File name:

uiso9_cn_9.7.0.3476.exe

Full analysis: https://app.any.run/tasks/809672fe-3eb5-45a5-837d-8680e92c69a5
Verdict: Malicious activity
Analysis date: April 29, 2025, 01:47:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

E67B238FD307435CE05DD36ABB7BD681

SHA1:

BA4D127BD4BD953544BF2949252578AE612FFAE7

SHA256:

A46EF9291B3ACA45CCBD5A9FF7DCF1F9958A1033BF5B212C19D6D4D550C050D6

SSDEEP:

98304:Z4adL7Mfb5kBv2ro9m4yFO+2dXs0tgvue1/uW2PG5B0Uhxt1Kc8jrj6iPxZDR4H/:3P1VK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • uiso9_cn_9.7.0.3476.exe (PID: 5556)
      • IsoCmd.exe (PID: 7988)

    • Registers / Runs the DLL via REGSVR32.EXE

      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • uiso9_cn_9.7.0.3476.exe (PID: 5556)
      • uiso9_cn_9.7.0.3476.exe (PID: 7200)
      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)

    • Reads security settings of Internet Explorer

      • uiso9_cn_9.7.0.3476.tmp (PID: 5596)

    • Reads the Windows owner or organization settings

      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)

    • Drops a system driver (possible attempt to evade defenses)

      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 7972)

  • INFO

    • Checks supported languages

      • uiso9_cn_9.7.0.3476.exe (PID: 5556)
      • uiso9_cn_9.7.0.3476.tmp (PID: 5596)
      • uiso9_cn_9.7.0.3476.exe (PID: 7200)
      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)
      • IsoCmd.exe (PID: 7988)
      • UltraISO.exe (PID: 8128)

    • Create files in a temporary directory

      • uiso9_cn_9.7.0.3476.exe (PID: 5556)
      • uiso9_cn_9.7.0.3476.exe (PID: 7200)
      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)

    • Process checks computer location settings

      • uiso9_cn_9.7.0.3476.tmp (PID: 5596)

    • Reads the computer name

      • uiso9_cn_9.7.0.3476.tmp (PID: 5596)
      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)
      • IsoCmd.exe (PID: 7988)
      • UltraISO.exe (PID: 8128)

    • Detects InnoSetup installer (YARA)

      • uiso9_cn_9.7.0.3476.exe (PID: 5556)
      • uiso9_cn_9.7.0.3476.tmp (PID: 5596)
      • uiso9_cn_9.7.0.3476.exe (PID: 7200)
      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)

    • Compiled with Borland Delphi (YARA)

      • uiso9_cn_9.7.0.3476.tmp (PID: 5596)
      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)

    • Creates files in the program directory

      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)

    • The sample compiled with english language support

      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)

    • Creates a software uninstall entry

      • uiso9_cn_9.7.0.3476.tmp (PID: 7220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (81.5)
.exe | Win32 Executable Delphi generic (10.5)
.exe | Win32 Executable (generic) (3.3)
.exe | Win16/32 Executable Delphi generic (1.5)
.exe | Generic Win/DOS Executable (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 41472
InitializedDataSize: 85504
UninitializedDataSize: -
EntryPoint: 0xaa98
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.7.0.3476
ProductVersionNumber: 9.7.0.3476
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: EZB Systems, Inc.
FileDescription: UltraISO Setup
FileVersion: 9.7.0.3476
LegalCopyright: (c) EZB Systems, Inc.
ProductName: UltraISO
ProductVersion: 9.7
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
10
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start uiso9_cn_9.7.0.3476.exe uiso9_cn_9.7.0.3476.tmp no specs uiso9_cn_9.7.0.3476.exe uiso9_cn_9.7.0.3476.tmp sppextcomobj.exe no specs slui.exe no specs regsvr32.exe no specs isocmd.exe no specs conhost.exe no specs ultraiso.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5556"C:\Users\admin\AppData\Local\Temp\uiso9_cn_9.7.0.3476.exe" C:\Users\admin\AppData\Local\Temp\uiso9_cn_9.7.0.3476.exe
explorer.exe
User:
admin
Company:
EZB Systems, Inc.
Integrity Level:
MEDIUM
Description:
UltraISO Setup
Exit code:
0
Version:
9.7.0.3476
Modules
Images
c:\users\admin\appdata\local\temp\uiso9_cn_9.7.0.3476.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5596"C:\Users\admin\AppData\Local\Temp\is-ATBG1.tmp\uiso9_cn_9.7.0.3476.tmp" /SL5="$90272,2148413,128000,C:\Users\admin\AppData\Local\Temp\uiso9_cn_9.7.0.3476.exe" C:\Users\admin\AppData\Local\Temp\is-ATBG1.tmp\uiso9_cn_9.7.0.3476.tmp—uiso9_cn_9.7.0.3476.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-atbg1.tmp\uiso9_cn_9.7.0.3476.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7200"C:\Users\admin\AppData\Local\Temp\uiso9_cn_9.7.0.3476.exe" /SPAWNWND=$50294 /NOTIFYWND=$90272 C:\Users\admin\AppData\Local\Temp\uiso9_cn_9.7.0.3476.exe
uiso9_cn_9.7.0.3476.tmp
User:
admin
Company:
EZB Systems, Inc.
Integrity Level:
HIGH
Description:
UltraISO Setup
Exit code:
0
Version:
9.7.0.3476
Modules
Images
c:\users\admin\appdata\local\temp\uiso9_cn_9.7.0.3476.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7220"C:\Users\admin\AppData\Local\Temp\is-QDL42.tmp\uiso9_cn_9.7.0.3476.tmp" /SL5="$802D2,2148413,128000,C:\Users\admin\AppData\Local\Temp\uiso9_cn_9.7.0.3476.exe" /SPAWNWND=$50294 /NOTIFYWND=$90272 C:\Users\admin\AppData\Local\Temp\is-QDL42.tmp\uiso9_cn_9.7.0.3476.tmp
uiso9_cn_9.7.0.3476.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-qdl42.tmp\uiso9_cn_9.7.0.3476.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7268C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7300"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7972"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files (x86)\UltraISO\isoshl64.dll"C:\Windows\System32\regsvr32.exe—uiso9_cn_9.7.0.3476.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7988"C:\Program Files (x86)\UltraISO\drivers\isocmd.exe" -iC:\Program Files (x86)\UltraISO\drivers\IsoCmd.exe—uiso9_cn_9.7.0.3476.tmp
User:
admin
Company:
EZB Systems, Inc.
Integrity Level:
HIGH
Description:
ISO Command
Exit code:
0
Version:
3.12 built by: WinDDK
Modules
Images
c:\program files (x86)\ultraiso\drivers\isocmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7996\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—IsoCmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8128"C:\Program Files (x86)\UltraISO\UltraISO.exe"C:\Program Files (x86)\UltraISO\UltraISO.exe—uiso9_cn_9.7.0.3476.tmp
User:
admin
Company:
EZB Systems, Inc.
Integrity Level:
HIGH
Description:
UltraISO Premium
Version:
9.7.0.3476
Modules
Images
c:\program files (x86)\ultraiso\ultraiso.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\setupapi.dll
Total events
778
Read events
742
Write events
36
Delete events
0

Modification events

(PID) Process:(7220) uiso9_cn_9.7.0.3476.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EasyBoot Systems\UltraISO\5.0
Operation:writeName:Shared
Value:
C:\Program Files (x86)\Common Files\EZB Systems
(PID) Process:(7220) uiso9_cn_9.7.0.3476.tmpKey:HKEY_CURRENT_USER\SOFTWARE\EasyBoot Systems\UltraISO\5.0
Operation:writeName:Shared
Value:
C:\Program Files (x86)\Common Files\EZB Systems
(PID) Process:(7220) uiso9_cn_9.7.0.3476.tmpKey:HKEY_CURRENT_USER\SOFTWARE\EasyBoot Systems\UltraISO\5.0
Operation:writeName:XPBurn
Value:
0
(PID) Process:(7220) uiso9_cn_9.7.0.3476.tmpKey:HKEY_CURRENT_USER\SOFTWARE\EasyBoot Systems\UltraISO\5.0
Operation:writeName:ISOFolder
Value:
C:\Users\admin\Documents\My ISO Files
(PID) Process:(7220) uiso9_cn_9.7.0.3476.tmpKey:HKEY_CURRENT_USER\SOFTWARE\EasyBoot Systems\UltraISO\5.0
Operation:writeName:UseSkins
Value:
1
(PID) Process:(7220) uiso9_cn_9.7.0.3476.tmpKey:HKEY_CURRENT_USER\SOFTWARE\EasyBoot Systems\UltraISO\5.0
Operation:writeName:SoundEffect
Value:
1
(PID) Process:(7220) uiso9_cn_9.7.0.3476.tmpKey:HKEY_CURRENT_USER\SOFTWARE\EasyBoot Systems\UltraISO\5.0
Operation:writeName:Language
Value:
2052
(PID) Process:(7220) uiso9_cn_9.7.0.3476.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EasyBoot Systems\UltraISO\5.0
Operation:writeName:Install
Value:
1
(PID) Process:(7220) uiso9_cn_9.7.0.3476.tmpKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ISODrive\Parameters
Operation:writeName:AutoMount
Value:
1
(PID) Process:(7972) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Operation:writeName:{AD392E40-428C-459F-961E-9B147782D099}
Value:
UltraISO
Executable files
23
Suspicious files
11
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
7200uiso9_cn_9.7.0.3476.exeC:\Users\admin\AppData\Local\Temp\is-QDL42.tmp\uiso9_cn_9.7.0.3476.tmpexecutable
MD5:0856978F29AE90DC02A700A33FE0302E
SHA256:E0E512BF5E39C44DB7EDA3A0BA2DBAF91C5B61E5FA233C9D293068F4FCD92E82
7220uiso9_cn_9.7.0.3476.tmpC:\Program Files (x86)\UltraISO\UltraISO.exeexecutable
MD5:8266D1CC1523E588DD66EC34B035111C
SHA256:A00E312ECBE98E6878A9D406A9C835202C8C5E08E5A3C97BF16B3FFE641B8ED2
7220uiso9_cn_9.7.0.3476.tmpC:\Program Files (x86)\UltraISO\is-CGG9E.tmpexecutable
MD5:470FD60E4B077777FD425AE1754970F5
SHA256:C85E2FA9DAD115DCE419E7981826822A90C13337DE92DF7EDA26FBB28B9D7B0F
7220uiso9_cn_9.7.0.3476.tmpC:\Program Files (x86)\UltraISO\unins000.exeexecutable
MD5:470FD60E4B077777FD425AE1754970F5
SHA256:C85E2FA9DAD115DCE419E7981826822A90C13337DE92DF7EDA26FBB28B9D7B0F
7220uiso9_cn_9.7.0.3476.tmpC:\Program Files (x86)\UltraISO\is-BSPUB.tmpexecutable
MD5:8266D1CC1523E588DD66EC34B035111C
SHA256:A00E312ECBE98E6878A9D406A9C835202C8C5E08E5A3C97BF16B3FFE641B8ED2
7220uiso9_cn_9.7.0.3476.tmpC:\Program Files (x86)\UltraISO\isoshl64.dllexecutable
MD5:DFDEAE11189400BF8DA520FAF005AA61
SHA256:4DB9E7BEECE7F4B65004DBB399D47643745BA0629BCCDE11D0E1669209DEFF8C
7220uiso9_cn_9.7.0.3476.tmpC:\Program Files (x86)\UltraISO\drivers\ISODrive.sysexecutable
MD5:5645290B24D23612D8AE10BBE8BF03CE
SHA256:21DC0FFF80748CE3115658BD6CDFF9FC13711ED9E686D25233C3A73535157D0F
7220uiso9_cn_9.7.0.3476.tmpC:\Program Files (x86)\UltraISO\drivers\is-MVVB6.tmpexecutable
MD5:5645290B24D23612D8AE10BBE8BF03CE
SHA256:21DC0FFF80748CE3115658BD6CDFF9FC13711ED9E686D25233C3A73535157D0F
7220uiso9_cn_9.7.0.3476.tmpC:\Program Files (x86)\UltraISO\drivers\ISODrv64.sysexecutable
MD5:E489D12FF435AEEF4A5474C47D329590
SHA256:66A01F63EE4F66C0CD5BB9BF20E1722D57CC8252AC126780800806B536F4CEA9
5556uiso9_cn_9.7.0.3476.exeC:\Users\admin\AppData\Local\Temp\is-ATBG1.tmp\uiso9_cn_9.7.0.3476.tmpexecutable
MD5:0856978F29AE90DC02A700A33FE0302E
SHA256:E0E512BF5E39C44DB7EDA3A0BA2DBAF91C5B61E5FA233C9D293068F4FCD92E82
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
20
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7828
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7828
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.4
  • 20.190.160.20
  • 20.190.160.5
  • 20.190.160.132
  • 20.190.160.67
  • 40.126.32.134
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
uiso9_cn_9.7.0.3476.exe