File name:

UltraISO Premium Edition .zip

Full analysis: https://app.any.run/tasks/b0570fcf-e7eb-4f37-8b67-28308a4aed74
Verdict: Malicious activity
Analysis date: April 29, 2025, 17:15:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
inno
installer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

B4F6208EA77D118776601C274A1866B8

SHA1:

5382CA5E88BF31A1A701456A1921531C3C4415C6

SHA256:

A6F17EA3B20411CB6B327754DBD395DF21B92EC513D770F1AC993E5B1D93194A

SSDEEP:

98304:CQ6asfV0UqFpvtaEPEhBWnvoy0vMErvZeVgoR6c4odnH1V4efiNy1ed6gMHlaLNT:uUjpWUDS3oIQE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5404)

    • Registers / Runs the DLL via REGSVR32.EXE

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 5892)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • Cracked.exe (PID: 7084)

    • Executable content was dropped or overwritten

      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 1280)
      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 2692)
      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • UltraISO Premium Edition Patch.exe (PID: 2904)

    • Reads the Windows owner or organization settings

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)

    • Drops a system driver (possible attempt to evade defenses)

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 4724)

    • Starts CMD.EXE for commands execution

      • Cracked.exe (PID: 7084)

    • Executing commands from a ".bat" file

      • Cracked.exe (PID: 7084)

    • Uses REG/REGEDIT.EXE to modify registry

      • UltraISO Premium Edition Patch.exe (PID: 2904)

  • INFO

    • Manual execution by a user

      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 1280)
      • UltraISO Premium Edition Patch.exe (PID: 1184)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • msedge.exe (PID: 4180)
      • UltraISO.exe (PID: 7196)

    • Checks supported languages

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 5892)
      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 2692)
      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 1280)
      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • IsoCmd.exe (PID: 1012)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • Cracked.exe (PID: 7084)

    • Reads the computer name

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 5892)
      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • IsoCmd.exe (PID: 1012)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • Cracked.exe (PID: 7084)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5404)

    • Create files in a temporary directory

      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 1280)
      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 2692)
      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • Cracked.exe (PID: 7084)

    • Process checks computer location settings

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 5892)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • Cracked.exe (PID: 7084)

    • Creates files in the program directory

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • UltraISO Premium Edition Patch.exe (PID: 2904)

    • The sample compiled with english language support

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • UltraISO Premium Edition Patch.exe (PID: 2904)

    • The sample compiled with chinese language support

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)

    • Creates a software uninstall entry

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)

    • Detects InnoSetup installer (YARA)

      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 1280)

    • Application launched itself

      • msedge.exe (PID: 6228)
      • msedge.exe (PID: 4180)
      • msedge.exe (PID: 7752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2023:07:08 00:00:00
ZipCRC: 0x280ee682
ZipCompressedSize: 5088035
ZipUncompressedSize: 5129120
ZipFileName: UltraISO Premium Edition v9.7.6.3860.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
48
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs ultraiso premium edition v9.7.6.3860.exe ultraiso premium edition v9.7.6.3860.tmp no specs ultraiso premium edition v9.7.6.3860.exe ultraiso premium edition v9.7.6.3860.tmp regsvr32.exe no specs isocmd.exe no specs conhost.exe no specs ultraiso premium edition patch.exe no specs ultraiso premium edition patch.exe regedit.exe no specs cracked.exe no specs cmd.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ultraiso.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1976 --field-trial-handle=1980,i,7930928319339995874,17055773533120224790,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
812"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3504 --field-trial-handle=2496,i,17054801482505450546,1350317766039383703,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012"C:\Program Files (x86)\UltraISO\drivers\isocmd.exe" -iC:\Program Files (x86)\UltraISO\drivers\IsoCmd.exe—UltraISO Premium Edition v9.7.6.3860.tmp
User:
admin
Company:
EZB Systems, Inc.
Integrity Level:
HIGH
Description:
ISO Command
Exit code:
0
Version:
3.21 built by: WinDDK
Modules
Images
c:\program files (x86)\ultraiso\drivers\isocmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1184"C:\Users\admin\Desktop\UltraISO Premium Edition Patch.exe" C:\Users\admin\Desktop\UltraISO Premium Edition Patch.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\ultraiso premium edition patch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1184"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5192 --field-trial-handle=2380,i,759955305879442849,13717734448421571009,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280"C:\Users\admin\Desktop\UltraISO Premium Edition v9.7.6.3860.exe" C:\Users\admin\Desktop\UltraISO Premium Edition v9.7.6.3860.exe
explorer.exe
User:
admin
Company:
EZB Systems, Inc.
Integrity Level:
MEDIUM
Description:
UltraISO Setup
Exit code:
0
Version:
9.7.6.3860
Modules
Images
c:\users\admin\desktop\ultraiso premium edition v9.7.6.3860.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1764C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\3C79.tmp\Cracked.bat" "C:\Program Files (x86)\UltraISO\Cracked.exe""C:\Windows\SysWOW64\cmd.exe—Cracked.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1812"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5284 --field-trial-handle=2380,i,759955305879442849,13717734448421571009,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2108\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2692"C:\Users\admin\Desktop\UltraISO Premium Edition v9.7.6.3860.exe" /SPAWNWND=$50256 /NOTIFYWND=$5025C C:\Users\admin\Desktop\UltraISO Premium Edition v9.7.6.3860.exe
UltraISO Premium Edition v9.7.6.3860.tmp
User:
admin
Company:
EZB Systems, Inc.
Integrity Level:
HIGH
Description:
UltraISO Setup
Exit code:
0
Version:
9.7.6.3860
Modules
Images
c:\users\admin\desktop\ultraiso premium edition v9.7.6.3860.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
10 928
Read events
10 838
Write events
77
Delete events
13

Modification events

(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\UltraISO Premium Edition .zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
126
Suspicious files
237
Text files
59
Unknown types
0

Dropped files

PID
Process
Filename
Type
2692UltraISO Premium Edition v9.7.6.3860.exeC:\Users\admin\AppData\Local\Temp\is-V1IBI.tmp\UltraISO Premium Edition v9.7.6.3860.tmpexecutable
MD5:3DE2992C86C78E781881E9C0DB26A32F
SHA256:E9700438D88E5A5F54D6940A4129477E943DCD4B95B006D0B38EF1E2A566A642
5404WinRAR.exeC:\Users\admin\Desktop\UltraISO Premium Edition v9.7.6.3860.exeexecutable
MD5:4BFA328D9DBE187DD545DD777592E7E4
SHA256:2FBA72CE12E770DD3699B06C25883FB6C7F68834EECAD557668BEAA4FBBD422B
1280UltraISO Premium Edition v9.7.6.3860.exeC:\Users\admin\AppData\Local\Temp\is-D656V.tmp\UltraISO Premium Edition v9.7.6.3860.tmpexecutable
MD5:3DE2992C86C78E781881E9C0DB26A32F
SHA256:E9700438D88E5A5F54D6940A4129477E943DCD4B95B006D0B38EF1E2A566A642
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\isoshl64.dllexecutable
MD5:C0FC6C67BD9D9FBC4F8AD44232D49D11
SHA256:50DF2E7BA2AB1892DD1E8C03BE51A1DFA9C1ECC501D5166CD5E69BADB4A8C503
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\drivers\ISODrv64.sysexecutable
MD5:BC81814B594286BEF9913EC5CA1110D7
SHA256:9C22B6F77E929D319C5E891EE1510045DC5F486BDAF47A0696564D4D84D30379
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\drivers\is-NU03B.tmpexecutable
MD5:BC81814B594286BEF9913EC5CA1110D7
SHA256:9C22B6F77E929D319C5E891EE1510045DC5F486BDAF47A0696564D4D84D30379
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\drivers\is-MT5PU.tmpexecutable
MD5:278075F074EF5EAF8D57DF223BC8CD82
SHA256:A4AF61F2CE903911F964A000F663F92CF27B82387AEB4FD924068E26615AD6B3
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\drivers\is-KCC1L.tmpexecutable
MD5:55677A521DD34CE7A93AB3F1D12B2DFD
SHA256:FC506CB2CE0FA9A994DB2E29A595F818FE93CAE93DD2F8CCA6F4B40944907C5C
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\drivers\IsoCmd.exeexecutable
MD5:55677A521DD34CE7A93AB3F1D12B2DFD
SHA256:FC506CB2CE0FA9A994DB2E29A595F818FE93CAE93DD2F8CCA6F4B40944907C5C
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\drivers\is-2UQ5G.tmpexecutable
MD5:B1CD3F9E805D2225133BA99CA93D34BC
SHA256:2FA5C3457AACB299886D27254A5DA71D4B7715C41ED57F10A492B48E8F8F37C5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
38
DNS requests
38
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.31:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6032
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6032
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.31:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.31
  • 23.216.77.22
  • 23.216.77.25
  • 23.216.77.21
  • 23.216.77.33
  • 23.216.77.30
  • 23.216.77.28
  • 23.216.77.27
  • 23.216.77.37
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.133
  • 40.126.32.134
  • 20.190.160.3
  • 40.126.32.72
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
UltraISO Premium Edition .zip