File name:

UltraISO Premium Edition .zip

Full analysis: https://app.any.run/tasks/b0570fcf-e7eb-4f37-8b67-28308a4aed74
Verdict: Malicious activity
Analysis date: April 29, 2025, 17:15:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
inno
installer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

B4F6208EA77D118776601C274A1866B8

SHA1:

5382CA5E88BF31A1A701456A1921531C3C4415C6

SHA256:

A6F17EA3B20411CB6B327754DBD395DF21B92EC513D770F1AC993E5B1D93194A

SSDEEP:

98304:CQ6asfV0UqFpvtaEPEhBWnvoy0vMErvZeVgoR6c4odnH1V4efiNy1ed6gMHlaLNT:uUjpWUDS3oIQE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5404)

    • Registers / Runs the DLL via REGSVR32.EXE

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 1280)
      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 2692)
      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • UltraISO Premium Edition Patch.exe (PID: 2904)

    • Reads security settings of Internet Explorer

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 5892)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • Cracked.exe (PID: 7084)

    • Reads the Windows owner or organization settings

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)

    • Drops a system driver (possible attempt to evade defenses)

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 4724)

    • Uses REG/REGEDIT.EXE to modify registry

      • UltraISO Premium Edition Patch.exe (PID: 2904)

    • Starts CMD.EXE for commands execution

      • Cracked.exe (PID: 7084)

    • Executing commands from a ".bat" file

      • Cracked.exe (PID: 7084)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5404)

    • Manual execution by a user

      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 1280)
      • UltraISO Premium Edition Patch.exe (PID: 1184)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • UltraISO.exe (PID: 7196)
      • msedge.exe (PID: 4180)

    • Create files in a temporary directory

      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 1280)
      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 2692)
      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • Cracked.exe (PID: 7084)

    • Checks supported languages

      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 1280)
      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 5892)
      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 2692)
      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • IsoCmd.exe (PID: 1012)
      • Cracked.exe (PID: 7084)

    • Reads the computer name

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 5892)
      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • IsoCmd.exe (PID: 1012)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • Cracked.exe (PID: 7084)

    • Process checks computer location settings

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 5892)
      • UltraISO Premium Edition Patch.exe (PID: 2904)
      • Cracked.exe (PID: 7084)

    • Creates files in the program directory

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • UltraISO Premium Edition Patch.exe (PID: 2904)

    • The sample compiled with chinese language support

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)

    • Creates a software uninstall entry

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)

    • Detects InnoSetup installer (YARA)

      • UltraISO Premium Edition v9.7.6.3860.exe (PID: 1280)

    • The sample compiled with english language support

      • UltraISO Premium Edition v9.7.6.3860.tmp (PID: 4988)
      • UltraISO Premium Edition Patch.exe (PID: 2904)

    • Application launched itself

      • msedge.exe (PID: 4180)
      • msedge.exe (PID: 6228)
      • msedge.exe (PID: 7752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2023:07:08 00:00:00
ZipCRC: 0x280ee682
ZipCompressedSize: 5088035
ZipUncompressedSize: 5129120
ZipFileName: UltraISO Premium Edition v9.7.6.3860.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
48
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs ultraiso premium edition v9.7.6.3860.exe ultraiso premium edition v9.7.6.3860.tmp no specs ultraiso premium edition v9.7.6.3860.exe ultraiso premium edition v9.7.6.3860.tmp regsvr32.exe no specs isocmd.exe no specs conhost.exe no specs ultraiso premium edition patch.exe no specs ultraiso premium edition patch.exe regedit.exe no specs cracked.exe no specs cmd.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ultraiso.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1976 --field-trial-handle=1980,i,7930928319339995874,17055773533120224790,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
812"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3504 --field-trial-handle=2496,i,17054801482505450546,1350317766039383703,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012"C:\Program Files (x86)\UltraISO\drivers\isocmd.exe" -iC:\Program Files (x86)\UltraISO\drivers\IsoCmd.exe—UltraISO Premium Edition v9.7.6.3860.tmp
User:
admin
Company:
EZB Systems, Inc.
Integrity Level:
HIGH
Description:
ISO Command
Exit code:
0
Version:
3.21 built by: WinDDK
Modules
Images
c:\program files (x86)\ultraiso\drivers\isocmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1184"C:\Users\admin\Desktop\UltraISO Premium Edition Patch.exe" C:\Users\admin\Desktop\UltraISO Premium Edition Patch.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\ultraiso premium edition patch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1184"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5192 --field-trial-handle=2380,i,759955305879442849,13717734448421571009,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280"C:\Users\admin\Desktop\UltraISO Premium Edition v9.7.6.3860.exe" C:\Users\admin\Desktop\UltraISO Premium Edition v9.7.6.3860.exe
explorer.exe
User:
admin
Company:
EZB Systems, Inc.
Integrity Level:
MEDIUM
Description:
UltraISO Setup
Exit code:
0
Version:
9.7.6.3860
Modules
Images
c:\users\admin\desktop\ultraiso premium edition v9.7.6.3860.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1764C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\3C79.tmp\Cracked.bat" "C:\Program Files (x86)\UltraISO\Cracked.exe""C:\Windows\SysWOW64\cmd.exe—Cracked.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1812"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5284 --field-trial-handle=2380,i,759955305879442849,13717734448421571009,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2108\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2692"C:\Users\admin\Desktop\UltraISO Premium Edition v9.7.6.3860.exe" /SPAWNWND=$50256 /NOTIFYWND=$5025C C:\Users\admin\Desktop\UltraISO Premium Edition v9.7.6.3860.exe
UltraISO Premium Edition v9.7.6.3860.tmp
User:
admin
Company:
EZB Systems, Inc.
Integrity Level:
HIGH
Description:
UltraISO Setup
Exit code:
0
Version:
9.7.6.3860
Modules
Images
c:\users\admin\desktop\ultraiso premium edition v9.7.6.3860.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
10 928
Read events
10 838
Write events
77
Delete events
13

Modification events

(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\UltraISO Premium Edition .zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
126
Suspicious files
237
Text files
59
Unknown types
0

Dropped files

PID
Process
Filename
Type
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\unins000.exeexecutable
MD5:F92F7190CAB7F80CBD7F5E419C27E37D
SHA256:82190E1BFE62F4549F3CA2DD76261CC6213968D4F599349D3B07274499223ECE
1280UltraISO Premium Edition v9.7.6.3860.exeC:\Users\admin\AppData\Local\Temp\is-D656V.tmp\UltraISO Premium Edition v9.7.6.3860.tmpexecutable
MD5:3DE2992C86C78E781881E9C0DB26A32F
SHA256:E9700438D88E5A5F54D6940A4129477E943DCD4B95B006D0B38EF1E2A566A642
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\is-N8LNG.tmpexecutable
MD5:BDCC1A4B4D745DB4397B6AE3EB9C954B
SHA256:19D13F1930210741BA580C0D031121435C225953B5203823FBE18C1E8D58B94B
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\is-2BIFM.tmpexecutable
MD5:C0FC6C67BD9D9FBC4F8AD44232D49D11
SHA256:50DF2E7BA2AB1892DD1E8C03BE51A1DFA9C1ECC501D5166CD5E69BADB4A8C503
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Users\admin\AppData\Local\Temp\is-RQIQP.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\is-N6RID.tmpexecutable
MD5:F92F7190CAB7F80CBD7F5E419C27E37D
SHA256:82190E1BFE62F4549F3CA2DD76261CC6213968D4F599349D3B07274499223ECE
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\is-38H2N.tmpexecutable
MD5:3FBE454216E4F8E3408965BB05EF117C
SHA256:A725DECE170D6AF9CC7EAA42FF5CFEDC10E8AD70B76EE50BC50413B412BB3DB7
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\UltraISO.exeexecutable
MD5:3FBE454216E4F8E3408965BB05EF117C
SHA256:A725DECE170D6AF9CC7EAA42FF5CFEDC10E8AD70B76EE50BC50413B412BB3DB7
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\isoshell.dllexecutable
MD5:BDCC1A4B4D745DB4397B6AE3EB9C954B
SHA256:19D13F1930210741BA580C0D031121435C225953B5203823FBE18C1E8D58B94B
4988UltraISO Premium Edition v9.7.6.3860.tmpC:\Program Files (x86)\UltraISO\drivers\ISODrive.sysexecutable
MD5:278075F074EF5EAF8D57DF223BC8CD82
SHA256:A4AF61F2CE903911F964A000F663F92CF27B82387AEB4FD924068E26615AD6B3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
38
DNS requests
38
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.31:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6032
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6032
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.31:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.31
  • 23.216.77.22
  • 23.216.77.25
  • 23.216.77.21
  • 23.216.77.33
  • 23.216.77.30
  • 23.216.77.28
  • 23.216.77.27
  • 23.216.77.37
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.133
  • 40.126.32.134
  • 20.190.160.3
  • 40.126.32.72
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
UltraISO Premium Edition .zip