URL:

https://dl.ubnt.com/aircontrol2/aircontrol-v2.1-GA3-180228-1639-win32.exe

Full analysis: https://app.any.run/tasks/ec8d10fc-acbd-41e6-aca5-4abca5008599
Verdict: Malicious activity
Analysis date: February 23, 2024, 12:19:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

A4F17C33BC722480E26332A98F9201B4

SHA1:

1E377EA487D47255C922E983351AEECC24DF9087

SHA256:

D2FF40AB489CF1DD877CF5ED611372E2AAE40F04EFE4D43C528041264C8419A8

SSDEEP:

3:N8RmGkTOkWpXXXP/MLQkAn:2sWZcLQkA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)
      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 2736)

    • Gets information about running processes via WMI (SCRIPT)

      • cscript.exe (PID: 2032)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)
      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 2736)

    • Executable content was dropped or overwritten

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)
      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 2736)

    • The process drops C-runtime libraries

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)
      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 2736)

    • Uses ICACLS.EXE to modify access control lists

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)

    • Reads security settings of Internet Explorer

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)

    • Reads the Internet Settings

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)

    • Application launched itself

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)

    • The process executes VB scripts

      • cmd.exe (PID: 2380)
      • cmd.exe (PID: 3044)

    • Accesses WMI object caption (SCRIPT)

      • cscript.exe (PID: 3356)

    • Executes WMI query (SCRIPT)

      • cscript.exe (PID: 3356)

    • Accesses operating system name via WMI (SCRIPT)

      • cscript.exe (PID: 3356)

    • Accesses computer name via WMI (SCRIPT)

      • cscript.exe (PID: 3356)

    • Accesses Windows installation date via WMI (SCRIPT)

      • cscript.exe (PID: 3356)

    • Starts CMD.EXE for commands execution

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • cscript.exe (PID: 3356)

  • INFO

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3864)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3952)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3952)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3864)
      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)

    • Application launched itself

      • iexplore.exe (PID: 3864)

    • Checks supported languages

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)
      • unpack200.exe (PID: 2156)
      • unpack200.exe (PID: 1992)
      • unpack200.exe (PID: 1644)
      • unpack200.exe (PID: 1576)
      • unpack200.exe (PID: 1336)
      • unpack200.exe (PID: 2576)
      • unpack200.exe (PID: 2112)
      • unpack200.exe (PID: 3616)
      • unpack200.exe (PID: 2384)
      • unpack200.exe (PID: 2772)
      • unpack200.exe (PID: 1484)
      • unpack200.exe (PID: 1780)
      • unpack200.exe (PID: 2724)
      • unpack200.exe (PID: 2320)
      • unpack200.exe (PID: 1556)
      • unpack200.exe (PID: 992)
      • unpack200.exe (PID: 924)
      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 2736)
      • unpack200.exe (PID: 2396)
      • wmpnscfg.exe (PID: 2840)
      • javaw.exe (PID: 3480)

    • Create files in a temporary directory

      • unpack200.exe (PID: 2156)
      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)
      • unpack200.exe (PID: 1992)
      • unpack200.exe (PID: 1644)
      • unpack200.exe (PID: 1576)
      • unpack200.exe (PID: 2724)
      • unpack200.exe (PID: 1336)
      • unpack200.exe (PID: 2320)
      • unpack200.exe (PID: 1556)
      • unpack200.exe (PID: 2576)
      • unpack200.exe (PID: 3616)
      • unpack200.exe (PID: 2112)
      • unpack200.exe (PID: 2384)
      • unpack200.exe (PID: 2772)
      • unpack200.exe (PID: 1484)
      • unpack200.exe (PID: 1780)
      • unpack200.exe (PID: 924)
      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 2736)
      • unpack200.exe (PID: 992)
      • unpack200.exe (PID: 2396)
      • javaw.exe (PID: 3480)

    • Creates files in the program directory

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)
      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 2736)
      • javaw.exe (PID: 3480)

    • Reads the computer name

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)
      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 2736)
      • wmpnscfg.exe (PID: 2840)

    • Reads the machine GUID from the registry

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)
      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 2736)

    • Process checks whether UAC notifications are on

      • aircontrol-v2.1-GA3-180228-1639-win32.exe (PID: 1740)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 3356)
      • cscript.exe (PID: 2032)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
95
Monitored processes
30
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe aircontrol-v2.1-ga3-180228-1639-win32.exe unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs icacls.exe no specs icacls.exe no specs aircontrol-v2.1-ga3-180228-1639-win32.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs javaw.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
924-r "jre\lib\ext\nashorn.jar.pack" "jre\lib\ext\nashorn.jar"C:\Users\admin\AppData\Local\Temp\e4jFC09.tmp_dir1708690898\jre\bin\unpack200.exe—aircontrol-v2.1-GA3-180228-1639-win32.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1020.14
Modules
Images
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\msvcr100.dll
992-r "jre\lib\ext\localedata.jar.pack" "jre\lib\ext\localedata.jar"C:\Users\admin\AppData\Local\Temp\e4jFC09.tmp_dir1708690898\jre\bin\unpack200.exe—aircontrol-v2.1-GA3-180228-1639-win32.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1020.14
Modules
Images
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\msvcr100.dll
1020icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage\48c3645fd80157b1.timestamp /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—aircontrol-v2.1-GA3-180228-1639-win32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
1036icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—aircontrol-v2.1-GA3-180228-1639-win32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
1336-r "jre\lib\management-agent.jar.pack" "jre\lib\management-agent.jar"C:\Users\admin\AppData\Local\Temp\e4jFC09.tmp_dir1708690898\jre\bin\unpack200.exe—aircontrol-v2.1-GA3-180228-1639-win32.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1020.14
Modules
Images
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\msvcr100.dll
1484-r "jre\lib\ext\jaccess.jar.pack" "jre\lib\ext\jaccess.jar"C:\Users\admin\AppData\Local\Temp\e4jFC09.tmp_dir1708690898\jre\bin\unpack200.exe—aircontrol-v2.1-GA3-180228-1639-win32.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1020.14
Modules
Images
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\msvcr100.dll
1556-r "jre\lib\resources.jar.pack" "jre\lib\resources.jar"C:\Users\admin\AppData\Local\Temp\e4jFC09.tmp_dir1708690898\jre\bin\unpack200.exe—aircontrol-v2.1-GA3-180228-1639-win32.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1020.14
Modules
Images
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\msvcr100.dll
1576-r "jre\lib\jfxswt.jar.pack" "jre\lib\jfxswt.jar"C:\Users\admin\AppData\Local\Temp\e4jFC09.tmp_dir1708690898\jre\bin\unpack200.exe—aircontrol-v2.1-GA3-180228-1639-win32.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1020.14
Modules
Images
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\msvcr100.dll
1644-r "jre\lib\jfr.jar.pack" "jre\lib\jfr.jar"C:\Users\admin\AppData\Local\Temp\e4jFC09.tmp_dir1708690898\jre\bin\unpack200.exe—aircontrol-v2.1-GA3-180228-1639-win32.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1020.14
Modules
Images
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4jfc09.tmp_dir1708690898\jre\bin\msvcr100.dll
1740"C:\Users\admin\Downloads\aircontrol-v2.1-GA3-180228-1639-win32.exe" C:\Users\admin\Downloads\aircontrol-v2.1-GA3-180228-1639-win32.exe
iexplore.exe
User:
admin
Company:
Ubiquiti Networks, Inc.
Integrity Level:
MEDIUM
Description:
airControl2
Exit code:
0
Version:
v2.1-GA3-180228-1639
Modules
Images
c:\users\admin\downloads\aircontrol-v2.1-ga3-180228-1639-win32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
25 023
Read events
24 883
Write events
103
Delete events
37

Modification events

(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31090258
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31090258
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
454
Suspicious files
227
Text files
982
Unknown types
113

Dropped files

PID
Process
Filename
Type
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:3640B5CC54E6D5E4743A592E20240E58
SHA256:521FB355A55339E45B692DB667EAFC047C40074736316B6302E965317B04BF6F
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:9F728F71B5C885DA6DF863032C1BCB45
SHA256:A7584EF98153A4FE7B4A6EB174F638917D557ADD426B1EFC1006B82706F55C3A
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B436D5D7E3751F880CF0096FDE680A01
SHA256:E694757FD45979AF8701B65251E55658A85F975311814A86EF2DC9F7738E8167
3864iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\7R5YLB26.txttext
MD5:49B02296A805A2517F55D1CCAB12684C
SHA256:DB511771824A3AB354F244F54FD07C50DB23041F041DFA0D230AA201C925EF03
3864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xmlxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656binary
MD5:736B4E20FE020D6777DABE9091C40F0A
SHA256:0469290F5E1C885EC9643E7EA4B4906D4BF0CF8E86D762E77D43064BD87C75C7
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894der
MD5:AC0252A6C8673FA50BDF2961DD6BD471
SHA256:19122C391D8CC9A95017536B2C46B10BC80C2EE932AE4BB99BC10AC87F6AE130
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:5F269D75D2D9906614322FB028FEBC29
SHA256:FF7FE1FF4947C8ADDEC0FD1D65420E634DDAAE6BE3934B60F982C092140DBAFA
3864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver6E55.tmpxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
3952iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\aircontrol-v2.1-GA3-180228-1639-win32[1].exeexecutable
MD5:353C08EF9DD68FAE8C2173292F3DBEAF
SHA256:74D2EF82B479594C4C455E9D1438BE16E70DA22BECE662290BE864D88555ED96
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
26
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3952
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?927e0d673a39dd41
unknown
—
—
unknown
3952
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d362edf7b65e9a48
unknown
—
—
unknown
3952
iexplore.exe
GET
200
108.156.61.221:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
binary
2.02 Kb
unknown
3952
iexplore.exe
GET
200
18.65.41.80:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
binary
1.49 Kb
unknown
3952
iexplore.exe
GET
200
18.65.41.80:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
unknown
binary
1.37 Kb
unknown
3864
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ad697231f9b13b
unknown
—
—
unknown
3864
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9aee5c2adfb08fdb
unknown
—
—
unknown
3864
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d416ea50f343b89b
unknown
—
—
unknown
3864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1b8fee253118cbef
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3952
iexplore.exe
52.222.140.181:443
dl.ubnt.com
AMAZON-02
US
unknown
3952
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3952
iexplore.exe
108.156.61.221:80
o.ss2.us
AMAZON-02
US
unknown
3952
iexplore.exe
18.65.41.80:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
unknown
1080
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3864
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3864
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
dl.ubnt.com
  • 52.222.140.181
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
o.ss2.us
  • 108.156.61.221
  • 108.156.61.76
  • 108.156.61.115
  • 108.156.61.136
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.65.41.80
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.65.41.80
shared
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://dl.ubnt.com/aircontrol2/aircontrol-v2.1-GA3-180228-1639-win32.exe