9EE0865F16F01C1DBBF11C613B55A07246A7918
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
148
DNS requests
133
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8024
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3306b655-8319-4199-8014-458f0c48d21f?P1=1748406826&P2=404&P3=2&P4=RZb%2fy96qOEqQ292LkOrt3mzF%2brmS9C3DQEb8kJlMvhZNM%2bF9PJ1o%2fMbNtbTfxH%2fc8uQcYrBQdiP7v5gbgEtI%2bg%3d%3d
unknown
—
—
whitelisted
8024
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2ef98485-cbad-4d99-b4c2-cd4abac73fb4?P1=1748537945&P2=404&P3=2&P4=CTII2rK1BlTD8%2bsrLyPMcv3N00QjP45sAFeHXONpEiECCMJzQNXhCkO3P2Qwia4PvANrOGpfl%2fWsDN5s3AAUgw%3d%3d
unknown
—
—
whitelisted
8024
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2ef98485-cbad-4d99-b4c2-cd4abac73fb4?P1=1748537945&P2=404&P3=2&P4=CTII2rK1BlTD8%2bsrLyPMcv3N00QjP45sAFeHXONpEiECCMJzQNXhCkO3P2Qwia4PvANrOGpfl%2fWsDN5s3AAUgw%3d%3d
unknown
—
—
whitelisted
8024
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3306b655-8319-4199-8014-458f0c48d21f?P1=1748406826&P2=404&P3=2&P4=RZb%2fy96qOEqQ292LkOrt3mzF%2brmS9C3DQEb8kJlMvhZNM%2bF9PJ1o%2fMbNtbTfxH%2fc8uQcYrBQdiP7v5gbgEtI%2bg%3d%3d
unknown
—
—
whitelisted
8024
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3306b655-8319-4199-8014-458f0c48d21f?P1=1748406826&P2=404&P3=2&P4=RZb%2fy96qOEqQ292LkOrt3mzF%2brmS9C3DQEb8kJlMvhZNM%2bF9PJ1o%2fMbNtbTfxH%2fc8uQcYrBQdiP7v5gbgEtI%2bg%3d%3d
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5148
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.3
  • 20.190.159.4
  • 20.190.159.128
  • 40.126.31.71
  • 40.126.31.67
  • 40.126.31.128
  • 40.126.31.130
  • 40.126.31.69
  • 20.190.159.130
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.131
  • 40.126.31.129
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
self.events.data.microsoft.com
  • 20.42.73.30
  • 20.189.173.6
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted

Threats

PID
Process
Class
Message
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CaptureBAT-Setup-2.0.0-5574.exe