File name:

I3GSvcManager.exe

Full analysis: https://app.any.run/tasks/bbff7e5e-8f2c-4d5c-9936-40c4b502bb65
Verdict: Malicious activity
Analysis date: October 19, 2024, 02:32:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2951F56151A0FF5B480A2A3EA348D232

SHA1:

44877AD743848348D175336F27D57FDFB6548747

SHA256:

23F13B42873C1A885E59F260CB9E37A98AC40F053D671BF7FA299945891A7B2F

SSDEEP:

98304:Sj+pzhreZxRMdRElX6ek1aBMU9VovGV7TB9czGm5N0QgMOmIz764XllNGOxUIADU:054du3Tg2gAA1yh2mqk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • I3GSvcManager.exe (PID: 5616)

    • Executable content was dropped or overwritten

      • I3GSvcManager.exe (PID: 5616)

    • The process drops C-runtime libraries

      • I3GSvcManager.exe (PID: 5616)

    • Process drops legitimate windows executable

      • I3GSvcManager.exe (PID: 5616)

    • Creates a software uninstall entry

      • I3GSvcManager.exe (PID: 5616)

    • Reads security settings of Internet Explorer

      • I3GSvcManager.exe (PID: 5616)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • I3GSvcManager.exe (PID: 5616)

    • Executes as Windows Service

      • I3GMainSvc.exe (PID: 7128)

  • INFO

    • Creates files in the program directory

      • I3GSvcManager.exe (PID: 5616)

    • Reads Environment values

      • I3GSvcManager.exe (PID: 5616)

    • Creates files or folders in the user directory

      • I3GSvcManager.exe (PID: 5616)

    • Checks supported languages

      • I3GSvcManager.exe (PID: 5616)
      • certmgr.exe (PID: 6720)
      • certmgr.exe (PID: 6024)
      • certmgr.exe (PID: 1732)
      • certmgr.exe (PID: 5012)

    • Reads the computer name

      • I3GSvcManager.exe (PID: 5616)

    • The process uses the downloaded file

      • I3GSvcManager.exe (PID: 5616)

    • Process checks computer location settings

      • I3GSvcManager.exe (PID: 5616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (38.9)
.exe | Win32 Executable MS Visual C++ (generic) (28.2)
.exe | Win64 Executable (generic) (25)
.exe | Win32 Executable (generic) (4)
.exe | Generic Win/DOS Executable (1.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:05:02 03:01:43+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 1236992
InitializedDataSize: 9635328
UninitializedDataSize: -
EntryPoint: 0x107d3b
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 3.0.0.24
ProductVersionNumber: 3.0.0.24
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Korea (Shift - KSC 5601)
Comments: I3GManager LWS Module Installer
CompanyName: Interezen. Co., Ltd.
FileDescription: I3GManager LWS Module Installer
FileVersion: 3.0.0.24
InternalName: I3GManager
LegalCopyright: Interezen. Copyright ⓒ 2009 ~
OriginalFileName: I3GSvcManager.exe
ProductName: I3GManager
ProductVersion: 3.0.0.24
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
35
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start i3gsvcmanager.exe netsh.exe no specs conhost.exe no specs certmgr.exe no specs conhost.exe no specs certmgr.exe no specs conhost.exe no specs certmgr.exe no specs conhost.exe no specs certmgr.exe no specs conhost.exe no specs openssl.exe no specs conhost.exe no specs openssl.exe no specs conhost.exe no specs openssl.exe no specs conhost.exe no specs openssl.exe no specs conhost.exe no specs openssl.exe no specs conhost.exe no specs certmgr.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs i3gproc.exe no specs i3gmainsvc.exe no specs i3gmainsvc.exe no specs i3gmainsvc.exe no specs i3ginit.exe no specs sppextcomobj.exe no specs slui.exe no specs i3gsvcmanager.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1156\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—certmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1176"C:\Program Files (x86)\IPinside_LWS\certfr\certutil.exe" -D -n "Interezen CA" -d "sql:C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release"C:\Program Files (x86)\IPinside_LWS\certfr\certutil.exe—I3GSvcManager.exe
User:
admin
Integrity Level:
HIGH
Exit code:
255
Modules
Images
c:\program files (x86)\ipinside_lws\certfr\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\program files (x86)\ipinside_lws\certfr\nssutil3.dll
1732"C:\Program Files (x86)\IPinside_LWS\certmgr.exe" /del /c /sha1 A9A41C09E8B58DD59C97B6F0524BB48D9A15BD4F /s /r localMachine RootC:\Program Files (x86)\IPinside_LWS\certmgr.exe—I3GSvcManager.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
ECM Certificate Manager
Exit code:
4294967295
Version:
5.131.1863.1
Modules
Images
c:\program files (x86)\ipinside_lws\certmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2312"C:\Program Files (x86)\IPinside_LWS\openssl.exe" req -config "C:\Program Files (x86)\IPinside_LWS\openssl.cnf" -x509 -new -nodes -key "C:\Program Files (x86)\IPinside_LWS\interezen-rootca.key" -sha256 -days 7300 -out "C:\Program Files (x86)\IPinside_LWS\interezen-rootca.crt" -subj "/emailAddress=HJKIM@INTEREZEN.CO.KR/CN=INTEREZEN CA/OU=INTEREZEN/O=INTEREZEN/L=SEOUL/ST=SEOUL/C=KR"C:\Program Files (x86)\IPinside_LWS\openssl.exe—I3GSvcManager.exe
User:
admin
Company:
The OpenSSL Project, https://www.openssl.org/
Integrity Level:
HIGH
Description:
OpenSSL application
Exit code:
0
Version:
3.0.7
Modules
Images
c:\program files (x86)\ipinside_lws\openssl.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
2360"C:\Program Files (x86)\IPinside_LWS\certfr\certutil.exe" -A -n "Interezen CA" -t "CP,CP," -i "C:\Program Files (x86)\IPinside_LWS\interezen-rootca.crt" -d "sql:C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release"C:\Program Files (x86)\IPinside_LWS\certfr\certutil.exe—I3GSvcManager.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files (x86)\ipinside_lws\certfr\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\program files (x86)\ipinside_lws\certfr\nssutil3.dll
2428\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—openssl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3604"C:\Program Files (x86)\IPinside_LWS\openssl.exe" x509 -req -in "C:\Program Files (x86)\IPinside_LWS\InterezenSSLServer.csr" -CA "C:\Program Files (x86)\IPinside_LWS\interezen-rootca.crt" -CAkey "C:\Program Files (x86)\IPinside_LWS\interezen-rootca.key" -CAcreateserial -out "C:\Program Files (x86)\IPinside_LWS\interezen.opt" -sha256 -extfile "C:\Program Files (x86)\IPinside_LWS\InterezenSSLServerCert.ext" -days 7300C:\Program Files (x86)\IPinside_LWS\openssl.exe—I3GSvcManager.exe
User:
admin
Company:
The OpenSSL Project, https://www.openssl.org/
Integrity Level:
HIGH
Description:
OpenSSL application
Exit code:
0
Version:
3.0.7
Modules
Images
c:\program files (x86)\ipinside_lws\openssl.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
3620\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—openssl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3828"C:\Program Files (x86)\IPinside_LWS\certmgr.exe" /add /c interezen-rootca.crt /s /r localMachine rootC:\Program Files (x86)\IPinside_LWS\certmgr.exe—I3GSvcManager.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
ECM Certificate Manager
Exit code:
0
Version:
5.131.1863.1
Modules
Images
c:\program files (x86)\ipinside_lws\certmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4348\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—certmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
21 641
Read events
21 568
Write events
71
Delete events
2

Modification events

(PID) Process:(5616) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:ipinside-mgr
Value:
(PID) Process:(5616) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\IPinside_LWS\I3GSvcManager.exe
(PID) Process:(5616) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:DisplayName
Value:
IPinside LWS Agent
(PID) Process:(5616) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:DisplayVersion
Value:
3.0.0.24
(PID) Process:(5616) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:Publisher
Value:
interezen
(PID) Process:(5616) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:UninstallPath
Value:
C:\Program Files (x86)\IPinside_LWS\I3GSvcManager.exe
(PID) Process:(5616) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\IPinside_LWS\I3GSvcManager.exe /uninstall
(PID) Process:(6720) certmgr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.10!6
Operation:writeName:Name
Value:
SpcSpAgencyInfo
(PID) Process:(6720) certmgr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.27!6
Operation:writeName:Name
Value:
SpcFinancialCriteria
(PID) Process:(6720) certmgr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.26!6
Operation:writeName:Name
Value:
SpcMinimalCriteria
Executable files
66
Suspicious files
5
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
5616I3GSvcManager.exeC:\Program Files (x86)\IPinside_LWS\api-ms-win-core-file-l1-2-0.dllexecutable
MD5:79EE4A2FCBE24E9A65106DE834CCDA4A
SHA256:9F7BDA59FAAFC8A455F98397A63A7F7D114EFC4E8A41808C791256EBF33C7613
5616I3GSvcManager.exeC:\Program Files (x86)\IPinside_LWS\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:E205DE17A85B0C3352A6857EF9B3C6DD
SHA256:29B23370474BE0C459CC47863603167CC7191F58318BD29877225FCBF2454215
5616I3GSvcManager.exeC:\Program Files (x86)\IPinside_LWS\api-ms-win-core-errorhandling-l1-1-0.dllexecutable
MD5:9A4FC3727AAF02C3285B47DF5EE56244
SHA256:891CCFEB349116283326262C27B8894B43CDC89B8AFD5BA7D21B891814A68075
5616I3GSvcManager.exeC:\Program Files (x86)\IPinside_LWS\api-ms-win-core-file-l1-1-0.dllexecutable
MD5:6B937FE1EFF0E440B124BBB9334DF34D
SHA256:71C87C14BC1BD0B20D9F68D4943E93C4C6DDC1B6CF252938BB15FE562552F93E
5616I3GSvcManager.exeC:\Program Files (x86)\IPinside_LWS\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:405BB6A7CD56CBF5276C3A8DC631963D
SHA256:F654E56C4299F507BC34271B6BAA29290FD4919B853E17D7470596CAD779F063
5616I3GSvcManager.exeC:\Program Files (x86)\IPinside_LWS\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:F4604E259459F5A0D5BE6914A6D4C5FB
SHA256:BCE066193FEB60B08EDF4CBEB490AAAA5DFFEB8A63A720CADF948748A9AF4B8F
5616I3GSvcManager.exeC:\Program Files (x86)\IPinside_LWS\api-ms-win-core-libraryloader-l1-1-0.dllexecutable
MD5:8F239C629F09E1B49CF1F03304AB8E69
SHA256:D8D74FB87F94A587582D56934816362B992B712E47C39F13D957058F17724886
5616I3GSvcManager.exeC:\Program Files (x86)\IPinside_LWS\api-ms-win-core-processthreads-l1-1-0.dllexecutable
MD5:066874FF22E1C100DC56C4AE76D2E1C2
SHA256:979FF0E25E7EA00B8714C9EF2DC8417E69AFAC137EA88F77F8F5A9FFEAA31923
5616I3GSvcManager.exeC:\Program Files (x86)\IPinside_LWS\api-ms-win-core-memory-l1-1-0.dllexecutable
MD5:536F07C04C316AAC61AB64A492ED9191
SHA256:50BF87DA10AE3F442C457E42D6666993B0FCA7C5D4DF521E8CD0959995FBCDDC
5616I3GSvcManager.exeC:\Program Files (x86)\IPinside_LWS\api-ms-win-core-rtlsupport-l1-1-0.dllexecutable
MD5:0AE94670FBD69ED5F8C923B75CE2C0BD
SHA256:6D541B215CFA452E54DC6AF9317A7FC24043FA465EF2B561E0F245A4870B2705
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
51
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2364
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6380
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6380
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2464
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.209.182:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4360
SearchApp.exe
2.23.209.182:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2364
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2364
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.130
  • 2.23.209.187
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.185.142
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.140
  • 40.126.32.74
  • 40.126.32.76
  • 40.126.32.136
  • 40.126.32.133
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
I3GSvcManager.exe