File name:

setup_installer.bin.zip

Full analysis: https://app.any.run/tasks/32cf7d22-5898-48cd-a84a-d96888563719
Verdict: Malicious activity
Analysis date: January 06, 2024, 05:42:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

BA318B6B520B6A7773A08E116A10AB32

SHA1:

8FFB8478FF3A0E00FF26F5E9374641BA428A16C1

SHA256:

AB0ABCB3F9390A3783CBDCD89833634B29F527368B40987BC796A3854E21B12A

SSDEEP:

98304:tHr+XwvQzGa1TTHNLzG5CTLREHtCS3qwgw7QSBXRnpjs6hl2e34O5k6mB4bQPkIZ:sFB8dhdU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • PowerISO8.exe (PID: 3992)
      • PowerISO.exe (PID: 332)

    • Creates a writable file in the system directory

      • PowerISO8.exe (PID: 3992)

    • Runs injected code in another process

      • rundll32.exe (PID: 3984)

  • SUSPICIOUS

    • Reads the Internet Settings

      • setup_installer.exe (PID: 1624)
      • PowerISO8.exe (PID: 3992)
      • PowerISO.exe (PID: 332)
      • zulka3.exe (PID: 1344)
      • zulka5.exe (PID: 268)
      • zulka1.exe (PID: 3616)
      • zulka5.exe (PID: 2472)

    • The process creates files with name similar to system file names

      • PowerISO8.exe (PID: 3992)

    • Reads settings of System Certificates

      • PowerISO8.exe (PID: 3992)
      • PowerISO.exe (PID: 332)
      • zulka1.exe (PID: 3616)
      • zulka5.exe (PID: 268)

    • Creates files in the driver directory

      • PowerISO8.exe (PID: 3992)

    • Drops a system driver (possible attempt to evade defenses)

      • PowerISO8.exe (PID: 3992)

    • Reads security settings of Internet Explorer

      • PowerISO.exe (PID: 332)
      • zulka1.exe (PID: 3616)

    • Checks Windows Trust Settings

      • PowerISO.exe (PID: 332)
      • zulka1.exe (PID: 3616)

    • Uses RUNDLL32.EXE to load library

      • zulka3.exe (PID: 1344)

    • Adds/modifies Windows certificates

      • PowerISO.exe (PID: 332)

  • INFO

    • Drops 7-zip archiver for unpacking

      • WinRAR.exe (PID: 116)
      • PowerISO8.exe (PID: 3992)

    • Checks supported languages

      • setup_installer.exe (PID: 1624)
      • setup_install.exe (PID: 1824)
      • PowerISO8.exe (PID: 3992)
      • PWRISOVM.EXE (PID: 3096)
      • PowerISO.exe (PID: 332)
      • zulka3.exe (PID: 1344)
      • setup_install.exe (PID: 3440)
      • zulka1.exe (PID: 3616)
      • zulka5.exe (PID: 268)
      • zulka5.exe (PID: 2472)

    • Manual execution by a user

      • setup_installer.exe (PID: 1624)
      • rundll32.exe (PID: 2408)
      • setup_installer.exe (PID: 1504)
      • msedge.exe (PID: 2244)
      • rundll32.exe (PID: 4048)
      • PowerISO.exe (PID: 332)
      • zulka1.exe (PID: 3616)
      • setup_install.exe (PID: 2592)
      • setup_install.exe (PID: 3440)
      • zulka3.exe (PID: 1344)
      • zulka5.exe (PID: 268)
      • zulka5.exe (PID: 2472)

    • Drops the executable file immediately after the start

      • setup_installer.exe (PID: 1624)
      • WinRAR.exe (PID: 116)
      • PowerISO8.exe (PID: 3992)
      • msedge.exe (PID: 664)
      • msedge.exe (PID: 2244)
      • zulka3.exe (PID: 1344)
      • PowerISO.exe (PID: 332)

    • Create files in a temporary directory

      • setup_installer.exe (PID: 1624)
      • PowerISO8.exe (PID: 3992)
      • PowerISO.exe (PID: 332)
      • zulka3.exe (PID: 1344)
      • zulka5.exe (PID: 268)

    • Reads the computer name

      • setup_installer.exe (PID: 1624)
      • setup_install.exe (PID: 1824)
      • PowerISO8.exe (PID: 3992)
      • PowerISO.exe (PID: 332)
      • zulka3.exe (PID: 1344)
      • setup_install.exe (PID: 3440)
      • zulka1.exe (PID: 3616)
      • zulka5.exe (PID: 268)
      • zulka5.exe (PID: 2472)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • PowerISO8.exe (PID: 3992)

    • Reads Environment values

      • PowerISO8.exe (PID: 3992)
      • zulka5.exe (PID: 268)
      • zulka5.exe (PID: 2472)

    • Reads the machine GUID from the registry

      • PowerISO8.exe (PID: 3992)
      • PowerISO.exe (PID: 332)
      • zulka1.exe (PID: 3616)
      • zulka5.exe (PID: 268)
      • zulka5.exe (PID: 2472)

    • The process uses the downloaded file

      • msedge.exe (PID: 1536)
      • msedge.exe (PID: 2244)

    • Application launched itself

      • msedge.exe (PID: 2244)
      • msedge.exe (PID: 2936)

    • Creates files or folders in the user directory

      • PowerISO.exe (PID: 332)
      • zulka1.exe (PID: 3616)

    • Checks proxy server information

      • PowerISO.exe (PID: 332)
      • zulka1.exe (PID: 3616)

    • Creates files in the program directory

      • PowerISO8.exe (PID: 3992)

    • Application was injected by another process

      • svchost.exe (PID: 856)

    • Checks for external IP

      • zulka5.exe (PID: 268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2024:01:06 05:41:48
ZipCRC: 0x0eb8a7db
ZipCompressedSize: 2991710
ZipUncompressedSize: 3049583
ZipFileName: setup_installer.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
119
Monitored processes
53
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start inject winrar.exe no specs rundll32.exe no specs setup_installer.exe no specs setup_installer.exe setup_install.exe msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs poweriso8.exe no specs poweriso8.exe regsvr32.exe no specs pwrisovm.exe no specs regsvr32.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs rundll32.exe no specs poweriso.exe regsvr32.exe no specs zulka3.exe no specs rundll32.exe svchost.exe setup_install.exe no specs setup_install.exe zulka1.exe zulka5.exe zulka5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\setup_installer.bin.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
188"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6d8ff598,0x6d8ff5a8,0x6d8ff5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
268"C:\Users\admin\Desktop\New folder\zulka5.exe" C:\Users\admin\Desktop\New folder\zulka5.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
ORAPOL
Exit code:
0
Version:
1.0.0.2
Modules
Images
c:\users\admin\desktop\new folder\zulka5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
332"C:\Program Files\PowerISO\PowerISO.exe" C:\Program Files\PowerISO\PowerISO.exe
explorer.exe
User:
admin
Company:
Power Software Ltd
Integrity Level:
MEDIUM
Description:
PowerISO
Exit code:
0
Version:
8, 7, 0, 0
Modules
Images
c:\program files\poweriso\poweriso.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
604"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3660 --field-trial-handle=1320,i,9269028847400058733,438729194069623144,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
664"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1420 --field-trial-handle=1320,i,9269028847400058733,438729194069623144,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
856C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
896"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4636 --field-trial-handle=1320,i,9269028847400058733,438729194069623144,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1112"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4472 --field-trial-handle=1320,i,9269028847400058733,438729194069623144,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1316"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4680 --field-trial-handle=1320,i,9269028847400058733,438729194069623144,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
30 058
Read events
29 741
Write events
306
Delete events
11

Modification events

(PID) Process:(116) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
87
Suspicious files
1 197
Text files
81
Unknown types
1

Dropped files

PID
Process
Filename
Type
1624setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS856B0D7E\zulka3.exeexecutable
MD5:56C0B50220D5B5B56A16F630301F8E4E
SHA256:65811D415F7CBDBDC05DCA27B8A3F59E626AFBFECF4E2B83CEB2EE4D6221098E
2244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFee76e.TMP —
MD5:—
SHA256:—
2244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1624setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS856B0D7E\zulka5.exeexecutable
MD5:8CFBF299C649FEE6F1BF478C9CBAAE23
SHA256:5A11C15CD27911490B03B06754B10A82DB7564F895EB386C67934A94051DD5B8
1624setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS856B0D7E\zulka1.exeexecutable
MD5:4E4DDDAAB764DC4ED458E50B92CD8B3E
SHA256:326BEBB9E00419C94B901A4597B8D8B1B56AC6CA9CBB96FC8F40DF4D85D588CB
1624setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS856B0D7E\zulka2.exeexecutable
MD5:82ED3ABE9637BB1C5A42B504778D061D
SHA256:1F3A898548A952EF8B6ABA6E47EE5F8CD8446206BCB901AB77E3439F6E94E439
1624setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS856B0D7E\setup_install.exeexecutable
MD5:5B387F1CF6213197662682C6EE74C30B
SHA256:B77A90B0E6EB28E518F6CD02A4D65B870D99A88E58442A1E3F5ED971CC39A97E
2244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFee79c.TMP —
MD5:—
SHA256:—
2244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
1624setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS856B0D7E\libwinpthread-1.dllexecutable
MD5:1E0D62C34FF2E649EBC5C372065732EE
SHA256:509CB1D1443B623A02562AC760BCED540E327C65157FFA938A22F75E38155723
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
77
DNS requests
113
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
664
msedge.exe
GET
200
216.92.201.29:80
http://www.poweriso.com/favicon.ico
unknown
image
8.85 Kb
unknown
664
msedge.exe
GET
200
216.92.201.29:80
http://www.poweriso.com/thankyou.htm
unknown
html
4.17 Kb
unknown
664
msedge.exe
GET
200
216.92.201.29:80
http://www.poweriso.com/images/thank-you-bg1.gif
unknown
image
1.03 Kb
unknown
664
msedge.exe
GET
200
216.92.201.29:80
http://www.poweriso.com/images/thank-you-logo.gif
unknown
image
20.2 Kb
unknown
664
msedge.exe
GET
200
216.92.201.29:80
http://www.poweriso.com/images/check.gif
unknown
image
1.02 Kb
unknown
664
msedge.exe
GET
200
216.92.201.29:80
http://www.poweriso.com/images/thank-you-bg.gif
unknown
image
11.5 Kb
unknown
664
msedge.exe
GET
200
216.92.201.29:80
http://www.poweriso.com/images/blank.gif
unknown
image
46 b
unknown
1080
svchost.exe
GET
304
87.248.202.1:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?89bca2e7018c82c0
unknown
—
—
unknown
332
PowerISO.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEGfe9D7xe9riT%2FWUBgbSwIQ%3D
unknown
binary
1.42 Kb
unknown
332
PowerISO.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY
unknown
binary
2.18 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
664
msedge.exe
204.79.197.203:443
ntp.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2244
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
664
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
664
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
664
msedge.exe
23.36.163.97:443
assets.msn.com
Akamai International B.V.
DE
unknown
664
msedge.exe
2.21.20.136:443
img-s-msn-com.akamaized.net
Akamai International B.V.
DE
unknown
664
msedge.exe
18.245.60.76:443
sb.scorecardresearch.com
—
US
unknown

DNS requests

Domain
IP
Reputation
estrix.xyz
  • —
unknown
ntp.msn.com
  • 204.79.197.203
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
assets.msn.com
  • 23.36.163.97
  • 23.36.163.109
whitelisted
img-s-msn-com.akamaized.net
  • 2.21.20.136
  • 2.21.20.134
whitelisted
sb.scorecardresearch.com
  • 18.245.60.76
  • 18.245.60.72
  • 18.245.60.107
  • 18.245.60.53
shared
th.bing.com
  • 92.123.104.33
  • 92.123.104.31
  • 92.123.104.38
  • 92.123.104.34
  • 92.123.104.32
whitelisted
www.bing.com
  • 92.123.104.33
  • 92.123.104.34
  • 92.123.104.31
  • 92.123.104.32
  • 92.123.104.38
  • 104.126.37.42
  • 104.126.37.35
whitelisted
c.msn.com
  • 68.219.88.97
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potential Corporate Privacy Violation
AV POLICY Suspicious Connection to Faceit Domain (DNS Query)
1080
svchost.exe
Potential Corporate Privacy Violation
ET POLICY IP Check Domain (iplogger .org in DNS Lookup)
268
zulka5.exe
Potential Corporate Privacy Violation
ET POLICY IP Check Domain (iplogger .org in TLS SNI)
Process
Message
msedge.exe
[0106/054459.880:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup_installer.bin.zip