File name:

ChimeraInstaller.exe

Full analysis: https://app.any.run/tasks/953b2cb3-865b-443a-bc04-f25768a074e7
Verdict: Malicious activity
Analysis date: May 23, 2025, 08:52:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
themida
upx
lua
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

1BFC807D5C951B60C0B2650C5D11E555

SHA1:

1D55D59BA96A921B09198D3CB00D91AD5B663C74

SHA256:

E5BE70CF81EEA22F2DF50DB96ECD650FA7AB7E4627B5FE5ABE793A691F412CD8

SSDEEP:

98304:mUzfXT8EO91YpOenngE/lrmefKZOHIWVaYRbGhlUN8mzDZx2dqyY+nK8fG0AEsvG:GVDDqZHj4ZnwhYW0BUusBLnKyG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • dpinst64.exe (PID: 6512)
      • dpinst64.exe (PID: 5756)
      • dpinst64.exe (PID: 3008)
      • dpinst64.exe (PID: 1240)
      • dpinst64.exe (PID: 8000)
      • dpinst64.exe (PID: 8096)
      • dpinst64.exe (PID: 4560)
      • dpinst64.exe (PID: 1228)
      • dpinst64.exe (PID: 5576)
      • dpinst64.exe (PID: 2288)
      • dpinst64.exe (PID: 5364)
      • dpinst64.exe (PID: 4692)
      • dpinst64.exe (PID: 5392)
      • dpinst64.exe (PID: 7264)
      • dpinst64.exe (PID: 8100)
      • dpinst64.exe (PID: 516)
      • dpinst64.exe (PID: 2908)
      • dpinst64.exe (PID: 7996)
      • dpinst64.exe (PID: 680)
      • dpinst64.exe (PID: 5304)
      • dpinst64.exe (PID: 7308)
      • dpinst64.exe (PID: 3900)
      • dpinst64.exe (PID: 8008)
      • dpinst64.exe (PID: 1228)
      • dpinst64.exe (PID: 6068)
      • dpinst64.exe (PID: 3968)
      • dpinst64.exe (PID: 1600)
      • dpinst64.exe (PID: 3760)
      • dpinst64.exe (PID: 4284)
      • dpinst64.exe (PID: 4572)
      • dpinst64.exe (PID: 7832)
      • dpinst64.exe (PID: 2772)
      • dpinst64.exe (PID: 4464)
      • dpinst64.exe (PID: 872)
      • dpinst64.exe (PID: 7916)
      • dpinst64.exe (PID: 6824)
      • dpinst64.exe (PID: 7960)
      • dpinst64.exe (PID: 8104)
      • dpinst64.exe (PID: 1088)
      • dpinst64.exe (PID: 7876)
      • dpinst64.exe (PID: 5112)
      • dpinst64.exe (PID: 8176)
      • dpinst64.exe (PID: 7312)
      • dpinst64.exe (PID: 6044)
      • dpinst64.exe (PID: 5936)

  • SUSPICIOUS

    • Reads the BIOS version

      • ChimeraInstaller.exe (PID: 7456)

    • Adds/modifies Windows certificates

      • ChimeraInstaller.exe (PID: 7456)

    • There is functionality for taking screenshot (YARA)

      • ChimeraInstaller.exe (PID: 7456)

    • Executable content was dropped or overwritten

      • irsetup.exe (PID: 1188)
      • b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exe (PID: 6112)
      • ChimeraInstaller.exe (PID: 7456)
      • dpinst64.exe (PID: 8000)
      • drvinst.exe (PID: 7200)
      • acde7ba8f28d2395454f5e394fa4a9b118f9d9dc.exe (PID: 7232)
      • irsetup.exe (PID: 1672)
      • drvinst.exe (PID: 4284)
      • drvinst.exe (PID: 7612)
      • drvinst.exe (PID: 5756)
      • drvinst.exe (PID: 1240)
      • drvinst.exe (PID: 208)
      • dpinst64.exe (PID: 5364)
      • drvinst.exe (PID: 7708)
      • drvinst.exe (PID: 7840)
      • 1228d68c662bc087f761f82eb76af633e7c02686.exe (PID: 8084)
      • drvinst.exe (PID: 7908)
      • irsetup.exe (PID: 8128)
      • drvinst.exe (PID: 6044)
      • dpinst64.exe (PID: 516)
      • drvinst.exe (PID: 4408)
      • dpinst64.exe (PID: 2908)
      • dpinst64.exe (PID: 7996)
      • drvinst.exe (PID: 4112)
      • a6013bbd273450b4838da21a135973eb8f41b332.exe (PID: 6744)
      • irsetup.exe (PID: 1388)
      • dpinst64.exe (PID: 8104)
      • drvinst.exe (PID: 4152)
      • drvinst.exe (PID: 5008)
      • drvinst.exe (PID: 7340)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 5640)
      • drvinst.exe (PID: 5404)
      • drvinst.exe (PID: 3132)
      • drvinst.exe (PID: 7448)
      • drvinst.exe (PID: 8000)
      • drvinst.exe (PID: 7948)
      • drvinst.exe (PID: 5084)
      • drvinst.exe (PID: 8084)
      • drvinst.exe (PID: 7100)
      • drvinst.exe (PID: 2896)
      • drvinst.exe (PID: 7464)
      • drvinst.exe (PID: 5256)
      • drvinst.exe (PID: 8096)
      • 220d61d5fef649c8279e49aa446a1441669fbf54.exe (PID: 5392)
      • irsetup.exe (PID: 1748)
      • drvinst.exe (PID: 8184)
      • drvinst.exe (PID: 7304)
      • drvinst.exe (PID: 1272)
      • dpinst64.exe (PID: 8176)
      • drvinst.exe (PID: 7628)
      • drvinst.exe (PID: 4692)
      • 0fad7d45e50203fc9f18f59696c47229bca11cf3.exe (PID: 5756)
      • irsetup.exe (PID: 7872)
      • drvinst.exe (PID: 8172)
      • drvinst.exe (PID: 6676)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 5404)
      • dpinst64.exe (PID: 6044)
      • dpinst64.exe (PID: 5936)
      • drvinst.exe (PID: 8152)
      • 770289e53ed94fa242151110d9c958c17139e98d.exe (PID: 1056)
      • dpinst64.exe (PID: 7312)
      • drvinst.exe (PID: 7316)
      • irsetup.exe (PID: 7976)
      • UsbDkController.exe (PID: 2420)

    • Drops a system driver (possible attempt to evade defenses)

      • irsetup.exe (PID: 1188)
      • dpinst64.exe (PID: 8000)
      • drvinst.exe (PID: 7200)
      • irsetup.exe (PID: 1672)
      • drvinst.exe (PID: 4284)
      • drvinst.exe (PID: 7612)
      • drvinst.exe (PID: 7708)
      • drvinst.exe (PID: 7840)
      • drvinst.exe (PID: 5756)
      • drvinst.exe (PID: 208)
      • dpinst64.exe (PID: 5364)
      • drvinst.exe (PID: 1240)
      • drvinst.exe (PID: 7908)
      • irsetup.exe (PID: 8128)
      • drvinst.exe (PID: 4408)
      • dpinst64.exe (PID: 2908)
      • dpinst64.exe (PID: 516)
      • dpinst64.exe (PID: 7996)
      • drvinst.exe (PID: 4112)
      • irsetup.exe (PID: 1388)
      • drvinst.exe (PID: 6044)
      • drvinst.exe (PID: 4152)
      • drvinst.exe (PID: 7448)
      • dpinst64.exe (PID: 8104)
      • drvinst.exe (PID: 7340)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 5008)
      • drvinst.exe (PID: 5404)
      • drvinst.exe (PID: 7464)
      • drvinst.exe (PID: 7100)
      • drvinst.exe (PID: 7948)
      • drvinst.exe (PID: 5084)
      • drvinst.exe (PID: 8084)
      • drvinst.exe (PID: 3132)
      • drvinst.exe (PID: 5256)
      • drvinst.exe (PID: 8096)
      • drvinst.exe (PID: 7304)
      • irsetup.exe (PID: 1748)
      • drvinst.exe (PID: 2896)
      • dpinst64.exe (PID: 8176)
      • drvinst.exe (PID: 4692)
      • drvinst.exe (PID: 7628)
      • irsetup.exe (PID: 7872)
      • drvinst.exe (PID: 6676)
      • dpinst64.exe (PID: 6044)
      • drvinst.exe (PID: 5404)
      • drvinst.exe (PID: 3888)
      • dpinst64.exe (PID: 7312)
      • drvinst.exe (PID: 7316)
      • irsetup.exe (PID: 7976)
      • UsbDkController.exe (PID: 2420)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2148)

    • Reads security settings of Internet Explorer

      • b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exe (PID: 6112)

    • Process drops legitimate windows executable

      • irsetup.exe (PID: 1188)
      • irsetup.exe (PID: 1672)
      • dpinst64.exe (PID: 5364)
      • drvinst.exe (PID: 7840)
      • drvinst.exe (PID: 208)
      • drvinst.exe (PID: 1240)
      • drvinst.exe (PID: 7708)
      • drvinst.exe (PID: 7908)
      • irsetup.exe (PID: 8128)
      • dpinst64.exe (PID: 2908)
      • dpinst64.exe (PID: 516)
      • drvinst.exe (PID: 4408)
      • dpinst64.exe (PID: 7996)
      • drvinst.exe (PID: 4112)
      • drvinst.exe (PID: 6044)
      • irsetup.exe (PID: 1388)
      • dpinst64.exe (PID: 8104)
      • drvinst.exe (PID: 4152)
      • drvinst.exe (PID: 5640)
      • drvinst.exe (PID: 8000)
      • drvinst.exe (PID: 5084)
      • drvinst.exe (PID: 2896)
      • drvinst.exe (PID: 7464)
      • drvinst.exe (PID: 5256)
      • drvinst.exe (PID: 8184)
      • drvinst.exe (PID: 8096)
      • irsetup.exe (PID: 1748)
      • dpinst64.exe (PID: 8176)
      • drvinst.exe (PID: 4692)
      • drvinst.exe (PID: 1272)
      • drvinst.exe (PID: 7628)
      • msiexec.exe (PID: 7908)
      • drvinst.exe (PID: 6676)
      • irsetup.exe (PID: 7872)
      • drvinst.exe (PID: 8172)
      • drvinst.exe (PID: 7316)
      • dpinst64.exe (PID: 7312)
      • irsetup.exe (PID: 7976)

    • Starts a Microsoft application from unusual location

      • dpinst64.exe (PID: 3008)
      • dpinst64.exe (PID: 5756)
      • dpinst64.exe (PID: 1240)
      • dpinst64.exe (PID: 8000)
      • dpinst64.exe (PID: 6512)
      • dpinst64.exe (PID: 8096)
      • dpinst64.exe (PID: 1228)
      • dpinst64.exe (PID: 5576)
      • dpinst64.exe (PID: 4560)
      • dpinst64.exe (PID: 2288)
      • dpinst64.exe (PID: 8100)
      • dpinst64.exe (PID: 4692)
      • dpinst64.exe (PID: 5364)
      • dpinst64.exe (PID: 5392)
      • dpinst64.exe (PID: 7264)
      • dpinst64.exe (PID: 2908)
      • dpinst64.exe (PID: 516)
      • dpinst64.exe (PID: 7996)
      • dpinst64.exe (PID: 7308)
      • dpinst64.exe (PID: 5304)
      • dpinst64.exe (PID: 3900)
      • dpinst64.exe (PID: 1228)
      • dpinst64.exe (PID: 680)
      • dpinst64.exe (PID: 6068)
      • dpinst64.exe (PID: 8008)
      • dpinst64.exe (PID: 872)
      • dpinst64.exe (PID: 7832)
      • dpinst64.exe (PID: 1600)
      • dpinst64.exe (PID: 3968)
      • dpinst64.exe (PID: 3760)
      • dpinst64.exe (PID: 4284)
      • dpinst64.exe (PID: 4572)
      • dpinst64.exe (PID: 2772)
      • dpinst64.exe (PID: 1088)
      • dpinst64.exe (PID: 4464)
      • dpinst64.exe (PID: 7876)
      • dpinst64.exe (PID: 6824)
      • dpinst64.exe (PID: 7916)
      • dpinst64.exe (PID: 5112)
      • dpinst64.exe (PID: 8104)
      • dpinst64.exe (PID: 7960)
      • dpinst64.exe (PID: 8176)
      • dpinst64.exe (PID: 7312)
      • dpinst64.exe (PID: 6044)
      • dpinst64.exe (PID: 5936)

    • Starts CMD.EXE for commands execution

      • irsetup.exe (PID: 1188)
      • irsetup.exe (PID: 1672)
      • irsetup.exe (PID: 1388)
      • irsetup.exe (PID: 1748)
      • irsetup.exe (PID: 7872)

    • Searches for installed software

      • dllhost.exe (PID: 3888)

    • Application launched itself

      • msiexec.exe (PID: 7908)

  • INFO

    • The sample compiled with english language support

      • ChimeraInstaller.exe (PID: 7456)
      • b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exe (PID: 6112)
      • irsetup.exe (PID: 1672)
      • acde7ba8f28d2395454f5e394fa4a9b118f9d9dc.exe (PID: 7232)
      • drvinst.exe (PID: 7708)
      • drvinst.exe (PID: 7840)
      • drvinst.exe (PID: 5756)
      • drvinst.exe (PID: 208)
      • dpinst64.exe (PID: 5364)
      • drvinst.exe (PID: 1240)
      • drvinst.exe (PID: 7908)
      • 1228d68c662bc087f761f82eb76af633e7c02686.exe (PID: 8084)
      • irsetup.exe (PID: 8128)
      • drvinst.exe (PID: 4408)
      • dpinst64.exe (PID: 2908)
      • dpinst64.exe (PID: 516)
      • dpinst64.exe (PID: 7996)
      • irsetup.exe (PID: 1388)
      • a6013bbd273450b4838da21a135973eb8f41b332.exe (PID: 6744)
      • drvinst.exe (PID: 4112)
      • drvinst.exe (PID: 6044)
      • dpinst64.exe (PID: 8104)
      • drvinst.exe (PID: 4152)
      • drvinst.exe (PID: 7340)
      • drvinst.exe (PID: 7448)
      • drvinst.exe (PID: 5008)
      • drvinst.exe (PID: 5640)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 8000)
      • drvinst.exe (PID: 7464)
      • 220d61d5fef649c8279e49aa446a1441669fbf54.exe (PID: 5392)
      • drvinst.exe (PID: 8184)
      • dpinst64.exe (PID: 8176)
      • drvinst.exe (PID: 1272)
      • irsetup.exe (PID: 1748)
      • irsetup.exe (PID: 7872)
      • msiexec.exe (PID: 7908)
      • drvinst.exe (PID: 8172)
      • 0fad7d45e50203fc9f18f59696c47229bca11cf3.exe (PID: 5756)
      • drvinst.exe (PID: 5404)
      • dpinst64.exe (PID: 6044)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 7316)
      • drvinst.exe (PID: 8152)
      • dpinst64.exe (PID: 7312)
      • dpinst64.exe (PID: 5936)
      • 770289e53ed94fa242151110d9c958c17139e98d.exe (PID: 1056)
      • irsetup.exe (PID: 7976)

    • Process checks whether UAC notifications are on

      • ChimeraInstaller.exe (PID: 7456)

    • Creates files in the program directory

      • ChimeraInstaller.exe (PID: 7456)

    • Reads the time zone

      • ChimeraInstaller.exe (PID: 7456)

    • Process checks computer location settings

      • ChimeraInstaller.exe (PID: 7456)
      • b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exe (PID: 6112)

    • Checks supported languages

      • ChimeraInstaller.exe (PID: 7456)
      • irsetup.exe (PID: 1188)
      • b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exe (PID: 6112)

    • Reads the computer name

      • ChimeraInstaller.exe (PID: 7456)
      • b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exe (PID: 6112)
      • irsetup.exe (PID: 1188)

    • Checks proxy server information

      • ChimeraInstaller.exe (PID: 7456)

    • Themida protector has been detected

      • ChimeraInstaller.exe (PID: 7456)

    • Create files in a temporary directory

      • irsetup.exe (PID: 1188)
      • b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exe (PID: 6112)

    • The sample compiled with arabic language support

      • irsetup.exe (PID: 1188)
      • irsetup.exe (PID: 1672)
      • irsetup.exe (PID: 8128)
      • irsetup.exe (PID: 1388)
      • irsetup.exe (PID: 1748)
      • irsetup.exe (PID: 7872)

    • UPX packer has been detected

      • irsetup.exe (PID: 1188)

    • Manages system restore points

      • SrTasks.exe (PID: 6108)

    • The process uses Lua

      • irsetup.exe (PID: 1188)

    • The sample compiled with korean language support

      • irsetup.exe (PID: 1388)

    • The sample compiled with chinese language support

      • irsetup.exe (PID: 1748)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7908)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 7908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:27 11:17:38+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 21041664
InitializedDataSize: 6166016
UninitializedDataSize: -
EntryPoint: 0x204d058
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 13.88.1015.0
ProductVersionNumber: 13.88.1015.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Euroserver Sro.
FileDescription: Chimera mobile tool installer
InternalName: chimeraInstaller
LegalCopyright: Copyright (C) 2016 Euroserver Sro.
OriginalFileName: ChimeraInstaller.exe
ProductName: Chimera Installer
FileVersion: 13, 88, 1015, 0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
301
Monitored processes
164
Malicious processes
26
Suspicious processes
61

Behavior graph

Click at the process to see the details
start chimerainstaller.exe sppextcomobj.exe no specs slui.exe b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exe irsetup.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs cmd.exe no specs conhost.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs find.exe no specs dpinst64.exe drvinst.exe drvinst.exe no specs SPPSurrogate no specs cmd.exe no specs conhost.exe no specs acde7ba8f28d2395454f5e394fa4a9b118f9d9dc.exe irsetup.exe dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe slui.exe no specs drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe no specs SPPSurrogate no specs cmd.exe no specs conhost.exe no specs 1228d68c662bc087f761f82eb76af633e7c02686.exe irsetup.exe dpinst64.exe drvinst.exe dpinst64.exe drvinst.exe dpinst64.exe drvinst.exe no specs drvinst.exe a6013bbd273450b4838da21a135973eb8f41b332.exe irsetup.exe SPPSurrogate no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe no specs dpinst64.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe no specs drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe no specs drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe no specs drvinst.exe drvinst.exe drvinst.exe SPPSurrogate no specs cmd.exe no specs conhost.exe no specs 220d61d5fef649c8279e49aa446a1441669fbf54.exe irsetup.exe dpinst64.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe cmd.exe no specs conhost.exe no specs 0fad7d45e50203fc9f18f59696c47229bca11cf3.exe irsetup.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msi3796.tmp no specs conhost.exe msiexec.exe no specs drvinst.exe dpinst64.exe drvinst.exe drvinst.exe cmd.exe no specs conhost.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs find.exe no specs dpinst64.exe drvinst.exe dpinst64.exe drvinst.exe SPPSurrogate no specs cmd.exe no specs conhost.exe no specs 770289e53ed94fa242151110d9c958c17139e98d.exe irsetup.exe usbdkcontroller.exe no specs conhost.exe no specs usbdkcontroller.exe conhost.exe no specs chimerainstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{fc792f75-5e89-2243-b05b-b55ffc462bf6}\motousbnet.inf" "9" "4cb309793" "00000000000001FC" "WinSta0\Default" "0000000000000208" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
516"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\Modem_Drivers\DPInst64.exe" /SW /F /SA /SE /LMC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\Modem_Drivers\dpinst64.exe
irsetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
256
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_0\modem_drivers\dpinst64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
616DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{cccb2044-1577-a44b-9522-4f0f8d68d83f}\rimpb_rndis.inf" "9" "49d5286b7" "0000000000000238" "WinSta0\Default" "000000000000023C" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\usb_drivers"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
680"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\ssadsdm2.inf"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe—irsetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
2147483648
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_0\dpinst64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
680C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
872"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\ssudcdf.inf"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe—irsetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
2147483648
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_0\dpinst64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1056"C:\Program Files (x86)\Chimera\Drivers\770289e53ed94fa242151110d9c958c17139e98d.exe" C:\Program Files (x86)\Chimera\Drivers\770289e53ed94fa242151110d9c958c17139e98d.exe
ChimeraInstaller.exe
User:
admin
Company:
Euro-Server s.r.o.
Integrity Level:
HIGH
Description:
ChimeraTool USBDK driver installer
Version:
4.0.0.0
Modules
Images
c:\program files (x86)\chimera\drivers\770289e53ed94fa242151110d9c958c17139e98d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1088"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\ssudrmnet.inf"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe—irsetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
2147483648
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_0\dpinst64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1164CMD.exe /D /A /C FIND /i /c "usb\vid_0B97" C:\WINDOWS\inf\*oem* > C:\Users\admin\AppData\Local\Temp\DriverCheck.acdC:\Windows\SysWOW64\cmd.exe—irsetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1188"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1817634 "__IRAFN:C:\Program Files (x86)\Chimera\Drivers\b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exe" "__IRCT:2" "__IRTSS:0" "__IRSID:S-1-5-21-1693682860-607145093-2874071422-1001"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
0
Version:
9.5.2.0
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_0\irsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
262 951
Read events
262 525
Write events
385
Delete events
41

Modification events

(PID) Process:(7456) ChimeraInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC
Operation:writeName:Blob
Value:
0300000001000000140000003F369FEC1EA4B285A44F3AD935922B152D7C68AC2000000001000000640500003082056030820448A003020102020900B9A5E5882CA0467A300D06092A864886F70D01010505003081DC310B30090603550406130255533110300E060355040813074172697A6F6E61311330110603550407130A53636F74747364616C6531253023060355040A131C537461726669656C6420546563686E6F6C6F676965732C20496E632E31393037060355040B1330687474703A2F2F6365727469666963617465732E737461726669656C64746563682E636F6D2F7265706F7369746F72793131302F06035504031328537461726669656C64205365637572652043657274696669636174696F6E20417574686F726974793111300F060355040513083130363838343335301E170D3135313230343038303033385A170D3138303932383138323534325A3061310B300906035504061302534B311830160603550407130F44756E616A736B6120537472656461311B3019060355040A13124575726F2D53657276657220732E722E6F2E311B3019060355040313124575726F2D53657276657220732E722E6F2E30820122300D06092A864886F70D01010105000382010F003082010A0282010100DAF719B5B3530BB03D6BB53CACD4FE8B573F94035A796E2C2FAA27EA7DFA8E3CDFE843FB596524F9A153A4C8E6C0745F213674312132944B135C2FC53BCC6801692427FA4925089884F24970170F0CC85C824CF31B953E46CEB7D910684337FD0BCE11E58BF527B815AB2463CDD9012612DE483CA679B33CA41B0D985F5ED7A7871931AF6CAE28B53696903FD8CD6AC32A50213EC192FDFB127EE873C7482478626CC9025089DE21A60396492FE871765B58E5265BB09158AE7CDB9C493420145DB92E53F26275B62602C0B8B94C8148A6A97B30FA68B2D0E865D9C80E69D0DB63EFDB9413705216C17D8E661AECAF121778115DB709839A4102334880D36FC10203010001A382019D30820199300C0603551D130101FF0402300030130603551D25040C300A06082B06010505070303300E0603551D0F0101FF04040302078030390603551D1F04323030302EA02CA02A8628687474703A2F2F63726C2E737461726669656C64746563682E636F6D2F736673352D31362E63726C30590603551D2004523050304E060B6086480186FD6E01071702303F303D06082B060105050702011631687474703A2F2F6365727469666963617465732E737461726669656C64746563682E636F6D2F7265706F7369746F72792F30818D06082B06010505070101048180307E302A06082B06010505073001861E687474703A2F2F6F6373702E737461726669656C64746563682E636F6D2F305006082B060105050730028644687474703A2F2F6365727469666963617465732E737461726669656C64746563682E636F6D2F7265706F7369746F72792F73665F696E7465726D6564696174652E637274301F0603551D23041830168014494B5227D11BBCF2A1216A627B51427A8AD7D556301D0603551D0E04160414EDE79531901B916A183A6DA721AEB6C10E0965FF300D06092A864886F70D010105050003820101009B9545C0C75B4BC3E9CD82632781066973F7B0D6B9B054329F19518E75692963B629E8F8454199F3D28BE28C718F7ABA36FB534427D84945527D2843936433091B6D12C9792364ADE245E20D1A4E18AE88F31CB210AF70AB5AF0718BC71417A062EF696EF77F350639220F7161EDE483AE7B0038D282429768991D5479B7ACB90C66D6C3631149755345436A2675934C21EEF2D1014D8E6CC16FE9D775D28648A5A0FC7004D6ABC9466F7A7B89FD94C8F1963596E7CDFC4520A3393A3E1381CCD128B2A480EB31CB1081864FB7CDDCA58D8BD2B8F051F4F0614A4E5498B4FE56B3CD74BFF624208010EC1E42DF7201AFE91DF95EC826C5481F6EF0E657ED5479
(PID) Process:(7456) ChimeraInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7
Operation:writeName:Blob
Value:
030000000100000014000000A7E3A467024FFA1DCE74842C491E6BBAAE6123C72000000001000000440500003082054030820428A00302010202084907C25D92D984EF300D06092A864886F70D01010B05003081C6310B30090603550406130255533110300E060355040813074172697A6F6E61311330110603550407130A53636F74747364616C6531253023060355040A131C537461726669656C6420546563686E6F6C6F676965732C20496E632E31333031060355040B132A687474703A2F2F63657274732E737461726669656C64746563682E636F6D2F7265706F7369746F72792F313430320603550403132B537461726669656C642053656375726520436572746966696361746520417574686F72697479202D204732301E170D3135313230343038303033385A170D3138303932383138323534325A3061310B300906035504061302534B311830160603550407130F44756E616A736B6120537472656461311B3019060355040A13124575726F2D53657276657220732E722E6F2E311B3019060355040313124575726F2D53657276657220732E722E6F2E30820122300D06092A864886F70D01010105000382010F003082010A0282010100DAF719B5B3530BB03D6BB53CACD4FE8B573F94035A796E2C2FAA27EA7DFA8E3CDFE843FB596524F9A153A4C8E6C0745F213674312132944B135C2FC53BCC6801692427FA4925089884F24970170F0CC85C824CF31B953E46CEB7D910684337FD0BCE11E58BF527B815AB2463CDD9012612DE483CA679B33CA41B0D985F5ED7A7871931AF6CAE28B53696903FD8CD6AC32A50213EC192FDFB127EE873C7482478626CC9025089DE21A60396492FE871765B58E5265BB09158AE7CDB9C493420145DB92E53F26275B62602C0B8B94C8148A6A97B30FA68B2D0E865D9C80E69D0DB63EFDB9413705216C17D8E661AECAF121778115DB709839A4102334880D36FC10203010001A382019430820190300C0603551D130101FF0402300030130603551D25040C300A06082B06010505070303300E0603551D0F0101FF040403020780303B0603551D1F043430323030A02EA02C862A687474703A2F2F63726C2E737461726669656C64746563682E636F6D2F736669673273352D302E63726C30590603551D2004523050304E060B6086480186FD6E01071702303F303D06082B060105050702011631687474703A2F2F6365727469666963617465732E737461726669656C64746563682E636F6D2F7265706F7369746F72792F30818206082B0601050507010104763074302A06082B06010505073001861E687474703A2F2F6F6373702E737461726669656C64746563682E636F6D2F304606082B06010505073002863A687474703A2F2F6365727469666963617465732E737461726669656C64746563682E636F6D2F7265706F7369746F72792F73666967322E637274301F0603551D23041830168014254581685026383D3B2D2CBECD6AD9B63DB36663301D0603551D0E04160414EDE79531901B916A183A6DA721AEB6C10E0965FF300D06092A864886F70D01010B05000382010100173D1E411D7A14AF3BBD8E45193F03F8120BEA70BC00006CF270E468FE0F24777BA3FF27A60740A2D804CC7901BAF8BFE20E98FF9DEB77DA2FE286C63AB3ACD1EB3E01CAC5D83C83E4E4B978B7001C2D5F7417BF12D24C28B4ED48A0D1A65CD624968A7FE3B85775C3DF3FD859DE59F5638691439224BCF58D1FF8F817383280800B96AC466281BB6993DECB1AE857981A63CE90958D30B296DA4392AE64AA964E11CB03CB4C37650DB70BFE5E5BE2F689CD93685439E33E08363830B06FD39933388E0EB397165322A2BD11C2AF29AD46B209229EF9EBE777965E18953C733AB655AF856C43CE080755DBAF1FF92929629FF620E7232FC5E4B2BCC4748A7F13
(PID) Process:(1188) irsetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
400000000000000040F1AA0CC0CBDB01A4040000D81A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3888) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000040F1AA0CC0CBDB01300F0000E8150000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3888) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000001551FE0CC0CBDB01300F0000E8150000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3888) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000001551FE0CC0CBDB01300F0000E8150000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3888) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000677C050DC0CBDB01300F0000E8150000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3888) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000F8B4000DC0CBDB01300F0000E8150000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3888) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(2148) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Leave)
Value:
48000000000000002841C40DC0CBDB0164080000E0140000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
571
Suspicious files
554
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
7456ChimeraInstaller.exeC:\Program Files (x86)\Chimera\Drivers\b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exeexecutable
MD5:3C6009F5685BD46F01C97494099C284A
SHA256:A1B7FB91A2417B69634B20220749DD19BF37CE56297DAFADB67226F58FFD04A3
1188irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\HTCDriver\Win7_x64\WPDMTPHW.INFbinary
MD5:46BF1D9B4AF261B793096BDCC6D2783B
SHA256:9BE59CA984A365AF08E65825A727AB790FDE89A7AD7BEC66E65399DD895D083F
6112b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dllexecutable
MD5:E7A789232EF503DCB4929791673009A3
SHA256:89DAA79B558055F6F893ABF38A0F17D3E1E0193D59DAFBDF98D72D4E5961C2A1
1188irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\Chimera.icoimage
MD5:0160C98A5BCE74331271DC08719C6D68
SHA256:9216A46311C9375B1BFAF86B89B1B93998DD0404EE6B15A62C7A62983AF63D88
1188irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\HTCDriver\Win7_x64\HtcVComV64.sysexecutable
MD5:7C7C986776D00E575BFBDE5DCBDC615D
SHA256:4CF12851A5A45917C3A9139B19D79434F2038611B617F83A714506CC7A1A6C61
6112b1a0d51eeb0b96e443ffd0da6881a9862bca9594.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeexecutable
MD5:A28329E9D35F27F6B4104DAC98BC3E56
SHA256:80BE4152F9BDB4631EC7F12DA1DC8DAE1037B340753A1552C3E4CD8DFDD05D2D
1188irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.datbinary
MD5:5CEFC33610A97C5DF3EB11EF042A0A3F
SHA256:4E7B17CD0105398825E08B1298D361C6CAEB320454CF367E81CE1D2D954D271B
1188irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\HTCDriver\Win7_x64\HtcVComV64.infbinary
MD5:A7C9EC50A2DFA3C12C964B27D8C71AA5
SHA256:198216704095AEBE8A7D373E7C9D18BD207581656C9BB15CD7A020AD4E5389CD
3888dllhost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1188irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\HTCDriver\Win7_x86\WPDMTPHW.INFbinary
MD5:46BF1D9B4AF261B793096BDCC6D2783B
SHA256:9BE59CA984A365AF08E65825A727AB790FDE89A7AD7BEC66E65399DD895D083F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
80
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7448
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7448
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5024
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.151.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.151.133
  • 20.190.151.69
  • 20.190.151.132
  • 20.190.151.70
  • 20.190.151.68
  • 20.190.151.67
  • 20.190.151.8
  • 20.190.151.6
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
chimeratool.com
  • 172.66.130.194
  • 172.66.130.193
whitelisted
data.chimeratool.com
  • 104.18.15.248
  • 104.18.14.248
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ChimeraInstaller.exe