URL:

https://downloadcenter.samsung.com/content/SW/202006/20200617140840447/SmartSwitchPC_Setup.exe

Full analysis: https://app.any.run/tasks/678bef5a-7d39-4410-a5da-32db88060f3c
Verdict: Malicious activity
Analysis date: July 16, 2020, 07:03:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

372269110C7AA85E88490BDAFAF11CB0

SHA1:

55E34AFD2D8AEAD571B60BB68D8ED679CF5901F2

SHA256:

E928BC711F76FD0BB483DF65DA3F3D522EA127D7A3E5FDCC2A0C0D64A93436A4

SSDEEP:

3:N8SEofXLWEidKL8s2yUL+TMZYIE3MIN2AvA:2SjWdQ9BQZlE3MIkAvA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Setup1.exe (PID: 2420)

    • Application was dropped or rewritten from another process

      • SmartSwitchPC_Setup.exe (PID: 2736)
      • vcredist_x86.exe (PID: 3068)
      • install.exe (PID: 840)
      • WriteDescExecuteFileName.exe (PID: 2812)
      • WriteDescExecuteFileName.exe (PID: 3036)
      • Setup.exe (PID: 3492)
      • SAMSUNG_USB_Driver_for_Mobile_Phones.exe (PID: 1700)
      • ss_conn_service2.exe (PID: 2432)
      • ss_conn_service.exe (PID: 2708)
      • SmartSwitchPC.exe (PID: 3160)
      • SmartSwitchUpdateClient.exe (PID: 2260)
      • WriteDescExecuteFileName.exe (PID: 2560)
      • WriteDescExecuteFileName.exe (PID: 864)
      • Kies3RemoveAll.exe (PID: 2612)
      • Execute2App.exe (PID: 1868)
      • Kies3RemoveAll.exe (PID: 4044)
      • WriteDescExecuteFileName.exe (PID: 2184)
      • WriteDescExecuteFileName.exe (PID: 464)
      • SmartSwitchPC.exe (PID: 3280)
      • AgentUpdate.exe (PID: 2304)
      • AgentUpdate.exe (PID: 3896)
      • AgentUpdate.exe (PID: 3808)

    • Changes settings of System certificates

      • msiexec.exe (PID: 3992)
      • Setup1.exe (PID: 2420)

    • Loads dropped or rewritten executable

      • install.exe (PID: 840)
      • Setup1.exe (PID: 2420)
      • regsvr32.exe (PID: 3744)
      • regsvr32.exe (PID: 576)
      • regsvr32.exe (PID: 3012)
      • regsvr32.exe (PID: 2152)
      • SAMSUNG_USB_Driver_for_Mobile_Phones.exe (PID: 1700)
      • regsvr32.exe (PID: 2460)
      • Setup.exe (PID: 3492)
      • regsvr32.exe (PID: 3084)
      • regsvr32.exe (PID: 2680)
      • SmartSwitchPC.exe (PID: 3160)
      • SmartSwitchUpdateClient.exe (PID: 2260)
      • Setup1.exe (PID: 1128)
      • Setup1.exe (PID: 1924)
      • regsvr32.exe (PID: 1856)
      • regsvr32.exe (PID: 3104)
      • regsvr32.exe (PID: 3472)
      • regsvr32.exe (PID: 3660)
      • regsvr32.exe (PID: 2284)
      • regsvr32.exe (PID: 2912)
      • regsvr32.exe (PID: 3828)
      • SmartSwitchPC.exe (PID: 3280)
      • AgentUpdate.exe (PID: 3896)
      • AgentUpdate.exe (PID: 2304)
      • AgentUpdate.exe (PID: 3808)

    • Registers / Runs the DLL via REGSVR32.EXE

      • Setup1.exe (PID: 2420)
      • Setup1.exe (PID: 1128)

    • Actions looks like stealing of personal data

      • SAMSUNG_USB_Driver_for_Mobile_Phones.exe (PID: 1700)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 948)
      • Setup1.exe (PID: 2420)
      • vcredist_x86.exe (PID: 3068)
      • MsiExec.exe (PID: 3116)
      • msiexec.exe (PID: 3992)
      • DrvInst.exe (PID: 2140)
      • SAMSUNG_USB_Driver_for_Mobile_Phones.exe (PID: 1700)
      • DrvInst.exe (PID: 1896)
      • DrvInst.exe (PID: 2100)
      • Setup.exe (PID: 3492)
      • DrvInst.exe (PID: 2296)
      • DrvInst.exe (PID: 4020)
      • DrvInst.exe (PID: 3744)
      • DrvInst.exe (PID: 552)
      • DrvInst.exe (PID: 3036)
      • Setup1.exe (PID: 1128)
      • MsiExec.exe (PID: 2360)
      • Setup1.exe (PID: 1924)

    • Adds / modifies Windows certificates

      • msiexec.exe (PID: 3992)
      • Setup1.exe (PID: 2420)

    • Creates files in the Windows directory

      • msiexec.exe (PID: 3992)
      • Setup1.exe (PID: 2420)
      • Setup.exe (PID: 3492)
      • DrvInst.exe (PID: 2580)
      • DrvInst.exe (PID: 2140)
      • DrvInst.exe (PID: 2100)
      • DrvInst.exe (PID: 1896)
      • DrvInst.exe (PID: 2924)
      • DrvInst.exe (PID: 2296)
      • DrvInst.exe (PID: 4032)
      • DrvInst.exe (PID: 4020)
      • DrvInst.exe (PID: 552)
      • DrvInst.exe (PID: 3744)
      • DrvInst.exe (PID: 3236)
      • DrvInst.exe (PID: 3036)

    • Removes files from Windows directory

      • msiexec.exe (PID: 3992)
      • DrvInst.exe (PID: 2140)
      • DrvInst.exe (PID: 2580)
      • DrvInst.exe (PID: 2100)
      • DrvInst.exe (PID: 2924)
      • DrvInst.exe (PID: 1896)
      • DrvInst.exe (PID: 4032)
      • DrvInst.exe (PID: 4020)
      • DrvInst.exe (PID: 2296)
      • DrvInst.exe (PID: 552)
      • DrvInst.exe (PID: 3744)
      • DrvInst.exe (PID: 3236)
      • DrvInst.exe (PID: 3036)

    • Executed as Windows Service

      • vssvc.exe (PID: 2108)
      • ss_conn_service2.exe (PID: 2432)
      • ss_conn_service.exe (PID: 2708)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2680)
      • regsvr32.exe (PID: 2460)
      • regsvr32.exe (PID: 2152)
      • regsvr32.exe (PID: 3744)
      • regsvr32.exe (PID: 3660)
      • regsvr32.exe (PID: 2284)
      • regsvr32.exe (PID: 2912)
      • regsvr32.exe (PID: 3828)

    • Searches for installed software

      • Setup1.exe (PID: 2420)
      • Setup1.exe (PID: 1924)
      • Setup1.exe (PID: 1128)

    • Creates a software uninstall entry

      • Setup1.exe (PID: 2420)
      • Setup.exe (PID: 3492)
      • Setup1.exe (PID: 1128)

    • Reads Internet Cache Settings

      • Setup1.exe (PID: 2420)
      • SmartSwitchPC.exe (PID: 3160)
      • Setup1.exe (PID: 1924)
      • SmartSwitchPC.exe (PID: 3280)
      • Setup1.exe (PID: 1128)

    • Creates files in the program directory

      • Setup1.exe (PID: 2420)
      • Setup.exe (PID: 3492)
      • Setup1.exe (PID: 1128)

    • Executed via COM

      • DrvInst.exe (PID: 2580)
      • DrvInst.exe (PID: 1896)
      • DrvInst.exe (PID: 2140)
      • DrvInst.exe (PID: 2100)
      • DrvInst.exe (PID: 2924)
      • DrvInst.exe (PID: 4032)
      • DrvInst.exe (PID: 4020)
      • DrvInst.exe (PID: 2296)
      • DrvInst.exe (PID: 552)
      • DrvInst.exe (PID: 3744)
      • DrvInst.exe (PID: 3236)
      • DrvInst.exe (PID: 3036)
      • rundll32.exe (PID: 3484)
      • rundll32.exe (PID: 3112)
      • DrvInst.exe (PID: 3012)

    • Uses RUNDLL32.EXE to load library

      • DrvInst.exe (PID: 2140)
      • DrvInst.exe (PID: 2100)
      • DrvInst.exe (PID: 2296)
      • DrvInst.exe (PID: 4020)
      • DrvInst.exe (PID: 552)
      • DrvInst.exe (PID: 3036)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2580)
      • DrvInst.exe (PID: 2140)
      • DrvInst.exe (PID: 2100)
      • DrvInst.exe (PID: 2924)
      • DrvInst.exe (PID: 1896)
      • DrvInst.exe (PID: 2296)
      • DrvInst.exe (PID: 4032)
      • DrvInst.exe (PID: 4020)
      • DrvInst.exe (PID: 552)
      • DrvInst.exe (PID: 3744)
      • DrvInst.exe (PID: 3236)
      • DrvInst.exe (PID: 3036)

    • Creates files in the user directory

      • Setup1.exe (PID: 2420)
      • SmartSwitchPC.exe (PID: 3160)
      • SmartSwitchUpdateClient.exe (PID: 2260)
      • SmartSwitchPC.exe (PID: 3280)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 948)

    • Reads the BIOS version

      • SmartSwitchPC.exe (PID: 3280)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 948)
      • chrome.exe (PID: 1740)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 948)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3992)

    • Application launched itself

      • msiexec.exe (PID: 3992)
      • chrome.exe (PID: 948)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3116)
      • MsiExec.exe (PID: 1452)
      • MsiExec.exe (PID: 2360)
      • MsiExec.exe (PID: 2776)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2108)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 2580)
      • DrvInst.exe (PID: 2296)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 2580)

    • Reads settings of System Certificates

      • chrome.exe (PID: 1740)
      • SmartSwitchPC.exe (PID: 3160)
      • SmartSwitchPC.exe (PID: 3280)

    • Creates files in the program directory

      • msiexec.exe (PID: 3992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
96
Malicious processes
29
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs smartswitchpc_setup.exe no specs setup1.exe no specs setup1.exe vcredist_x86.exe install.exe no specs msiexec.exe chrome.exe no specs msiexec.exe writedescexecutefilename.exe no specs vssvc.exe no specs chrome.exe no specs msiexec.exe no specs writedescexecutefilename.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs samsung_usb_driver_for_mobile_phones.exe setup.exe drvinst.exe no specs drvinst.exe rundll32.exe no specs drvinst.exe drvinst.exe rundll32.exe no specs drvinst.exe no specs drvinst.exe rundll32.exe no specs drvinst.exe no specs drvinst.exe rundll32.exe no specs drvinst.exe drvinst.exe rundll32.exe no specs drvinst.exe no specs drvinst.exe rundll32.exe no specs ss_conn_service.exe no specs ss_conn_service2.exe no specs rundll32.exe no specs drvinst.exe no specs dinotify.exe no specs rundll32.exe no specs smartswitchpc.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs smartswitchupdateclient.exe smartswitchpc_4.2.20072_4.exe no specs setup1.exe no specs setup1.exe writedescexecutefilename.exe no specs writedescexecutefilename.exe no specs execute2app.exe no specs kies3removeall.exe no specs setup1.exe msiexec.exe writedescexecutefilename.exe no specs kies3removeall.exe msiexec.exe no specs writedescexecutefilename.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs smartswitchpc.exe agentupdate.exe no specs agentupdate.exe no specs agentupdate.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
464C:\Users\admin\AppData\Local\Temp\{099965E9-4765-47FE-BAEC-2C3A42131C61}\WriteDescExecuteFileName.exe Software\Samsung\KIESSETUP "Smart Switch PC Installer 4.0"C:\Users\admin\AppData\Local\Temp\{099965E9-4765-47FE-BAEC-2C3A42131C61}\WriteDescExecuteFileName.exe—Setup1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\{099965e9-4765-47fe-baec-2c3a42131c61}\writedescexecutefilename.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
540"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,18438824680635865581,8941307951937248769,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=3489106358900190877 --mojo-platform-channel-handle=5072 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
552DrvInst.exe "4" "20" "C:\Users\admin\AppData\Local\Temp\{172538f6-6e00-379a-d88b-e2192620f00d}\ss_conn_usb_driver.inf" "0" "6cfb83dcb" "000002B8" "WinSta0\Default" "00000548" "208" "C:\Program Files\Samsung\USB Drivers\25_escape"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
576C:\Windows\system32\regsvr32.exe "C:\Program Files\Samsung\Smart Switch PC\External\Msfdb.dll" /sC:\Windows\system32\regsvr32.exe—Setup1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
616"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,18438824680635865581,8941307951937248769,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12713178462346698779 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\windows\system32\wininet.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\oleaut32.dll
c:\users\admin\appdata\local\temp\smartswitch_20200716080406\setup1.exe
c:\windows\system32\version.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\bcryptprimitives.dll
840c:\2bec19f1abc9506144387299\.\install.exe /qc:\2bec19f1abc9506144387299\install.exe—vcredist_x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
External Installer
Exit code:
0
Version:
9.0.30729.1 built by: SP
Modules
Images
c:\2bec19f1abc9506144387299\install.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
864C:\Users\admin\AppData\Local\Temp\{8C9741E9-5B4C-4C63-800B-D04023066C4D}\WriteDescExecuteFileName.exe Software\Samsung\KIESSETUP "Smart Switch PC Installer 4.0"C:\Users\admin\AppData\Local\Temp\{8C9741E9-5B4C-4C63-800B-D04023066C4D}\WriteDescExecuteFileName.exe—Setup1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\{8c9741e9-5b4c-4c63-800b-d04023066c4d}\writedescexecutefilename.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
948"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://downloadcenter.samsung.com/content/SW/202006/20200617140840447/SmartSwitchPC_Setup.exe"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1128"C:\Users\admin\AppData\Local\Temp\SmartSwitch_20200716080709\Setup1.exe" /L1033 C:\Users\admin\AppData\Local\Temp\SmartSwitch_20200716080709\Setup1.exe
Execute2App.exe
User:
admin
Company:
Samsung Electronics Co., Ltd.
Integrity Level:
HIGH
Description:
Smart Switch PC Installer 4.0
Exit code:
0
Version:
4.2.20072.4
Modules
Images
c:\users\admin\appdata\local\temp\smartswitch_20200716080709\setup1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2336 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
7 576
Read events
5 523
Write events
1 895
Delete events
158

Modification events

(PID) Process:(948) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(948) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(948) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(948) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(948) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(948) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(1392) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:948-13239356607548500
Value:
259
(PID) Process:(948) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(948) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(948) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
516
Suspicious files
230
Text files
2 859
Unknown types
130

Dropped files

PID
Process
Filename
Type
948chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5F0FFBC0-3B4.pma —
MD5:—
SHA256:—
948chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old —
MD5:—
SHA256:—
948chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\721b62df-a87f-4244-8151-6ea30f3fa415.tmp —
MD5:—
SHA256:—
948chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
948chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
948chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF11e7bd.TMPtext
MD5:—
SHA256:—
948chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF11e81b.TMPtext
MD5:—
SHA256:—
948chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF11e7cd.TMPtext
MD5:—
SHA256:—
948chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
948chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF11e992.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
42
DNS requests
36
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2420
Setup1.exe
GET
200
23.37.43.27:80
http://s.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEGMYDTj7gJd4qdA1oxYY%2BEA%3D
NL
der
1.71 Kb
shared
3160
SmartSwitchPC.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEQDEhqaSFwulzQMiksy6fGXC
US
der
472 b
whitelisted
3160
SmartSwitchPC.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEQDEhqaSFwulzQMiksy6fGXC
US
der
472 b
whitelisted
3160
SmartSwitchPC.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
3160
SmartSwitchPC.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
3160
SmartSwitchPC.exe
GET
200
52.222.147.225:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEA3s9ogLk3Ja5gt%2FeLyEZa8%3D
US
der
471 b
whitelisted
1740
chrome.exe
GET
200
185.180.12.141:80
http://r2---sn-n02xgoxufvg3-8pxe.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNmRlQUFXU0o1UkNFTWx3aGRUUHBsWUJUZw/7819.902.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mh=8p&mip=185.183.107.227&mm=28&mn=sn-n02xgoxufvg3-8pxe&ms=nvh&mt=1594883114&mv=m&mvi=2&pl=24&shardbypass=yes
AT
crx
824 Kb
whitelisted
2420
Setup1.exe
POST
200
184.72.55.30:80
http://ccrloadbalancer-240403386.us-west-1.elb.amazonaws.com/usage/
US
text
47 b
shared
1740
chrome.exe
GET
302
172.217.18.14:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
539 b
whitelisted
3160
SmartSwitchPC.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
727 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1740
chrome.exe
104.111.214.94:443
downloadcenter.samsung.com
Akamai International B.V.
NL
whitelisted
1740
chrome.exe
172.217.23.100:443
www.google.com
Google Inc.
US
whitelisted
1740
chrome.exe
172.217.22.99:443
www.gstatic.com
Google Inc.
US
whitelisted
1740
chrome.exe
172.217.21.227:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2420
Setup1.exe
184.72.55.30:80
ccrloadbalancer-240403386.us-west-1.elb.amazonaws.com
Amazon.com, Inc.
US
shared
2420
Setup1.exe
52.222.147.97:443
d2ogrndh9skxtm.cloudfront.net
Amazon.com, Inc.
US
unknown
2420
Setup1.exe
23.37.43.27:80
s.symcd.com
Akamai Technologies, Inc.
NL
whitelisted
2420
Setup1.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3160
SmartSwitchPC.exe
54.248.247.45:443
update.kies.samsung.com
Amazon.com, Inc.
JP
unknown
1740
chrome.exe
216.58.205.238:443
clients1.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 216.58.205.227
whitelisted
downloadcenter.samsung.com
  • 104.111.214.94
whitelisted
accounts.google.com
  • 216.58.207.77
shared
www.google.com
  • 172.217.23.100
malicious
ssl.gstatic.com
  • 172.217.21.227
whitelisted
www.gstatic.com
  • 172.217.22.99
whitelisted
ccrloadbalancer-240403386.us-west-1.elb.amazonaws.com
  • 184.72.55.30
  • 184.169.137.169
shared
d2ogrndh9skxtm.cloudfront.net
  • 52.222.147.97
  • 52.222.147.56
  • 52.222.147.214
  • 52.222.147.98
whitelisted
s.symcd.com
  • 23.37.43.27
shared
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
Process
Message
Setup1.exe
???????????›??????????)
Setup1.exe
???????????›??????????????????????????????????????????
Setup1.exe
???????????›?????
Setup1.exe
???????????›??????????????????)
Setup1.exe
???????????›????????????????????????????????????????????????????????????????????????????????????4????????????
Setup1.exe
???????????›?????????????????????????????????????????????????????????????????????????????????????•????›0
Setup1.exe
???????????›??????
Setup1.exe
???????????›???????????????????›??????????????????????????????\
Setup1.exe
???????????›??????????????????)
Setup1.exe
???????????›?????????????????)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://downloadcenter.samsung.com/content/SW/202006/20200617140840447/SmartSwitchPC_Setup.exe