URL:

https://cdn.ulsinc.com/assets/other/5efbc97c3cc4b204672cc3d0/ucpinst-5.38.58.00.exe

Full analysis: https://app.any.run/tasks/62a9423c-67d6-4292-871b-f15451556bfa
Verdict: Malicious activity
Analysis date: October 15, 2020, 14:07:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6AD5E3A52D76330BA8FA914160EEB839

SHA1:

882DF14A699C054785EAAAC2589E74135AF91E07

SHA256:

89211EA43AC195952DC601E3E2A0E8654C762C778D70EF2BECCE4E0B4F632CF7

SSDEEP:

3:N8cFyl3SbzcSlreWEMLWakdL/kA:2cFS3SbzcSxeWRW1dLsA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ucpinst-5.38.58.00.exe (PID: 2396)
      • ucpinst-5.38.58.00.exe (PID: 1144)
      • GetID75.exe (PID: 2016)
      • ns24A2.tmp (PID: 3904)
      • vcredist_x86.exe (PID: 1860)
      • vcredist_x86.exe (PID: 3536)
      • ns575B.tmp (PID: 2756)
      • CopyInf.exe (PID: 1076)
      • ucpport.exe (PID: 3552)
      • InstHelper.exe (PID: 3912)
      • InstHelper.exe (PID: 2564)
      • nsBFAB.tmp (PID: 2416)
      • CopyInf.exe (PID: 984)
      • ns2B18.tmp (PID: 3664)
      • OEMSetup.exe (PID: 2216)
      • openlf.exe (PID: 3864)
      • ns8B7A.tmp (PID: 2412)
      • ns8995.tmp (PID: 1896)
      • datafolder.exe (PID: 3652)

    • Loads dropped or rewritten executable

      • ucpinst-5.38.58.00.exe (PID: 1144)
      • spoolsv.exe (PID: 1192)
      • InstHelper.exe (PID: 3912)
      • InstHelper.exe (PID: 2564)
      • openlf.exe (PID: 3864)

    • Changes the autorun value in the registry

      • vcredist_x86.exe (PID: 1860)
      • vcredist_x86.exe (PID: 3536)
      • ucpinst-5.38.58.00.exe (PID: 1144)

    • Changes settings of System certificates

      • msiexec.exe (PID: 3400)
      • rundll32.exe (PID: 1296)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2120)
      • vcredist_x86.exe (PID: 1860)
      • vcredist_x86.exe (PID: 3536)
      • msiexec.exe (PID: 3400)
      • ucpinst-5.38.58.00.exe (PID: 1144)
      • CopyInf.exe (PID: 1076)
      • DrvInst.exe (PID: 2716)
      • ucpport.exe (PID: 3552)
      • CopyInf.exe (PID: 984)
      • DrvInst.exe (PID: 3164)
      • OEMSetup.exe (PID: 2216)
      • DrvInst.exe (PID: 2624)
      • spoolsv.exe (PID: 1192)

    • Application launched itself

      • vcredist_x86.exe (PID: 1860)
      • cmd.exe (PID: 2108)

    • Adds / modifies Windows certificates

      • msiexec.exe (PID: 3400)

    • Creates files in the Windows directory

      • msiexec.exe (PID: 3400)
      • DrvInst.exe (PID: 2716)
      • ucpport.exe (PID: 3552)
      • DrvInst.exe (PID: 3164)
      • DrvInst.exe (PID: 2624)
      • spoolsv.exe (PID: 1192)
      • openlf.exe (PID: 3864)
      • ucpinst-5.38.58.00.exe (PID: 1144)

    • Starts application with an unusual extension

      • ucpinst-5.38.58.00.exe (PID: 1144)

    • Removes files from Windows directory

      • msiexec.exe (PID: 3400)
      • DrvInst.exe (PID: 2716)
      • DrvInst.exe (PID: 2508)
      • DrvInst.exe (PID: 3164)
      • DrvInst.exe (PID: 2624)
      • spoolsv.exe (PID: 1192)

    • Executed via COM

      • DrvInst.exe (PID: 2716)
      • DrvInst.exe (PID: 2508)
      • DrvInst.exe (PID: 3164)
      • DrvInst.exe (PID: 2624)
      • DrvInst.exe (PID: 3088)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2716)
      • DrvInst.exe (PID: 3164)
      • DrvInst.exe (PID: 2624)
      • ucpinst-5.38.58.00.exe (PID: 1144)

    • Uses RUNDLL32.EXE to load library

      • DrvInst.exe (PID: 2716)
      • DrvInst.exe (PID: 3164)
      • DrvInst.exe (PID: 2624)
      • OEMSetup.exe (PID: 2216)

    • Executed as Windows Service

      • vssvc.exe (PID: 3480)

    • Creates files in the program directory

      • ucpinst-5.38.58.00.exe (PID: 1144)

    • Starts CMD.EXE for commands execution

      • ns8B7A.tmp (PID: 2412)
      • cmd.exe (PID: 2108)

    • Uses ICACLS.EXE to modify access control list

      • cmd.exe (PID: 2108)

    • Creates or modifies windows services

      • ucpinst-5.38.58.00.exe (PID: 1144)

    • Creates a software uninstall entry

      • ucpinst-5.38.58.00.exe (PID: 1144)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2120)
      • iexplore.exe (PID: 1516)

    • Application launched itself

      • iexplore.exe (PID: 2120)
      • msiexec.exe (PID: 3400)

    • Changes internet zones settings

      • iexplore.exe (PID: 2120)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 1516)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2120)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1516)
      • iexplore.exe (PID: 2120)
      • DrvInst.exe (PID: 2716)
      • DrvInst.exe (PID: 3164)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1516)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2120)
      • DrvInst.exe (PID: 2716)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2120)
      • DrvInst.exe (PID: 2716)

    • Creates files in the user directory

      • iexplore.exe (PID: 2120)

    • Creates files in the program directory

      • msiexec.exe (PID: 3400)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3400)

    • Searches for installed software

      • DrvInst.exe (PID: 2716)
      • DrvInst.exe (PID: 3164)
      • DrvInst.exe (PID: 2624)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
101
Monitored processes
47
Malicious processes
10
Suspicious processes
9

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe ucpinst-5.38.58.00.exe no specs ucpinst-5.38.58.00.exe getid75.exe no specs ns24a2.tmp no specs vcredist_x86.exe vcredist_x86.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs ns575b.tmp no specs copyinf.exe drvinst.exe rundll32.exe no specs vssvc.exe no specs ucpport.exe spoolsv.exe insthelper.exe no specs insthelper.exe no specs drvinst.exe no specs nsbfab.tmp no specs copyinf.exe drvinst.exe rundll32.exe no specs ns2b18.tmp no specs oemsetup.exe drvinst.exe rundll32.exe no specs drvinst.exe no specs rundll32.exe no specs rundll32.exe no specs openlf.exe no specs ns8995.tmp no specs datafolder.exe no specs ns8b7a.tmp no specs cmd.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs regini.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
984"C:\Program Files\ULS\UCP\ULSPORT\CopyInf.exe" C:\Program Files\ULS\UCP\sys\ULSPRINT.INFC:\Program Files\ULS\UCP\ULSPORT\CopyInf.exe
nsBFAB.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\uls\ucp\ulsport\copyinf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1076"C:\Program Files\ULS\UCP\ULSPORT\CopyInf.exe" C:\Program Files\ULS\UCP\sys\ULSPRINT.INFC:\Program Files\ULS\UCP\ULSPORT\CopyInf.exe
ns575B.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\uls\ucp\ulsport\copyinf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1144"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\ucpinst-5.38.58.00.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\ucpinst-5.38.58.00.exe
iexplore.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\6z2bcoul\ucpinst-5.38.58.00.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1192C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Spooler SubSystem App
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1296rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{7f2ae744-01d9-76b5-9bd7-05604e710425} Global\{3b3e666f-f6e0-51c5-4db7-4c7211fb1a38} C:\Windows\System32\DriverStore\Temp\{0177c8b0-e2ad-2193-8d2a-8400d6570f3c}\ULSPRINT.INF C:\Windows\System32\DriverStore\Temp\{0177c8b0-e2ad-2193-8d2a-8400d6570f3c}\ulsprint.catC:\Windows\system32\rundll32.exe—DrvInst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1504C:\Windows\system32\cmd.exe /S /D /c" echo Y"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1516"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2120 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1860"C:\Program Files\ULS\vcredist_x86.exe" /q:a /c:"vcredist_x86.exe /q:a /c:""msiexec /i vcredist.msi /qn"" "C:\Program Files\ULS\vcredist_x86.exe
ns24A2.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
Modules
Images
c:\program files\uls\vcredist_x86.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1896"C:\Users\admin\AppData\Local\Temp\nsnB443.tmp\ns8995.tmp" datafolderC:\Users\admin\AppData\Local\Temp\nsnB443.tmp\ns8995.tmp—ucpinst-5.38.58.00.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsnb443.tmp\ns8995.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2016"C:\Program Files\ULS\UCP\ULSPORT\GetID75.exe" 328066C:\Program Files\ULS\UCP\ULSPORT\GetID75.exe—ucpinst-5.38.58.00.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225600
Modules
Images
c:\program files\uls\ucp\ulsport\getid75.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
3 130
Read events
1 634
Write events
1 475
Delete events
21

Modification events

(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
2998984626
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30843644
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
121
Suspicious files
96
Text files
374
Unknown types
100

Dropped files

PID
Process
Filename
Type
2120iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1516iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab8458.tmp —
MD5:—
SHA256:—
1516iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar8459.tmp —
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF42415C432677E279.TMP —
MD5:—
SHA256:—
1516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ucpinst-5.38.58.00[1].exe —
MD5:—
SHA256:—
1516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\ucpinst-5.38.58.00.exe.gvaookq.partial —
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC4C413A121E81E58.TMP —
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\ucpinst-5.38.58.00.exe.gvaookq.partial:Zone.Identifier —
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Temp\CabA1A4.tmp —
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Temp\TarA1A5.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
27
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1516
iexplore.exe
GET
200
13.35.253.205:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEATZdopdVRV8Dl%2BU3X7%2ByEU%3D
US
der
471 b
whitelisted
1516
iexplore.exe
GET
200
13.35.253.128:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
1516
iexplore.exe
GET
200
13.35.253.128:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
1516
iexplore.exe
GET
200
13.35.253.15:80
http://crl.rootg2.amazontrust.com/rootg2.crl
US
der
608 b
whitelisted
2120
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
1516
iexplore.exe
GET
200
13.35.253.15:80
http://crl.rootg2.amazontrust.com/rootg2.crl
US
der
608 b
whitelisted
1516
iexplore.exe
GET
200
13.35.253.15:80
http://crl.rootca1.amazontrust.com/rootca1.crl
US
der
439 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1516
iexplore.exe
99.86.7.17:443
cdn.ulsinc.com
AT&T Services, Inc.
US
unknown
1516
iexplore.exe
13.35.253.128:80
o.ss2.us
—
US
suspicious
1516
iexplore.exe
13.35.253.198:80
ocsp.rootg2.amazontrust.com
—
US
whitelisted
2120
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1516
iexplore.exe
13.35.253.15:80
crl.rootg2.amazontrust.com
—
US
whitelisted
1516
iexplore.exe
13.35.253.5:80
ocsp.rootg2.amazontrust.com
—
US
whitelisted
1516
iexplore.exe
13.35.253.205:80
ocsp.sca1b.amazontrust.com
—
US
whitelisted
2120
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2120
iexplore.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2120
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
cdn.ulsinc.com
  • 99.86.7.17
  • 99.86.7.45
  • 99.86.7.118
  • 99.86.7.70
whitelisted
o.ss2.us
  • 13.35.253.128
  • 13.35.253.97
  • 13.35.253.170
  • 13.35.253.32
whitelisted
ocsp.rootg2.amazontrust.com
  • 13.35.253.198
  • 13.35.253.5
  • 13.35.253.148
  • 13.35.253.185
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
crl.rootg2.amazontrust.com
  • 13.35.253.15
  • 13.35.253.157
  • 13.35.253.129
  • 13.35.253.125
whitelisted
ocsp.rootca1.amazontrust.com
  • 13.35.253.198
  • 13.35.253.148
  • 13.35.253.185
  • 13.35.253.5
shared
crl.rootca1.amazontrust.com
  • 13.35.253.15
  • 13.35.253.129
  • 13.35.253.125
  • 13.35.253.157
whitelisted
ocsp.sca1b.amazontrust.com
  • 13.35.253.205
  • 13.35.253.7
  • 13.35.253.20
  • 13.35.253.165
whitelisted
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

No threats detected
Process
Message
OEMSetup.exe
do
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cdn.ulsinc.com/assets/other/5efbc97c3cc4b204672cc3d0/ucpinst-5.38.58.00.exe