File name:

figma_agent.exe

Full analysis: https://app.any.run/tasks/5151b2dd-f7d9-494e-8ac6-ee2357ea79df
Verdict: Malicious activity
Analysis date: November 09, 2023, 08:28:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

35CBFB18C1EFFF3F83EDC92575E3B744

SHA1:

5D3FB989C6440E5D649457B9DEA393048AD0A5A6

SHA256:

086C31C4A0A49851C15A8008E22F695D139C6ED7527A1055DF7D82C0CFFC9D97

SSDEEP:

98304:uYZfPCfEFoduG0qh1tT6QhDIk2r0p0A2o52sQKX+FZHXIg94ce5/BZFkcIPOTBOV:l8rYX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads settings of System Certificates

      • figma_agent.exe (PID: 3196)

    • Reads the Internet Settings

      • figma_agent.exe (PID: 3196)

    • Checks Windows Trust Settings

      • figma_agent.exe (PID: 3196)

    • Reads security settings of Internet Explorer

      • figma_agent.exe (PID: 3196)

  • INFO

    • Checks supported languages

      • figma_agent.exe (PID: 3196)
      • wmpnscfg.exe (PID: 3380)

    • Reads the machine GUID from the registry

      • figma_agent.exe (PID: 3196)
      • wmpnscfg.exe (PID: 3380)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3380)
      • figma_agent.exe (PID: 3196)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3380)

    • Checks proxy server information

      • figma_agent.exe (PID: 3196)

    • Creates files or folders in the user directory

      • figma_agent.exe (PID: 3196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:04 02:36:06+01:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.37
CodeSize: 4668928
InitializedDataSize: 2119168
UninitializedDataSize: -
EntryPoint: 0x442934
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 116.14.9.0
ProductVersionNumber: 116.14.9.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
ProductVersion: 116.14.9
FileDescription: Figma Agent
ProductName: figma_agent
FileVersion: 116.14.9
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start figma_agent.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3196"C:\Users\admin\AppData\Local\Temp\figma_agent.exe" C:\Users\admin\AppData\Local\Temp\figma_agent.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Figma Agent
Exit code:
0
Version:
116.14.9
Modules
Images
c:\users\admin\appdata\local\temp\figma_agent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
3380"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
4 674
Read events
4 647
Write events
24
Delete events
3

Modification events

(PID) Process:(3196) figma_agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3196) figma_agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3196) figma_agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3196) figma_agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3196) figma_agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3196) figma_agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3196) figma_agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3196) figma_agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3196) figma_agent.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3380) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{DBC8BA7A-B266-4F65-955D-3D81D875A644}\{2E4D6889-3326-4651-A771-819B4BFF8A60}
Operation:delete keyName:(default)
Value:
Executable files
0
Suspicious files
9
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3196figma_agent.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656binary
MD5:F2D8103568D0722E0EA8B2BFD4C1BB1C
SHA256:0C8A67C250ADBD3E295B277A63392F70D6BDA5A71E6A29E8F860AB4EF94B700F
3196figma_agent.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:448AD339B1AF7E8A38CC9D353266A4FB
SHA256:C3261DC4E8038493D6E68C52B915BC2FF89A85E5CC5138D2F77F9AEEFAE1313D
3196figma_agent.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:BEEF47A45E55099629C267E519B24FCA
SHA256:B39C6ECD27E95482CDA85A7D4C13AD735B2E1E70F48A65BE151261ECE31118B2
3196figma_agent.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:73089FCAA3BC6ED3E8D14319E38AF991
SHA256:ACED6B0C76336FEECD04203388131D46771E67CF4AA7C9A97273F168C6EA5CD7
3196figma_agent.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:A11EC831B058B955250CE0530C66A225
SHA256:452D0A29E0031E2587FD7110BD426F732579A7EB00815DF26712B951E5C009F6
3196figma_agent.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3196figma_agent.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:902334C8CCC6CAD1B29C8B70C797751D
SHA256:11266376CD48428B663900C18E8C178DF28A160BDE28E598A4DA908A2F8848EE
3196figma_agent.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656binary
MD5:FA7CF75B80767DE22420F2472D3C51C9
SHA256:06923215623797A167BFD80D49DCFF87DA20585F4537260A8D5DA4D98B565C46
3196figma_agent.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\RELEASE[1].jsonbinary
MD5:7E809ABAD17BB129B893E8E9AE387913
SHA256:96B23692BCB35843AD73A1802E0C53DD65970882F64374005448519934F40B2A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
10
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
67.27.158.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5d3ea207b63a5b7f
unknown
compressed
4.66 Kb
unknown
3196
figma_agent.exe
GET
200
108.138.2.173:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
binary
2.02 Kb
unknown
3196
figma_agent.exe
GET
200
18.66.142.79:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
binary
1.51 Kb
unknown
3196
figma_agent.exe
GET
200
18.66.142.79:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
unknown
binary
1.39 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
868
svchost.exe
95.101.148.135:80
—
Akamai International B.V.
NL
unknown
3196
figma_agent.exe
108.138.26.8:443
desktop.figma.com
AMAZON-02
US
unknown
3196
figma_agent.exe
67.27.158.254:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
3196
figma_agent.exe
108.138.2.173:80
o.ss2.us
AMAZON-02
US
unknown
3196
figma_agent.exe
18.66.142.79:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
868
svchost.exe
184.30.20.134:80
armmf.adobe.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
desktop.figma.com
  • 108.138.26.8
  • 108.138.26.90
  • 108.138.26.38
  • 108.138.26.32
whitelisted
ctldl.windowsupdate.com
  • 67.27.158.254
  • 8.241.122.254
  • 8.248.147.254
  • 8.248.137.254
  • 8.248.149.254
whitelisted
o.ss2.us
  • 108.138.2.173
  • 108.138.2.10
  • 108.138.2.107
  • 108.138.2.195
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.66.142.79
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.66.142.79
shared
armmf.adobe.com
  • 184.30.20.134
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
figma_agent.exe