File name:

setup_dLHl6p2Gx9.zip

Full analysis: https://app.any.run/tasks/522c851f-2444-42ef-bf4f-198e4b5b4ed1
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: May 27, 2025, 18:45:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
downloadassistant
adware
inno
installer
delphi
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

6AA56504CDDA1BE709BE4DD8B0DB4B2D

SHA1:

6BAD3BF974C4A15484F08E89381791DF3A397432

SHA256:

B4C34E4C2C6EC35AA17DE6DBDF0C7627CB84B76D644E21473EAB045EE9AFD01C

SSDEEP:

98304:0YgBG+Ekvg11nuPlLCTYQpSgWIS+/P9cSY8VaIexmdLMW1trJW/19vofQuXTQ7tV:OLsmlgXI1YqMA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DOWNLOADASSISTANT mutex has been found

      • iphonedatarecovery2104.exe (PID: 2660)
      • setup_dLHl6p2Gx9.tmp (PID: 6148)

    • ADWARE has been detected (SURICATA)

      • iphonedatarecovery2104.exe (PID: 2660)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5116)
      • setup_dLHl6p2Gx9.tmp (PID: 7148)

    • Executable content was dropped or overwritten

      • setup_dLHl6p2Gx9.exe (PID: 6028)
      • setup_dLHl6p2Gx9.exe (PID: 4020)
      • setup_dLHl6p2Gx9.tmp (PID: 6148)

    • Executes application which crashes

      • iphonedatarecovery2104.exe (PID: 2660)

    • Reads the Windows owner or organization settings

      • setup_dLHl6p2Gx9.tmp (PID: 6148)

    • Process drops legitimate windows executable

      • setup_dLHl6p2Gx9.tmp (PID: 6148)

    • The process drops C-runtime libraries

      • setup_dLHl6p2Gx9.tmp (PID: 6148)

    • Access to an unwanted program domain was detected

      • iphonedatarecovery2104.exe (PID: 2660)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5116)

    • Create files in a temporary directory

      • setup_dLHl6p2Gx9.exe (PID: 6028)
      • setup_dLHl6p2Gx9.exe (PID: 4020)
      • setup_dLHl6p2Gx9.tmp (PID: 6148)

    • Checks supported languages

      • setup_dLHl6p2Gx9.exe (PID: 6028)
      • setup_dLHl6p2Gx9.tmp (PID: 7148)
      • setup_dLHl6p2Gx9.exe (PID: 4020)
      • setup_dLHl6p2Gx9.tmp (PID: 6148)
      • iphonedatarecovery2104.exe (PID: 2660)

    • Reads the computer name

      • setup_dLHl6p2Gx9.tmp (PID: 7148)
      • iphonedatarecovery2104.exe (PID: 2660)
      • setup_dLHl6p2Gx9.tmp (PID: 6148)

    • Process checks computer location settings

      • setup_dLHl6p2Gx9.tmp (PID: 7148)

    • Creates files or folders in the user directory

      • setup_dLHl6p2Gx9.tmp (PID: 6148)
      • WerFault.exe (PID: 2616)
      • WerFault.exe (PID: 6300)
      • WerFault.exe (PID: 2240)
      • WerFault.exe (PID: 6872)
      • WerFault.exe (PID: 1568)
      • WerFault.exe (PID: 5504)
      • WerFault.exe (PID: 4408)
      • WerFault.exe (PID: 5800)
      • WerFault.exe (PID: 5504)
      • WerFault.exe (PID: 2240)
      • WerFault.exe (PID: 6944)

    • The sample compiled with english language support

      • setup_dLHl6p2Gx9.tmp (PID: 6148)

    • Creates a software uninstall entry

      • setup_dLHl6p2Gx9.tmp (PID: 6148)

    • Compiled with Borland Delphi (YARA)

      • setup_dLHl6p2Gx9.exe (PID: 4020)
      • setup_dLHl6p2Gx9.exe (PID: 6028)
      • setup_dLHl6p2Gx9.tmp (PID: 7148)
      • setup_dLHl6p2Gx9.tmp (PID: 6148)
      • iphonedatarecovery2104.exe (PID: 2660)

    • Detects InnoSetup installer (YARA)

      • setup_dLHl6p2Gx9.exe (PID: 6028)
      • setup_dLHl6p2Gx9.tmp (PID: 7148)
      • setup_dLHl6p2Gx9.exe (PID: 4020)
      • setup_dLHl6p2Gx9.tmp (PID: 6148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x000b
ZipCompression: Deflated
ZipModifyDate: 2025:05:27 21:44:42
ZipCRC: 0xf896a266
ZipCompressedSize: 7918873
ZipUncompressedSize: 7941827
ZipFileName: setup_dLHl6p2Gx9.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
18
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe setup_dlhl6p2gx9.exe setup_dlhl6p2gx9.tmp no specs setup_dlhl6p2gx9.exe #DOWNLOADASSISTANT setup_dlhl6p2gx9.tmp #DOWNLOADASSISTANT iphonedatarecovery2104.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1568C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2660 -s 1404C:\Windows\SysWOW64\WerFault.exe—iphonedatarecovery2104.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1804C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2240C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2660 -s 1136C:\Windows\SysWOW64\WerFault.exe—iphonedatarecovery2104.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2240C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2660 -s 1388C:\Windows\SysWOW64\WerFault.exe—iphonedatarecovery2104.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2616C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2660 -s 900C:\Windows\SysWOW64\WerFault.exe—iphonedatarecovery2104.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2660"C:\Users\admin\AppData\Local\IPhone Data Recovery 5.7.2.104\iphonedatarecovery2104.exe" ccbbf61b095dc4743a65515fce94271fC:\Users\admin\AppData\Local\IPhone Data Recovery 5.7.2.104\iphonedatarecovery2104.exe
setup_dLHl6p2Gx9.tmp
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\iphone data recovery 5.7.2.104\iphonedatarecovery2104.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
4020"C:\Users\admin\AppData\Local\Temp\Rar$EXb5116.33065\setup_dLHl6p2Gx9.exe" /SPAWNWND=$50294 /NOTIFYWND=$30264 C:\Users\admin\AppData\Local\Temp\Rar$EXb5116.33065\setup_dLHl6p2Gx9.exe
setup_dLHl6p2Gx9.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
IPhone Data Recovery Setup
Version:
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb5116.33065\setup_dlhl6p2gx9.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4408C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2660 -s 988C:\Windows\SysWOW64\WerFault.exe—iphonedatarecovery2104.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5116"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\setup_dLHl6p2Gx9.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5504C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2660 -s 1108C:\Windows\SysWOW64\WerFault.exe—iphonedatarecovery2104.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
21 281
Read events
21 195
Write events
53
Delete events
33

Modification events

(PID) Process:(5116) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5116) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5116) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5116) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\setup_dLHl6p2Gx9.zip
(PID) Process:(5116) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5116) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5116) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5116) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5116) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6148) setup_dLHl6p2Gx9.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IPhone Data Recovery_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.3.5 (a)
Executable files
31
Suspicious files
0
Text files
23
Unknown types
23

Dropped files

PID
Process
Filename
Type
5116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb5116.33065\setup_dLHl6p2Gx9.exeexecutable
MD5:8E01F12D18D95B4CE09C57D448426CEF
SHA256:FC442197ED3339106B161A0BD236402E9FAC93FEB96B98191FB06FEFB177DD19
5116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb5116.33065\PASSWORD 123.txttext
MD5:74BE16979710D4C4E7C6647856088456
SHA256:F215FAF9D88B7F0A881632EE22459EE452A296C808D261B6CC993D3A1FD0600E
6148setup_dLHl6p2Gx9.tmpC:\Users\admin\AppData\Local\Temp\is-FO76P.tmp\_isetup\_iscrypt.dllexecutable
MD5:A69559718AB506675E907FE49DEB71E9
SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
6148setup_dLHl6p2Gx9.tmpC:\Users\admin\AppData\Local\IPhone Data Recovery 5.7.2.104\uninstall\is-RQCUH.tmpexecutable
MD5:7EF0BC17A44D958E23B17FD601384603
SHA256:03BB8F2A5A93AB3A027B22B52EA5DF29F6374149903DF5B3740DB1FECCEB5633
6148setup_dLHl6p2Gx9.tmpC:\Users\admin\AppData\Local\Temp\is-FO76P.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
6148setup_dLHl6p2Gx9.tmpC:\Users\admin\AppData\Local\Temp\is-FO76P.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
6148setup_dLHl6p2Gx9.tmpC:\Users\admin\AppData\Local\Temp\is-FO76P.tmp\_isetup\_RegDLL.tmpexecutable
MD5:0EE914C6F0BB93996C75941E1AD629C6
SHA256:4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
6148setup_dLHl6p2Gx9.tmpC:\Users\admin\AppData\Local\IPhone Data Recovery 5.7.2.104\libEGL.dllexecutable
MD5:EAE56B896A718C3BC87A4253832A5650
SHA256:EE1D7D8F396D627FEE7DCF2655FB5ACFE5A1EE2A5DEEDA764EF311E75B94CEA1
6148setup_dLHl6p2Gx9.tmpC:\Users\admin\AppData\Local\IPhone Data Recovery 5.7.2.104\uninstall\unins000.exeexecutable
MD5:7EF0BC17A44D958E23B17FD601384603
SHA256:03BB8F2A5A93AB3A027B22B52EA5DF29F6374149903DF5B3740DB1FECCEB5633
6148setup_dLHl6p2Gx9.tmpC:\Users\admin\AppData\Local\IPhone Data Recovery 5.7.2.104\is-VSVJB.tmpexecutable
MD5:DAE4100039A943128C34BA3E05F6CD02
SHA256:2357806CA24C9D3152D54D34270810DA9D9CA943462EBF7291AE06A10E5CB8BA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
22
DNS requests
15
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2660
iphonedatarecovery2104.exe
POST
—
172.67.152.231:80
http://somenoxezowa.ru/new/net_api
unknown
—
—
unknown
2660
iphonedatarecovery2104.exe
POST
—
172.67.152.231:80
http://somenoxezowa.ru/new/net_api
unknown
—
—
unknown
4404
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4404
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5048
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5796
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2660
iphonedatarecovery2104.exe
172.67.152.231:80
somenoxezowa.ru
CLOUDFLARENET
US
unknown
6544
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
somenoxezowa.ru
  • 172.67.152.231
  • 104.21.2.206
unknown
login.live.com
  • 20.190.159.2
  • 40.126.31.0
  • 40.126.31.128
  • 40.126.31.129
  • 40.126.31.1
  • 40.126.31.2
  • 40.126.31.130
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2660
iphonedatarecovery2104.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] DownloadAssistant HTTP POST Request
2660
iphonedatarecovery2104.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] DownloadAssistant HTTP POST Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup_dLHl6p2Gx9.zip