URL:

http://download.iskysoft.com/cbs_down/uniconverter-win_full6515.exe

Full analysis: https://app.any.run/tasks/28b267fd-371a-43fc-9b81-89cabe5148fa
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 02, 2021, 15:42:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

B0D7B41E55E915245C968F7BF6E742C5

SHA1:

4FB31A2AB73A3EBADD91C51B945D1EE23C54EC5E

SHA256:

A85857009EA47E7B7C26BB98BF3BA4373BB96BEAD72B9628EC1E923A2D4427DF

SSDEEP:

3:N1KaKElKKNtQjKqQfMODse4An:Ca5KQQ2qQfVs1A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • uniconverter-win_full6515.exe (PID: 2496)
      • uniconverter-win_full6515.exe (PID: 3152)
      • Wondershare Helper Compact.exe (PID: 3744)
      • Wondershare Helper Compact.tmp (PID: 3088)
      • DVDTemplateInstall.exe (PID: 2184)
      • DVDTemplateInstall.tmp (PID: 988)

    • Changes the autorun value in the registry

      • uniconverter-win_full6515.tmp (PID: 2660)
      • Wondershare Helper Compact.tmp (PID: 3088)

    • Application was dropped or rewritten from another process

      • WSHelper.exe (PID: 1252)
      • CheckNvidiaProfile.exe (PID: 3672)
      • CheckGraphicsType.exe (PID: 680)
      • cmdCheckMFForVCE.exe (PID: 2252)
      • WSVCUUpdateHelper.exe (PID: 2016)
      • WSHelper.exe (PID: 2136)
      • sniffer.exe (PID: 3784)
      • TransferProcess.exe (PID: 2788)
      • VideoConverterUltimate.exe (PID: 3276)
      • Wondershare Helper Compact.exe (PID: 3744)
      • URLReqService.exe (PID: 1664)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 3280)
      • regsvr32.exe (PID: 2664)
      • regsvr32.exe (PID: 2768)
      • WSHelper.exe (PID: 1252)
      • RegAsm.exe (PID: 1000)
      • RegAsm.exe (PID: 2428)
      • CheckNvidiaProfile.exe (PID: 3672)
      • CheckGraphicsType.exe (PID: 680)
      • VideoConverterUltimate.exe (PID: 3276)
      • cmdCheckMFForVCE.exe (PID: 2252)
      • TransferProcess.exe (PID: 2788)
      • sniffer.exe (PID: 3784)
      • URLReqService.exe (PID: 1664)
      • WSVCUUpdateHelper.exe (PID: 2016)

    • Changes settings of System certificates

      • RegAsm.exe (PID: 1000)

    • Registers / Runs the DLL via REGSVR32.EXE

      • uniconverter-win_full6515.tmp (PID: 2660)

    • Changes internet zones settings

      • uniconverter-win_full6515.tmp (PID: 2660)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • uniconverter-win_full6515.exe (PID: 2496)
      • uniconverter-win_full6515.exe (PID: 3152)
      • Wondershare Helper Compact.exe (PID: 3744)
      • uniconverter-win_full6515.tmp (PID: 2660)
      • Wondershare Helper Compact.tmp (PID: 3088)
      • DVDTemplateInstall.exe (PID: 2184)
      • WSVCUUpdateHelper.exe (PID: 2016)
      • DVDTemplateInstall.tmp (PID: 988)

    • Reads the Windows organization settings

      • uniconverter-win_full6515.tmp (PID: 2660)
      • DVDTemplateInstall.tmp (PID: 988)

    • Reads Windows owner or organization settings

      • uniconverter-win_full6515.tmp (PID: 2660)
      • DVDTemplateInstall.tmp (PID: 988)

    • Drops a file with too old compile date

      • uniconverter-win_full6515.tmp (PID: 2660)
      • Wondershare Helper Compact.exe (PID: 3744)
      • Wondershare Helper Compact.tmp (PID: 3088)
      • DVDTemplateInstall.tmp (PID: 988)

    • Uses TASKKILL.EXE to kill process

      • uniconverter-win_full6515.tmp (PID: 2660)

    • Creates files in the Windows directory

      • uniconverter-win_full6515.tmp (PID: 2660)
      • CertUtil.exe (PID: 1248)
      • InstallUtil.exe (PID: 2900)

    • Creates files in the user directory

      • uniconverter-win_full6515.tmp (PID: 2660)

    • Drops a file that was compiled in debug mode

      • uniconverter-win_full6515.tmp (PID: 2660)
      • Wondershare Helper Compact.tmp (PID: 3088)
      • DVDTemplateInstall.tmp (PID: 988)

    • Creates a directory in Program Files

      • uniconverter-win_full6515.tmp (PID: 2660)
      • Wondershare Helper Compact.tmp (PID: 3088)
      • WSHelper.exe (PID: 1252)
      • VideoConverterUltimate.exe (PID: 3276)
      • TransferProcess.exe (PID: 2788)
      • WSHelper.exe (PID: 2136)
      • DVDTemplateInstall.tmp (PID: 988)

    • Creates or modifies windows services

      • uniconverter-win_full6515.tmp (PID: 2660)

    • Adds / modifies Windows certificates

      • RegAsm.exe (PID: 1000)

    • Creates/Modifies COM task schedule object

      • RegAsm.exe (PID: 1000)
      • RegAsm.exe (PID: 2428)
      • RegAsm.exe (PID: 2820)

    • Creates files in the program directory

      • RegAsm.exe (PID: 1000)
      • RegAsm.exe (PID: 2820)
      • RegAsm.exe (PID: 2428)
      • InstallUtil.exe (PID: 2900)
      • CheckNvidiaProfile.exe (PID: 3672)
      • CheckGraphicsType.exe (PID: 680)
      • cmdCheckMFForVCE.exe (PID: 2252)
      • WSHelper.exe (PID: 2136)
      • TransferProcess.exe (PID: 2788)
      • VideoConverterUltimate.exe (PID: 3276)
      • WSVCUUpdateHelper.exe (PID: 2016)

    • Removes files from Windows directory

      • CertUtil.exe (PID: 1248)

    • Starts Internet Explorer

      • uniconverter-win_full6515.tmp (PID: 2660)

    • Loads Python modules

      • VideoConverterUltimate.exe (PID: 3276)
      • sniffer.exe (PID: 3784)

    • Reads Environment values

      • VideoConverterUltimate.exe (PID: 3276)
      • WSVCUUpdateHelper.exe (PID: 2016)

    • Executed via COM

      • WSHelper.exe (PID: 2136)

    • Searches for installed software

      • WSVCUUpdateHelper.exe (PID: 2016)

    • Reads internet explorer settings

      • VideoConverterUltimate.exe (PID: 3276)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 656)
      • iexplore.exe (PID: 1232)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 656)
      • iexplore.exe (PID: 2084)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 656)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 656)
      • RegAsm.exe (PID: 1000)
      • iexplore.exe (PID: 2084)
      • VideoConverterUltimate.exe (PID: 3276)

    • Creates files in the user directory

      • iexplore.exe (PID: 656)
      • iexplore.exe (PID: 2084)

    • Application launched itself

      • iexplore.exe (PID: 656)
      • iexplore.exe (PID: 1232)

    • Application was dropped or rewritten from another process

      • uniconverter-win_full6515.tmp (PID: 3268)
      • uniconverter-win_full6515.tmp (PID: 2660)
      • Wondershare Helper Compact.tmp (PID: 3088)
      • DVDTemplateInstall.tmp (PID: 988)

    • Loads dropped or rewritten executable

      • uniconverter-win_full6515.tmp (PID: 2660)
      • Wondershare Helper Compact.tmp (PID: 3088)
      • DVDTemplateInstall.tmp (PID: 988)

    • Changes settings of System certificates

      • iexplore.exe (PID: 656)
      • iexplore.exe (PID: 2084)

    • Creates files in the program directory

      • Wondershare Helper Compact.tmp (PID: 3088)
      • uniconverter-win_full6515.tmp (PID: 2660)
      • DVDTemplateInstall.tmp (PID: 988)

    • Dropped object may contain TOR URL's

      • uniconverter-win_full6515.tmp (PID: 2660)
      • VideoConverterUltimate.exe (PID: 3276)

    • Creates a software uninstall entry

      • uniconverter-win_full6515.tmp (PID: 2660)
      • Wondershare Helper Compact.tmp (PID: 3088)

    • Dropped object may contain Bitcoin addresses

      • uniconverter-win_full6515.tmp (PID: 2660)
      • VideoConverterUltimate.exe (PID: 3276)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
102
Monitored processes
44
Malicious processes
16
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe uniconverter-win_full6515.exe uniconverter-win_full6515.tmp no specs uniconverter-win_full6515.exe uniconverter-win_full6515.tmp taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs wondershare helper compact.exe wondershare helper compact.tmp wshelper.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe no specs installutil.exe no specs certutil.exe no specs urlreqservice.exe no specs checknvidiaprofile.exe no specs checkgraphicstype.exe no specs cmdcheckmfforvce.exe no specs iexplore.exe videoconverterultimate.exe iexplore.exe wshelper.exe transferprocess.exe sniffer.exe wsvcuupdatehelper.exe dvdtemplateinstall.exe dvdtemplateinstall.tmp

Process information

PID
CMD
Path
Indicators
Parent process
656"C:\Program Files\Internet Explorer\iexplore.exe" http://download.iskysoft.com/cbs_down/uniconverter-win_full6515.exeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
680"C:\Program Files\Wondershare\UniConverter\CheckGraphicsType.exe"C:\Program Files\Wondershare\UniConverter\CheckGraphicsType.exe—uniconverter-win_full6515.tmp
User:
admin
Company:
Wondershare Software
Integrity Level:
HIGH
Description:
Wondershare Check Graphic Type
Exit code:
0
Version:
1.0.0.2
Modules
Images
c:\program files\wondershare\uniconverter\checkgraphicstype.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
988"C:\Users\admin\AppData\Local\Temp\is-G3UN8.tmp\DVDTemplateInstall.tmp" /SL5="$20274,35805582,119296,C:\ProgramData\Wondershare\UniConverter\DVDTemplateInstall.exe" /SP- /VERYSILENT /norestart installpath "C:\ProgramData\Wondershare\UniConverter\MenuRes"C:\Users\admin\AppData\Local\Temp\is-G3UN8.tmp\DVDTemplateInstall.tmp
DVDTemplateInstall.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-g3un8.tmp\dvdtemplateinstall.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1000"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Program Files\Wondershare\UniConverter\WsBurner.exe" /codebase /tlbC:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe—uniconverter-win_full6515.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1232"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\WS_ATLMovie.dllC:\Windows\system32\regsvr32.exe—uniconverter-win_full6515.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1232"C:\Program Files\Internet Explorer\iexplore.exe" http://cbs.wondershare.com/go.php?pid=6485&m=iC:\Program Files\Internet Explorer\iexplore.exe
uniconverter-win_full6515.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\msctf.dll
c:\windows\system32\regsvr32.exe
c:\windows\system32\wininet.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\devobj.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\profapi.dll
1248"CertUtil.exe" -addstore TrustedPublisher "C:\Program Files\Wondershare\UniConverter\WsInfoTech.cer"C:\Windows\system32\CertUtil.exe—uniconverter-win_full6515.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
2147942402
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\certutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\certcli.dll
c:\windows\system32\atl.dll
1252"C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" /regserverC:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe—Wondershare Helper Compact.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
Wondershare Studio
Exit code:
0
Version:
2.5.3.1
Modules
Images
c:\program files\common files\wondershare\wondershare helper compact\wshelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1264"C:\Windows\system32\TASKKILL.exe" /F /IM ScreenCapture.exeC:\Windows\system32\TASKKILL.exe—uniconverter-win_full6515.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1664"C:\Program Files\Wondershare\UniConverter\DownloadRes\URLReqService.exe" /regserverC:\Program Files\Wondershare\UniConverter\DownloadRes\URLReqService.exe—uniconverter-win_full6515.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
URLReqService
Exit code:
0
Version:
2, 6, 3, 3
Modules
Images
c:\program files\wondershare\uniconverter\downloadres\urlreqservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
c:\program files\wondershare\uniconverter\downloadres\easyhook32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
3 133
Read events
1 969
Write events
1 140
Delete events
24

Modification events

(PID) Process:(656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
262211594
(PID) Process:(656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30865786
(PID) Process:(656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
496
Suspicious files
48
Text files
2 262
Unknown types
875

Dropped files

PID
Process
Filename
Type
656iexplore.exeC:\Users\admin\AppData\Local\Temp\Cab5177.tmp —
MD5:—
SHA256:—
656iexplore.exeC:\Users\admin\AppData\Local\Temp\Tar5178.tmp —
MD5:—
SHA256:—
656iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver5189.tmp —
MD5:—
SHA256:—
4028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\uniconverter-win_full6515[1].exe —
MD5:—
SHA256:—
656iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\KKVOH2KJ.txt —
MD5:—
SHA256:—
656iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\2VRQ80YO.txt —
MD5:—
SHA256:—
656iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\JWKHSJKY.txt —
MD5:—
SHA256:—
656iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\99IUT4Y6.txt —
MD5:—
SHA256:—
4028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\uniconverter-win_full6515.exe.7z7ogw2.partial —
MD5:—
SHA256:—
656iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFD58A62E4E1CA364D.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
68
DNS requests
26
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2084
iexplore.exe
GET
302
47.91.89.20:80
http://cbs.wondershare.com/go.php?pid=6485&m=i
US
—
—
whitelisted
3276
VideoConverterUltimate.exe
GET
302
47.91.89.20:80
http://cbs.wondershare.com/go.php?pid=6485&m=ck&num=24
US
—
—
whitelisted
2136
WSHelper.exe
GET
404
47.91.67.36:80
http://platform.wondershare.com/interface.php?m=downloader&client_sign={400642AD-B802-40BB-8E7C-304480BA5DF3}&product_ids=1025,6485
US
—
—
suspicious
656
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
656
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
656
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
656
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
4028
iexplore.exe
GET
206
47.246.43.167:80
http://download.iskysoft.com/cbs_down/uniconverter-win_full6515.exe
US
binary
57.6 Mb
whitelisted
2084
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
2084
iexplore.exe
GET
200
142.250.186.163:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCSph7JeRt7BgMAAAAAx82r
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4028
iexplore.exe
47.246.43.167:80
download.iskysoft.com
—
US
suspicious
656
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
656
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
656
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
Microsoft Corporation
US
whitelisted
2084
iexplore.exe
47.91.89.20:80
cbs.wondershare.com
Alibaba (China) Technology Co., Ltd.
US
malicious
2084
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2084
iexplore.exe
104.108.40.45:443
videoconverter.iskysoft.com
Akamai Technologies, Inc.
NL
unknown
2084
iexplore.exe
142.250.185.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2084
iexplore.exe
142.250.186.163:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2084
iexplore.exe
74.125.133.157:443
stats.g.doubleclick.net
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
download.iskysoft.com
  • 47.246.43.167
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
cbs.wondershare.com
  • 47.91.89.20
  • 47.91.76.37
  • 47.91.89.199
  • 47.91.91.66
whitelisted
videoconverter.iskysoft.com
  • 104.108.40.45
suspicious
neveragain.allstatics.com
  • 104.108.40.45
whitelisted
www.wondershare.com
  • 104.108.40.45
whitelisted
fonts.googleapis.com
  • 142.250.185.170
whitelisted

Threats

PID
Process
Class
Message
4028
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1040
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
3276
VideoConverterUltimate.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
3276
VideoConverterUltimate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2016
WSVCUUpdateHelper.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
VideoConverterUltimate.exe
OS Version: Win7 OS32Bits
VideoConverterUltimate.exe
=======================================
VideoConverterUltimate.exe
Program.Start Product=UniConverter, Version=11.7.7.1
VideoConverterUltimate.exe
Program.InitLog...
VideoConverterUltimate.exe
DownloadHelper 1 OSUtils.OSVersion:Win7
VideoConverterUltimate.exe
SkinEngine.ActiveSkin = Default
VideoConverterUltimate.exe
ProductClient.Init, product lang: ENG id: 6485
WSHelper.exe
HTTP/1.1 200 OK
WSHelper.exe
HTTP/1.1 200 OK
WSHelper.exe
HTTP/1.1 404 Not Found
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://download.iskysoft.com/cbs_down/uniconverter-win_full6515.exe