File name:

UltraUXThemePatcher_4.4.4.exe

Full analysis: https://app.any.run/tasks/86c3c787-426a-4510-b01b-cdcac65de0ca
Verdict: Malicious activity
Analysis date: June 21, 2025, 15:50:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

3276BF178249904F4E9AC0958F32D906

SHA1:

8C8421055DE59718EFF8C535F3B447132B5322F1

SHA256:

9945195D54509CA4E8A41E468851137A56F711163D4FCBE4A8692ED24023A739

SSDEEP:

3072:89Y63Sq4u9dC3Sn1aJnys0Qgnio9XL9F3SbdCvzNCv5HhQDem17tP1q/:HKSyASn1GneQgniYDSxCpMZhQDV17Jk/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Executable content was dropped or overwritten

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • The process creates files with name similar to system file names

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6796)

    • Reads security settings of Internet Explorer

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Searches for installed software

      • dllhost.exe (PID: 5780)

    • Uses ICACLS.EXE to modify access control lists

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Process drops legitimate windows executable

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Takes ownership (TAKEOWN.EXE)

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Creates a software uninstall entry

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Application launched itself

      • updater.exe (PID: 4132)

    • The process executes via Task Scheduler

      • updater.exe (PID: 4132)
      • PLUGScheduler.exe (PID: 4148)

  • INFO

    • Checks supported languages

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)
      • updater.exe (PID: 4132)
      • updater.exe (PID: 5052)
      • PLUGScheduler.exe (PID: 4148)

    • The sample compiled with english language support

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Reads the computer name

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)
      • updater.exe (PID: 4132)
      • PLUGScheduler.exe (PID: 4148)

    • Create files in a temporary directory

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Reads Environment values

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Manages system restore points

      • SrTasks.exe (PID: 2532)

    • Creates files in the program directory

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)
      • PLUGScheduler.exe (PID: 4148)

    • Process checks computer location settings

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Creates files or folders in the user directory

      • UltraUXThemePatcher_4.4.4.exe (PID: 1644)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 4132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:08 23:05:20+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 139776
UninitializedDataSize: 2048
EntryPoint: 0x369f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.4.4.0
ProductVersionNumber: 4.4.4.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: UltraUXThemePatcher modifies your system file(s) to use 3rd party themes
CompanyName: Manuel Hoefs (Zottel)
FileDescription: Windows UltraUXThemePatcher
FileVersion: 4.4.4.0
InternalName: UltraUXThemePatcher_4.4.4
LegalCopyright: 2008 - 2025 Manuel Hoefs (Zottel)
LegalTrademarks: UltraUXThemePatcher created by Manuel Hoefs (Zottel)
OriginalFileName: UltraUXThemePatcher_4.4.4.exe
ProductName: UltraUXThemePatcher
ProductVersion: 4.4.4.0
Website: https://mhoefs.eu
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
278
Monitored processes
21
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ultrauxthemepatcher_4.4.4.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs takeown.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs takeown.exe no specs conhost.exe no specs takeown.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs takeown.exe no specs conhost.exe no specs updater.exe no specs plugscheduler.exe no specs updater.exe no specs ultrauxthemepatcher_4.4.4.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1568"C:\Users\admin\Desktop\UltraUXThemePatcher_4.4.4.exe" C:\Users\admin\Desktop\UltraUXThemePatcher_4.4.4.exe—explorer.exe
User:
admin
Company:
Manuel Hoefs (Zottel)
Integrity Level:
MEDIUM
Description:
Windows UltraUXThemePatcher
Exit code:
3221226540
Version:
4.4.4.0
Modules
Images
c:\users\admin\desktop\ultrauxthemepatcher_4.4.4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1644"C:\Users\admin\Desktop\UltraUXThemePatcher_4.4.4.exe" C:\Users\admin\Desktop\UltraUXThemePatcher_4.4.4.exe
explorer.exe
User:
admin
Company:
Manuel Hoefs (Zottel)
Integrity Level:
HIGH
Description:
Windows UltraUXThemePatcher
Exit code:
0
Version:
4.4.4.0
Modules
Images
c:\users\admin\desktop\ultrauxthemepatcher_4.4.4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—takeown.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1816\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—takeown.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2292\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2532C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
1073807364
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2648"C:\WINDOWS\system32\takeown.exe" /f "C:\WINDOWS\system32\uxinit.dll"C:\Windows\System32\takeown.exe—UltraUXThemePatcher_4.4.4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Takes ownership of a file
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\takeown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3844\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3964"C:\WINDOWS\system32\icacls.exe" "C:\WINDOWS\system32\uxinit.dll" /grant admin:FC:\Windows\System32\icacls.exe—UltraUXThemePatcher_4.4.4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4088\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—takeown.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
2 303
Read events
2 103
Write events
182
Delete events
18

Modification events

(PID) Process:(1644) UltraUXThemePatcher_4.4.4.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000606E2958C4E2DB016C0600006C040000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5780) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000D0DA8858C4E2DB0194160000AC0F0000E803000001000000000000000000000089FBC472363F5245AFF00FC79F05918500000000000000000000000000000000
(PID) Process:(6796) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000D1BA9458C4E2DB018C1A0000AC080000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6796) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000009E1E9758C4E2DB018C1A0000FC0E0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6796) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000009E1E9758C4E2DB018C1A000080170000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6796) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000009E1E9758C4E2DB018C1A0000C0040000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6796) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(6796) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(6796) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(6796) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
Executable files
13
Suspicious files
45
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
5780dllhost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1644UltraUXThemePatcher_4.4.4.exeC:\Users\admin\AppData\Local\Temp\nsp736D.tmp\System.dllexecutable
MD5:9B38A1B07A0EBC5C7E59E63346ECC2DB
SHA256:C881253DAFCF1322A771139B1A429EC1E78C507CA81A218A20DC1A4B25ABBFE7
1644UltraUXThemePatcher_4.4.4.exeC:\Users\admin\AppData\Local\Temp\nsp736D.tmp\nsDialogs.dllexecutable
MD5:8F0E7415F33843431DF308BB8E06AF81
SHA256:BB49F15FA83452370047A7801E39FC7F64E70C7545B8999BB85AA4749EAA048B
1644UltraUXThemePatcher_4.4.4.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UltraUXThemePatcher\Homepage.urlbinary
MD5:882495A1A22BA12816D505BBF53BB2E5
SHA256:D1908AF1B95473AC1F450ED8E042AA79DA6B8EA609529A6940D836695F4D8908
1644UltraUXThemePatcher_4.4.4.exeC:\Windows\System32\uxinit.dll.backupexecutable
MD5:F125A0876D8684A04F4BABD010DAF904
SHA256:D45894E386AA667220EA8B5397A82449EDC8E977EE1EA8CB2B78FFEE2A64A73B
1644UltraUXThemePatcher_4.4.4.exeC:\Program Files (x86)\UltraUXThemePatcher\Uninstall.exeexecutable
MD5:C2B590236410895EA72D586039A8803B
SHA256:460951CD4961DF57E035BED66CDD5FAC4FA377CDF28768DE139386ED2F353677
1644UltraUXThemePatcher_4.4.4.exeC:\Windows\System32\uxinit.dll.oldexecutable
MD5:F125A0876D8684A04F4BABD010DAF904
SHA256:D45894E386AA667220EA8B5397A82449EDC8E977EE1EA8CB2B78FFEE2A64A73B
1644UltraUXThemePatcher_4.4.4.exeC:\Windows\System32\uxinit.dll.newexecutable
MD5:F125A0876D8684A04F4BABD010DAF904
SHA256:D45894E386AA667220EA8B5397A82449EDC8E977EE1EA8CB2B78FFEE2A64A73B
1644UltraUXThemePatcher_4.4.4.exeC:\Windows\System32\uxinit.dllexecutable
MD5:40C064486D8D485BCCB0020EE33CCF8A
SHA256:F5D9874C6FF19307DA15FEFF354C7CD755945B7BACA6F3B6022B8347EB34CEFC
1644UltraUXThemePatcher_4.4.4.exeC:\Users\admin\AppData\Local\Temp\nsz735C.tmpbinary
MD5:AAA68E79E997E9C6FB567F40B3E348AE
SHA256:25329BA16DC0F140C54ECFA1F8ED992502D0299A45328CFD7EA8D1E20F59922B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
25
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4960
RUXIMICS.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4960
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
52.109.76.240:443
https://officeclient.microsoft.com/config16/?syslcid=1033&build=16.0.16026&crev=3
unknown
xml
180 Kb
whitelisted
—
—
GET
200
2.23.227.208:443
https://www.bing.com/manifest/threshold.appcache
unknown
text
3.09 Kb
whitelisted
—
—
POST
204
2.23.227.208:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
whitelisted
—
—
GET
200
2.23.227.208:443
https://www.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=DyIrb3t-gQF4cnWyAbUBK6UBK7gB&or=w
unknown
binary
21.3 Kb
whitelisted
—
—
GET
200
2.23.227.215:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init
unknown
html
129 Kb
whitelisted
—
—
GET
200
2.23.227.208:443
https://www.bing.com/rb/16/jnc,nj/-M-8YWX0KlEtdAHVrkTvKQHOghs.js?bu=Dicwe4sBkgGVAYgBgQGFAcABwwEwuAHGAQ&or=w
unknown
binary
22.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4960
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
4960
RUXIMICS.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5944
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4960
RUXIMICS.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.22
whitelisted
self.events.data.microsoft.com
  • 20.42.73.27
  • 20.189.173.24
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
www.bing.com
  • 2.16.241.218
  • 2.16.241.205
  • 2.16.241.201
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
UltraUXThemePatcher_4.4.4.exe