File name:

cmd_fw_installer_138430009_eb.exe

Full analysis: https://app.any.run/tasks/3d9d65f3-e74f-4943-89aa-5b66e30b3009
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: July 28, 2024, 15:52:42
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
upx
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B48216DCA6F745A40645248384659FDD

SHA1:

3BC265E7282BFB5C63BE6CC73A2B7AAD9A060904

SHA256:

9B6394B0D1DA147C5C718EBF3ABA211CE2D4AEFC63EB0DC80ED5CFC0DB269BCD

SSDEEP:

98304:n3oeoi7dSeyJ6A89FbeCD25kvriejkx9sZjMK6vx6IF/M8aWzBWcPNkNzt9e:n3oeoYSeyJ6vnKCD25kvmeh6vFF//aFU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • cmdinstall.exe (PID: 6752)
      • dragonsetup.exe (PID: 7616)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)
      • msiexec.exe (PID: 7564)

    • Actions looks like stealing of personal data

      • dragon.exe (PID: 7724)
      • dragon.exe (PID: 7860)
      • conhost.exe (PID: 8000)
      • dragon_updater.exe (PID: 7996)
      • dragon.exe (PID: 3840)
      • dragonsetup.exe (PID: 7616)
      • isestart.exe (PID: 6888)
      • vkise.exe (PID: 7172)

    • Changes the autorun value in the registry

      • isestart.exe (PID: 6888)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)
      • vkise.exe (PID: 7172)

    • Reads the date of Windows installation

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)

    • Drops 7-zip archiver for unpacking

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)

    • Executable content was dropped or overwritten

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • cmdinstall.exe (PID: 6752)
      • dragonsetup.exe (PID: 7616)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)

    • Application launched itself

      • cmdinstall.exe (PID: 7124)
      • dragon.exe (PID: 3840)

    • The process creates files with name similar to system file names

      • dragonsetup.exe (PID: 7616)

    • The process verifies whether the antivirus software is installed

      • dragon.exe (PID: 3840)
      • dragon.exe (PID: 7724)
      • dragon.exe (PID: 7860)
      • dragon_updater.exe (PID: 7996)
      • conhost.exe (PID: 8000)
      • dragonsetup.exe (PID: 7616)
      • isestart.exe (PID: 6888)
      • isesrv.exe (PID: 6040)
      • vkise.exe (PID: 7172)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • dragonsetup.exe (PID: 7616)

    • Process drops legitimate windows executable

      • dragonsetup.exe (PID: 7616)

    • Creates a software uninstall entry

      • dragonsetup.exe (PID: 7616)
      • isestart.exe (PID: 6888)

    • Drops a system driver (possible attempt to evade defenses)

      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)

    • Creates files in the driver directory

      • isestart.exe (PID: 6888)

    • Executes as Windows Service

      • isesrv.exe (PID: 6040)

    • Creates or modifies Windows services

      • isestart.exe (PID: 6888)

    • Searches for installed software

      • vkise.exe (PID: 7172)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 7564)

    • Process requests binary or script from the Internet

      • vkise.exe (PID: 7172)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7564)

  • INFO

    • Create files in a temporary directory

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • cmdinstall.exe (PID: 7124)
      • dragonsetup.exe (PID: 7616)
      • ise_installer.exe (PID: 6136)
      • vkise.exe (PID: 7172)

    • Reads the computer name

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • dragonsetup.exe (PID: 7616)
      • dragon.exe (PID: 3840)
      • dragon_updater.exe (PID: 7996)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)
      • isesrv.exe (PID: 6040)
      • vkise.exe (PID: 7172)
      • msiexec.exe (PID: 7564)
      • msiexec.exe (PID: 7080)

    • Checks supported languages

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • cmdinstall.exe (PID: 7124)
      • cmdinstall.exe (PID: 6752)
      • dragonsetup.exe (PID: 7616)
      • dragon.exe (PID: 7724)
      • dragon.exe (PID: 3840)
      • dragon.exe (PID: 7860)
      • ise_installer.exe (PID: 6136)
      • dragon_updater.exe (PID: 7996)
      • isestart.exe (PID: 6888)
      • isesrv.exe (PID: 6040)
      • vkise.exe (PID: 7172)
      • msiexec.exe (PID: 7564)
      • msiexec.exe (PID: 7080)

    • Process checks computer location settings

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • cmdinstall.exe (PID: 7124)
      • cmdinstall.exe (PID: 6752)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)

    • Creates files in the program directory

      • cmdinstall.exe (PID: 6752)
      • dragonsetup.exe (PID: 7616)
      • isestart.exe (PID: 6888)
      • isesrv.exe (PID: 6040)
      • vkise.exe (PID: 7172)

    • Checks proxy server information

      • slui.exe (PID: 7680)
      • dragon.exe (PID: 3840)
      • dragonsetup.exe (PID: 7616)

    • Reads the software policy settings

      • slui.exe (PID: 7680)
      • vkise.exe (PID: 7172)
      • msiexec.exe (PID: 7564)

    • UPX packer has been detected

      • dragonsetup.exe (PID: 7616)

    • Creates files or folders in the user directory

      • dragon.exe (PID: 7724)
      • dragon.exe (PID: 3840)

    • Reads Microsoft Office registry keys

      • dragon.exe (PID: 3840)

    • Reads the machine GUID from the registry

      • vkise.exe (PID: 7172)
      • msiexec.exe (PID: 7564)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7564)

    • Application launched itself

      • msiexec.exe (PID: 7564)
      • MSI8D03.tmp (PID: 6332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:02:18 14:47:52+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 144384
InitializedDataSize: 1587200
UninitializedDataSize: -
EntryPoint: 0x1d0f6
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 12.2.2.8012
ProductVersionNumber: 12.2.2.8012
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: COMODO
FileVersion: 12, 2, 2, 8012
FileDescription: COMODO Internet Security
LegalCopyright: 2005-2021 COMODO. All rights reserved.
ProductName: COMODO Internet Security
ProductVersion: 12, 2, 2, 8012
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
19
Malicious processes
14
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd_fw_installer_138430009_eb.exe cmdinstall.exe cmdinstall.exe slui.exe THREAT dragonsetup.exe dragon.exe dragon.exe dragon.exe dragon_updater.exe conhost.exe ise_installer.exe isestart.exe isesrv.exe vkise.exe msiexec.exe msiexec.exe msiexec.exe no specs msi8d03.tmp no specs msi8d03.tmp

Process information

PID
CMD
Path
Indicators
Parent process
3840"C:\Program Files (x86)\Comodo\Dragon\dragon.exe" --no-first-run --register-dragon-browserC:\Program Files (x86)\Comodo\Dragon\dragon.exe
dragonsetup.exe
User:
admin
Company:
Comodo
Integrity Level:
HIGH
Description:
Comodo Dragon
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files (x86)\comodo\dragon\dragon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4788"C:\Users\admin\Desktop\cmd_fw_installer_138430009_eb.exe" C:\Users\admin\Desktop\cmd_fw_installer_138430009_eb.exe
explorer.exe
User:
admin
Company:
COMODO
Integrity Level:
MEDIUM
Description:
COMODO Internet Security
Version:
12, 2, 2, 8012
Modules
Images
c:\users\admin\desktop\cmd_fw_installer_138430009_eb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6040"C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe" -serviceC:\Program Files (x86)\Comodo\Internet Security Essentials\isesrv.exe
services.exe
User:
SYSTEM
Company:
COMODO
Integrity Level:
SYSTEM
Description:
Internet Security Essentials
Version:
1, 6, 472587, 185
Modules
Images
c:\program files (x86)\comodo\internet security essentials\isesrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6136"C:\ProgramData\\Comodo\Installer\ise_installer.exe" /quiet /chid=138430009 /aff=138430009C:\ProgramData\Comodo\Installer\ise_installer.exe
cmdinstall_138430009_eb.exe
User:
admin
Company:
COMODO
Integrity Level:
HIGH
Description:
Internet Security Essentials
Exit code:
0
Version:
1, 6, 472587, 185
Modules
Images
c:\programdata\comodo\installer\ise_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6332"C:\WINDOWS\Installer\MSI8D03.tmp" -rptype 0 -descr "Installing COMODO Firewall" -logfile "C:\Users\admin\AppData\Local\Temp\COMODO Internet Security dbgout.log"C:\Windows\Installer\MSI8D03.tmp—msiexec.exe
User:
admin
Company:
COMODO
Integrity Level:
HIGH
Description:
COMODO Internet Security
Version:
12, 2, 2, 8012
6752"C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe" -log -theme "lycia" -setupname "cmd_fw_installer_138430009_eb.exe" -type "web" -mode "cfwfree" -sfx "C:\Users\admin\Desktop" -elevated -logfile "C:\Users\admin\AppData\Local\Temp\\cmdinstall.exe_24-07-28_15.52.50.log" -parent 7124 "admin" 1964 C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe
cmdinstall.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\windows\syswow64\ondemandconnroutehelper.dll
c:\windows\syswow64\wbem\wbemprox.dll
c:\windows\syswow64\wbemcomn.dll
c:\windows\syswow64\wbem\wbemsvc.dll
c:\windows\syswow64\wbem\fastprox.dll
c:\windows\syswow64\amsi.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\x86\mpoav.dll
6872"C:\WINDOWS\Installer\MSI8D03.tmp" -rptype 0 -descr "Installing COMODO Firewall" -logfile "C:\Users\admin\AppData\Local\Temp\COMODO Internet Security dbgout.log" -workingC:\Windows\Installer\MSI8D03.tmp
MSI8D03.tmp
User:
SYSTEM
Company:
COMODO
Integrity Level:
SYSTEM
Description:
COMODO Internet Security
Version:
12, 2, 2, 8012
6888"C:\Users\admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe" /quiet /chid=138430009 /aff=138430009C:\Users\admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe
ise_installer.exe
User:
admin
Company:
COMODO
Integrity Level:
HIGH
Description:
Internet Security Essentials
Exit code:
0
Version:
1, 6, 472587, 185
Modules
Images
c:\users\admin\appdata\local\temp\7zipsfx.001\bin\ise_installer\isestart.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7080C:\Windows\System32\MsiExec.exe -Embedding 148C6D4038557AE360C86437AF7028CBC:\Windows\System32\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7124"C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe" -log -setupname "cmd_fw_installer_138430009_eb.exe" -sfx "C:\Users\admin\Desktop" -theme lycia -type web -mode cfwfree C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe
cmd_fw_installer_138430009_eb.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\syswow64\ondemandconnroutehelper.dll
c:\windows\syswow64\wbem\wbemprox.dll
c:\windows\syswow64\wbemcomn.dll
c:\windows\syswow64\wbem\wbemsvc.dll
c:\windows\syswow64\wbem\fastprox.dll
c:\windows\syswow64\amsi.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\x86\mpoav.dll
Total events
23 063
Read events
22 909
Write events
151
Delete events
3

Modification events

(PID) Process:(4788) cmd_fw_installer_138430009_eb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4788) cmd_fw_installer_138430009_eb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4788) cmd_fw_installer_138430009_eb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4788) cmd_fw_installer_138430009_eb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6752) cmdinstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO
Operation:writeName:GlobalMachineId
Value:
1D80DD99B7B912A24BF6239858F84A685883C189
(PID) Process:(6752) cmdinstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO
Operation:writeName:MachineId
Value:
12B921A21758A328BFD969FB7176EDDE
(PID) Process:(7616) dragonsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO\Dragon
Operation:writeName:PAAR_MACHINE_ID
Value:
12B921A21758A328BFD969FB7176EDDE
(PID) Process:(7616) dragonsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO\75.0.3770.100
Operation:writeName:VERSION
Value:
(PID) Process:(7616) dragonsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO\75.0.3770.100
Operation:writeName:MODE
Value:
1
(PID) Process:(7616) dragonsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO\75.0.3770.100
Operation:writeName:NEED
Value:
1
Executable files
71
Suspicious files
96
Text files
93
Unknown types
5

Dropped files

PID
Process
Filename
Type
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1025.langxml
MD5:159295A63CF16D39C9D0944C696D6D22
SHA256:B006045A62B6D1B336206FC522DCA7EE6968A6127A6BFB0C35E9E64F6BD7A7FA
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1045.langxml
MD5:E78D6766F86AA0BAA1448886FE7939E2
SHA256:723F57EFBC0A90ACC7229925FB35A1ABB298EB8129900572C917E6B98AF8B0EA
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1029.langxml
MD5:222E3AB01EECF99CF4DD23C35D82709E
SHA256:9766E8708E28C3B1F0767DC9B58CE3F0B3562D41DE94C17079FE411F528470FA
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1048.langxml
MD5:F6B3341A030E931A8644C9E4A979DF06
SHA256:A6085D7D214F74715E1AAA1B10A4ECBC254E57D53C5F23D0A234CFA7B8D52196
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1032.langxml
MD5:26BA47F25D22CFEBEFA3D4DAD607CB99
SHA256:FF662CC5FC59E4D111FB537D06BA9CA7DE7CF183C1BF94ED9FA11F4170827EF3
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1034.langxml
MD5:7D074C11B3F5DFF322E6BFF85DEB6F28
SHA256:8B14432378C965E4F2156EB37D12648081D6C7E4C24557D18B07D84475BAE97D
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1031.langxml
MD5:4308208CEE6EE93EC49D385503A692BF
SHA256:0BAB7AE6CEDED50035A5FD748BB1140C3242FEE988136EF8121E79A1257A465A
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1040.langxml
MD5:AC859B160B3B1BB0903F4A5A59C30C9A
SHA256:B67F64E249F2E1C2FDA1344F37693FD1105A422809C4D43743B65D346F92BFCB
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1041.langxml
MD5:283BF49692B268982A781BDEA2022541
SHA256:E748B8B1CE8D151BB131D5B04D2FF2DE84F7B81B39267FE97C3D2BC41E68BCDD
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1043.langxml
MD5:CCFC2C6F4FCFFD9434F4FBC028564127
SHA256:6A4D0C2C4C2A9B12472CB16A9C1723673197A4E2795148790E180D878827CB74
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
104
TCP/UDP connections
376
DNS requests
56
Threats
154

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSmEJ7s5DLYqQ4%2FaFKR54j1BHqdkgQUGqH4YRkgD8NBd0UojtE1XwYSBFUCEQCMd6AAj%2FTRsMY9nzpIg41r
unknown
—
—
whitelisted
6268
cmdinstall_138430009_eb.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2%2BiPob4twryIF%2BFfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa%2FLgCEE6wh4%2FMJDU2stjJ9785VXc%3D
unknown
—
—
whitelisted
6268
cmdinstall_138430009_eb.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT7fORrXjT27lkLixr8QTmACTI%2FtwQUZCKGtkqJyQQP0ARYkiuzbj0eJ2wCECtz23RjEUxaWzJK8jBXckk%3D
unknown
—
—
whitelisted
6268
cmdinstall_138430009_eb.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT7fORrXjT27lkLixr8QTmACTI%2FtwQUZCKGtkqJyQQP0ARYkiuzbj0eJ2wCECtz23RjEUxaWzJK8jBXckk%3D
unknown
—
—
whitelisted
6268
cmdinstall_138430009_eb.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEG3UcusCrgQG492EP1%2FhReE%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4324
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
92.123.104.46:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
7088
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
—
—
162.255.25.209:443
download.comodo.com
NUCDN
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 51.104.136.2
whitelisted
www.bing.com
  • 92.123.104.46
  • 92.123.104.38
  • 92.123.104.58
  • 92.123.104.34
  • 92.123.104.35
  • 92.123.104.50
  • 92.123.104.43
  • 92.123.104.59
  • 92.123.104.54
whitelisted
google.com
  • 142.250.181.238
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
download.comodo.com
  • 162.255.25.209
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.60
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

Found threats are available for the paid subscriptions
154 ETPRO signatures available at the full report
Process
Message
dragonsetup.exe
-------------------------------Previous Chromodo Shortcut does not exist -----------------------------
dragonsetup.exe
[Dragon] CSecureDNSPluginApp::InitInstance
dragonsetup.exe
[Dragon] CSecureDNSPluginApp::InitializeSecureDNS
dragonsetup.exe
[Dragon] CSecureDNSPluginApp::InitInstance
dragonsetup.exe
[Dragon] CSecureDNSPluginApp::InitInstance
dragon.exe
in DragonUpdateManager::CreateUpdater4.1
msiexec.exe
CISWIX: Cannot read string value 'Proxy': 2
msiexec.exe
CISWIX: PROXY 12.2.2.8012 (TestWindowsVersion): proxy dll path ()
msiexec.exe
CISWIX: PROXY 12.2.2.8012 (TestWindowsVersion): proxy path empty or does not exists
msiexec.exe
CISWIX: PROXY 12.2.2.8012 (TestWindowsVersion): Call original method
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cmd_fw_installer_138430009_eb.exe