File name:

ICE-2.0.3-for-64-bit-Windows.msi

Full analysis: https://app.any.run/tasks/4383eab9-8385-4f09-b02c-bda407eff634
Verdict: Malicious activity
Analysis date: August 17, 2024, 20:56:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Create Time/Date: Mon Jun 21 07:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: x64;1033, Number of Pages: 200, Revision Number: {C64CF350-2D02-4AED-A36C-7B7DD51DE256}, Title: Image Composite Editor, Author: Microsoft Corporation, Comments: Image Composite Editor is an advanced panoramic image stitcher., Number of Words: 2, Last Saved Time/Date: Tue Feb 24 22:49:22 2015, Last Printed: Tue Feb 24 22:49:22 2015
MD5:

E55FEC9A014EFBD4F3EDBF3157A5EDC5

SHA1:

8A7EBCBB7BB833E0C0B18D320E8E3C0B3FFF653A

SHA256:

3A39A8FFF473500186F56E6F79985BAE87A5B6D5F10ED3F8A3F40899D7FDDB43

SSDEEP:

98304:LbG7OS9Nu3N0ZTPTk7jgIjQFTZg+k0RZKWVplvLRdGiWD0uGShRorWN4ioPnFIlK:mBl9/D/qApX4MybS/W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Scans artifacts that could help determine the target

      • ICE.exe (PID: 6320)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6548)
      • msiexec.exe (PID: 6700)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6700)
      • ICE.exe (PID: 6320)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6992)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6700)
      • msiexec.exe (PID: 6548)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6700)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 6700)
      • msiexec.exe (PID: 2132)
      • msiexec.exe (PID: 6236)

    • Changes default file association

      • msiexec.exe (PID: 6700)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 6700)

    • Reads Microsoft Outlook installation path

      • ICE.exe (PID: 6320)

    • Reads Internet Explorer settings

      • ICE.exe (PID: 6320)

    • Reads security settings of Internet Explorer

      • ICE.exe (PID: 6320)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 6700)
      • msiexec.exe (PID: 6740)
      • msiexec.exe (PID: 6276)
      • ICE.exe (PID: 6320)

    • Reads the software policy settings

      • msiexec.exe (PID: 6548)
      • msiexec.exe (PID: 6700)
      • ICE.exe (PID: 6320)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6548)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6548)
      • msiexec.exe (PID: 6700)
      • ICE.exe (PID: 6320)

    • Checks proxy server information

      • msiexec.exe (PID: 6548)
      • ICE.exe (PID: 6320)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6548)
      • msiexec.exe (PID: 6700)

    • Reads the computer name

      • msiexec.exe (PID: 6700)
      • msiexec.exe (PID: 6740)
      • msiexec.exe (PID: 6276)
      • ICE.exe (PID: 6320)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6700)
      • ICE.exe (PID: 6320)

    • Create files in a temporary directory

      • msiexec.exe (PID: 6740)
      • msiexec.exe (PID: 6276)
      • ICE.exe (PID: 6320)

    • Application launched itself

      • msiexec.exe (PID: 6700)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6700)

    • Creates files in the program directory

      • ICE.exe (PID: 6320)

    • Disables trace logs

      • ICE.exe (PID: 6320)

    • Reads Environment values

      • ICE.exe (PID: 6320)

    • Process checks Internet Explorer phishing filters

      • ICE.exe (PID: 6320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CreateDate: 1999:06:21 07:00:00
Software: Windows Installer
Security: Password protected
CodePage: Windows Latin 1 (Western European)
Template: x64;1033
Pages: 200
RevisionNumber: {C64CF350-2D02-4AED-A36C-7B7DD51DE256}
Title: Image Composite Editor
Subject: -
Author: Microsoft Corporation
Keywords: -
Comments: Image Composite Editor is an advanced panoramic image stitcher.
Words: 2
ModifyDate: 2015:02:24 22:49:22
LastPrinted: 2015:02:24 22:49:22
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs ice.exe

Process information

PID
CMD
Path
Indicators
Parent process
1860C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2132"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\Microsoft Research\Image Composite Editor\WLPG.dll"C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4824\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6236"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Microsoft Research\Image Composite Editor\ShellExtension.dll"C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6276C:\Windows\syswow64\MsiExec.exe -Embedding 1884DD5306D79040A34AAB3940857B4DC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6320"C:\Program Files\Microsoft Research\Image Composite Editor\ICE.exe"C:\Program Files\Microsoft Research\Image Composite Editor\ICE.exe
msiexec.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Image Composite Editor
Version:
2.0.3.0
Modules
Images
c:\program files\microsoft research\image composite editor\ice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6548"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\ICE-2.0.3-for-64-bit-Windows.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6700C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6740C:\Windows\syswow64\MsiExec.exe -Embedding 6B4B47C9898D0BA661993039E2806100 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6992C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
22 709
Read events
22 244
Write events
445
Delete events
20

Modification events

(PID) Process:(6700) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000086201209E8F0DA012C1A0000401B0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6700) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000086201209E8F0DA012C1A0000401B0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6700) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000033815209E8F0DA012C1A0000401B0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6700) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000033815209E8F0DA012C1A0000401B0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6700) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000075485709E8F0DA012C1A0000401B0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6700) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000016125C09E8F0DA012C1A0000401B0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6700) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6700) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000005286C209E8F0DA012C1A0000401B0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6700) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000A94EC709E8F0DA012C1A0000F41B0000E803000001000000000000000000000061E579383FEFE546841C496E3EE2FF9100000000000000000000000000000000
(PID) Process:(6992) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000484BD309E8F0DA01501B00002C0C0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
36
Suspicious files
28
Text files
16
Unknown types
1

Dropped files

PID
Process
Filename
Type
6700msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6700msiexec.exeC:\Windows\Installer\ec0ac.msi —
MD5:—
SHA256:—
6548msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759ADder
MD5:6872FAE8288DB34207D9E7EE350157F4
SHA256:50795B027E2BC566D3B7ACB89913F8EFD23B70615C9DB9BF5B23323AD3132A7D
6700msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:6D2AABB7E7FB07511B29F557529D281E
SHA256:045A9AA3FF14F111E46FFB490358E46BF46D19A3CBAAF43A53A4CF75B643DD7E
6700msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{3879e561-ef3f-46e5-841c-496e3ee2ff91}_OnDiskSnapshotPropbinary
MD5:6D2AABB7E7FB07511B29F557529D281E
SHA256:045A9AA3FF14F111E46FFB490358E46BF46D19A3CBAAF43A53A4CF75B643DD7E
6548msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759ADbinary
MD5:00917A2CEF705F48EEF5C5445DE6B635
SHA256:7E3E67B417EFA85435ED09237C434C013998FA4ABA79ADCC8F895C090801F6B4
6548msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21binary
MD5:B59C6E17E7E0BD2F24F87A1C62BE4884
SHA256:4A4F4177CC3E0468875206CF97084D190828BDB77759616462EE4EC74AAC19F7
6548msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5DDB.tmpexecutable
MD5:5494165B1384FAEEFDD3D5133DF92F5A
SHA256:BA0AD3A4D2112B269E379A2231128E7EBE23E95D5D04878D6EE8815E657BB055
6700msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:507F0B5A73C3BDA2861048B646D4982F
SHA256:6FB2549A6AD7F652611ED02F2CFCDBBD1B581E583CA927961E3FC556F450514F
6548msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21der
MD5:E07178901A4EAAC2816BB238EC3A80DB
SHA256:EEBD04C1272661E1091084108083CE44F7C961013791892D866B2F92EE3DEDA8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
43
DNS requests
21
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6548
msiexec.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
6548
msiexec.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
7092
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6052
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5300
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6320
ICE.exe
GET
302
184.28.89.167:80
http://go.microsoft.com/fwlink/?LinkID=510775
unknown
—
—
whitelisted
6320
ICE.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6320
ICE.exe
GET
302
184.28.89.167:80
http://go.microsoft.com/fwlink/?LinkId=185905
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
5240
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2464
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6548
msiexec.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5240
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5300
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5300
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.64
  • 20.190.159.75
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.0
  • 20.190.159.73
  • 40.126.31.69
  • 20.190.159.71
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
go.microsoft.com
  • 184.30.17.189
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ICE-2.0.3-for-64-bit-Windows.msi