URL:

http://mirror42.mountspace.com/getfile.php?p=http://eu-uk7.disk-tools.com/1d6b94c7bb2b89ea2601a5362fd43072/DTLite10100-0797.exe

Full analysis: https://app.any.run/tasks/1e084030-341f-4d37-8420-58130977e8f3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 21, 2019, 11:02:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

F86EF81BABE1A41FB33F03F28FD1D798

SHA1:

396D8FCE38CEEB9C1A41D906A13515E628BF595F

SHA256:

68518FAF1DA79F61C552C363250186FF04C4AE215F254192159D2954490CBEE1

SSDEEP:

3:N1KTfh8Z3XyTZARQJAkgFmpSWLK5LD0HcXT4ncSLN:CjhC2Z0Q5CSl2H0E4c4N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DTPro821-0709.exe (PID: 3260)
      • DTPro821-0709.exe (PID: 1548)
      • DiscSoftBusServicePro.exe (PID: 3064)
      • InstallGadget.exe (PID: 3416)
      • DiscSoftBusServicePro.exe (PID: 3576)
      • DTShellHlp.exe (PID: 1828)
      • DTAgent.exe (PID: 2040)
      • DTPro.exe (PID: 2548)

    • Changes settings of System certificates

      • DTPro821-0709.exe (PID: 3260)
      • sidebar.exe (PID: 1180)

    • Loads dropped or rewritten executable

      • DiscSoftBusServicePro.exe (PID: 3064)
      • DTPro821-0709.exe (PID: 3260)
      • regsvr32.exe (PID: 1932)
      • regsvr32.exe (PID: 2708)
      • regsvr32.exe (PID: 3972)
      • sidebar.exe (PID: 1180)
      • DiscSoftBusServicePro.exe (PID: 3576)
      • explorer.exe (PID: 1696)
      • svchost.exe (PID: 872)
      • DTShellHlp.exe (PID: 1828)
      • DTAgent.exe (PID: 2040)
      • DTPro.exe (PID: 2548)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 2632)

    • Changes the autorun value in the registry

      • DTPro821-0709.exe (PID: 3260)
      • sidebar.exe (PID: 1180)

    • Registers / Runs the DLL via REGSVR32.EXE

      • DTPro821-0709.exe (PID: 3260)
      • InstallGadget.exe (PID: 3416)

  • SUSPICIOUS

    • Starts Internet Explorer

      • explorer.exe (PID: 1696)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2632)
      • iexplore.exe (PID: 2368)
      • DTPro821-0709.exe (PID: 3260)
      • DiscSoftBusServicePro.exe (PID: 3064)
      • DrvInst.exe (PID: 2892)
      • DrvInst.exe (PID: 1332)

    • Creates files in the program directory

      • DTPro821-0709.exe (PID: 3260)
      • DiscSoftBusServicePro.exe (PID: 3064)
      • regsvr32.exe (PID: 3972)

    • Adds / modifies Windows certificates

      • DTPro821-0709.exe (PID: 3260)

    • Creates a software uninstall entry

      • DTPro821-0709.exe (PID: 3260)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 2892)
      • DiscSoftBusServicePro.exe (PID: 3064)
      • DrvInst.exe (PID: 1332)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2892)
      • DrvInst.exe (PID: 1332)

    • Uses RUNDLL32.EXE to load library

      • DrvInst.exe (PID: 2892)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2892)
      • DrvInst.exe (PID: 1332)

    • Searches for installed software

      • DrvInst.exe (PID: 2892)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2708)
      • regsvr32.exe (PID: 1932)
      • regsvr32.exe (PID: 3972)

    • Reads Internet Cache Settings

      • sidebar.exe (PID: 1180)
      • explorer.exe (PID: 1696)

    • Reads internet explorer settings

      • sidebar.exe (PID: 1180)

    • Modifies the open verb of a shell class

      • DTPro821-0709.exe (PID: 3260)

    • Creates files in the user directory

      • DTPro.exe (PID: 2548)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2368)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2632)
      • iexplore.exe (PID: 2368)

    • Changes internet zones settings

      • iexplore.exe (PID: 2368)

    • Creates files in the user directory

      • iexplore.exe (PID: 2632)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2904)
      • iexplore.exe (PID: 2368)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2632)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2368)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2368)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2368)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
25
Malicious processes
11
Suspicious processes
7

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs dtpro821-0709.exe no specs dtpro821-0709.exe discsoftbusservicepro.exe drvinst.exe rundll32.exe no specs vssvc.exe no specs drvinst.exe no specs drvinst.exe regsvr32.exe no specs installgadget.exe no specs regsvr32.exe no specs regsvr32.exe no specs explorer.exe no specs explorer.exe no specs sidebar.exe discsoftbusservicepro.exe no specs regsvr32.exe no specs explorer.exe no specs svchost.exe dtshellhlp.exe no specs dtpro.exe dtagent.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{1b4dd322-4feb-24a3-d44e-cc1df31ff40c} Global\{71f7fed3-80e5-22d5-f050-1f70209b2b7f} C:\Windows\System32\DriverStore\Temp\{1fd1da28-78b6-1f0c-ea5c-330949330420}\dtproscsibus.inf C:\Windows\System32\DriverStore\Temp\{1fd1da28-78b6-1f0c-ea5c-330949330420}\dtproscsibus.catC:\Windows\system32\rundll32.exe—DrvInst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
828"C:\Windows\explorer.exe" DTPro.gadgetC:\Windows\explorer.exe—InstallGadget.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
872C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1180"C:\Program Files\Windows Sidebar\sidebar.exe" (null)C:\Program Files\Windows Sidebar\sidebar.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Desktop Gadgets
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows sidebar\sidebar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1332DrvInst.exe "2" "211" "ROOT\SCSIADAPTER\0000" "C:\Windows\INF\oem4.inf" "dtproscsibus.inf:Vendor.NTx86:DTPROSCSIBUS:5.28.0.0:root\dtproscsibus" "6ade3b53b" "000003F4" "000005CC" "000005E4"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1548"C:\Users\admin\Downloads\DTPro821-0709.exe" C:\Users\admin\Downloads\DTPro821-0709.exe—iexplore.exe
User:
admin
Company:
Disc Soft Ltd
Integrity Level:
MEDIUM
Description:
DAEMON Tools Pro Setup
Exit code:
3221226540
Version:
8.2.1.0709.0
Modules
Images
c:\users\admin\downloads\dtpro821-0709.exe
c:\systemroot\system32\ntdll.dll
1696C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1828"C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe"C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe—explorer.exe
User:
admin
Company:
Disc Soft Ltd
Integrity Level:
MEDIUM
Description:
DAEMON Tools Shell Extensions Helper
Exit code:
0
Version:
8.2.1.0709
Modules
Images
c:\program files\daemon tools pro\dtshellhlp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\daemon tools pro\dtcommonres.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1932regsvr32.exe /s DTGadget32.dllC:\Windows\system32\regsvr32.exe—DTPro821-0709.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2040"C:\Program Files\DAEMON Tools Pro\DTAgent.exe" C:\Program Files\DAEMON Tools Pro\DTAgent.exe—DTPro.exe
User:
admin
Company:
Disc Soft Ltd
Integrity Level:
MEDIUM
Description:
DAEMON Tools Pro Agent
Exit code:
0
Version:
8.2.1.0709
Modules
Images
c:\program files\daemon tools pro\dtagent.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\daemon tools pro\dtcommonres.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
4 699
Read events
3 779
Write events
875
Delete events
45

Modification events

(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000006E000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{DF000579-4BC8-11E9-A302-5254004A04AF}
Value:
0
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
1
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E3070300040015000B00020035008F01
Executable files
85
Suspicious files
26
Text files
318
Unknown types
27

Dropped files

PID
Process
Filename
Type
2368iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
2368iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
872svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
2632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:—
SHA256:—
2632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
2632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WF4ZZKUH\download[1].txt —
MD5:—
SHA256:—
2632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:—
SHA256:—
2632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DATsmt
MD5:—
SHA256:—
2632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WF4ZZKUH\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
2368iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Feeds Cache\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
23
DNS requests
16
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2632
iexplore.exe
GET
302
212.38.168.6:80
http://eu-uk7.disk-tools.com/1d6b94c7bb2b89ea2601a5362fd43072/DTLite10100-0797.exe
GB
—
—
unknown
2632
iexplore.exe
GET
200
109.169.28.157:80
http://mirror31.daemon-tools.cc/getfile.php?p=http://eu-uk7.disk-tools.com/1c5d1c8b0868be7bad06c9eae52bf08c/DTPro821-0709.exe
GB
executable
31.4 Mb
suspicious
2548
DTPro.exe
POST
200
94.242.254.192:80
http://depot.mountspace.com/
LU
binary
256 b
suspicious
2632
iexplore.exe
GET
410
217.150.241.164:80
http://mirror42.mountspace.com/getfile.php?p=http://eu-uk7.disk-tools.com/1d6b94c7bb2b89ea2601a5362fd43072/DTLite10100-0797.exe
CH
—
—
suspicious
2548
DTPro.exe
GET
301
212.117.184.51:80
http://gamespace.daemon-tools.cc/widget/build/2.40/2.40_eng.zip
LU
html
185 b
unknown
2632
iexplore.exe
GET
302
212.38.168.6:80
http://eu-uk7.disk-tools.com/request?p=1c5d1c8b0868be7bad06c9eae52bf08c/DTPro821-0709.exe
GB
html
185 b
unknown
1180
sidebar.exe
GET
200
91.199.212.52:80
http://crt.comodoca.com/COMODORSAAddTrustCA.crt
GB
der
1.37 Kb
whitelisted
2632
iexplore.exe
GET
301
212.38.168.6:80
http://eu-uk7.disk-tools.com/
GB
html
185 b
unknown
2368
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3260
DTPro821-0709.exe
GET
200
216.58.210.14:80
http://www.google-analytics.com/collect?v=1&tid=UA-56351243-1&cid=12C38DD4-6B25-4938-A406-0CE7C1EFA0CC&ul=en-US&av=8.2&t=event&an=DTPro&ec=Installer&ea=Finished
US
image
35 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2548
DTPro.exe
212.117.184.51:80
gamespace.daemon-tools.cc
root SA
LU
unknown
2632
iexplore.exe
217.150.241.164:80
mirror42.mountspace.com
Nine Internet Solutions AG
CH
suspicious
2632
iexplore.exe
212.38.168.6:443
eu-uk7.disk-tools.com
iomart Cloud Services Limited.
GB
unknown
2632
iexplore.exe
212.38.168.6:80
eu-uk7.disk-tools.com
iomart Cloud Services Limited.
GB
unknown
2632
iexplore.exe
212.38.168.7:443
img.disk-tools.com
iomart Cloud Services Limited.
GB
unknown
2632
iexplore.exe
172.217.18.104:443
ssl.google-analytics.com
Google Inc.
US
suspicious
2632
iexplore.exe
172.217.21.226:443
adservice.google.ch
Google Inc.
US
whitelisted
2632
iexplore.exe
172.217.18.2:443
adservice.google.com
Google Inc.
US
whitelisted
2368
iexplore.exe
212.38.168.6:443
eu-uk7.disk-tools.com
iomart Cloud Services Limited.
GB
unknown
2368
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
mirror42.mountspace.com
  • 217.150.241.164
suspicious
eu-uk7.disk-tools.com
  • 212.38.168.6
unknown
www.disk-tools.com
  • 212.38.168.6
unknown
cdnjs.cloudflare.com
  • 104.19.196.151
  • 104.19.198.151
  • 104.19.199.151
  • 104.19.197.151
  • 104.19.195.151
whitelisted
img.disk-tools.com
  • 212.38.168.7
unknown
pagead2.googlesyndication.com
  • 172.217.22.2
whitelisted
ssl.google-analytics.com
  • 172.217.18.104
whitelisted
adservice.google.com
  • 172.217.18.2
whitelisted
adservice.google.ch
  • 172.217.21.226
whitelisted

Threats

PID
Process
Class
Message
2632
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2632
iexplore.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2632
iexplore.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://mirror42.mountspace.com/getfile.php?p=http://eu-uk7.disk-tools.com/1d6b94c7bb2b89ea2601a5362fd43072/DTLite10100-0797.exe