File name:

cmd_fw_installer_138430009_eb.exe

Full analysis: https://app.any.run/tasks/3d9d65f3-e74f-4943-89aa-5b66e30b3009
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: July 28, 2024, 15:52:42
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
upx
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B48216DCA6F745A40645248384659FDD

SHA1:

3BC265E7282BFB5C63BE6CC73A2B7AAD9A060904

SHA256:

9B6394B0D1DA147C5C718EBF3ABA211CE2D4AEFC63EB0DC80ED5CFC0DB269BCD

SSDEEP:

98304:n3oeoi7dSeyJ6A89FbeCD25kvriejkx9sZjMK6vx6IF/M8aWzBWcPNkNzt9e:n3oeoYSeyJ6vnKCD25kvmeh6vFF//aFU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • cmdinstall.exe (PID: 6752)
      • dragonsetup.exe (PID: 7616)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)
      • msiexec.exe (PID: 7564)

    • Actions looks like stealing of personal data

      • dragon.exe (PID: 7724)
      • dragon.exe (PID: 7860)
      • dragon_updater.exe (PID: 7996)
      • conhost.exe (PID: 8000)
      • dragon.exe (PID: 3840)
      • dragonsetup.exe (PID: 7616)
      • isestart.exe (PID: 6888)
      • vkise.exe (PID: 7172)

    • Changes the autorun value in the registry

      • isestart.exe (PID: 6888)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • cmdinstall.exe (PID: 6752)
      • dragonsetup.exe (PID: 7616)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)

    • Reads security settings of Internet Explorer

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)
      • vkise.exe (PID: 7172)

    • Drops 7-zip archiver for unpacking

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)

    • Reads the date of Windows installation

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)

    • Application launched itself

      • cmdinstall.exe (PID: 7124)
      • dragon.exe (PID: 3840)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • dragonsetup.exe (PID: 7616)

    • Process drops legitimate windows executable

      • dragonsetup.exe (PID: 7616)

    • The process verifies whether the antivirus software is installed

      • dragon.exe (PID: 3840)
      • dragon.exe (PID: 7724)
      • dragon.exe (PID: 7860)
      • dragon_updater.exe (PID: 7996)
      • conhost.exe (PID: 8000)
      • dragonsetup.exe (PID: 7616)
      • isestart.exe (PID: 6888)
      • isesrv.exe (PID: 6040)
      • vkise.exe (PID: 7172)

    • The process creates files with name similar to system file names

      • dragonsetup.exe (PID: 7616)

    • Creates a software uninstall entry

      • dragonsetup.exe (PID: 7616)
      • isestart.exe (PID: 6888)

    • Drops a system driver (possible attempt to evade defenses)

      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)

    • Executes as Windows Service

      • isesrv.exe (PID: 6040)

    • Creates files in the driver directory

      • isestart.exe (PID: 6888)

    • Creates or modifies Windows services

      • isestart.exe (PID: 6888)

    • Searches for installed software

      • vkise.exe (PID: 7172)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 7564)

    • Process requests binary or script from the Internet

      • vkise.exe (PID: 7172)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7564)

  • INFO

    • Reads the computer name

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • dragon.exe (PID: 3840)
      • dragonsetup.exe (PID: 7616)
      • dragon_updater.exe (PID: 7996)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)
      • isesrv.exe (PID: 6040)
      • vkise.exe (PID: 7172)
      • msiexec.exe (PID: 7564)
      • msiexec.exe (PID: 7080)

    • Checks supported languages

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • cmdinstall.exe (PID: 7124)
      • cmdinstall.exe (PID: 6752)
      • dragonsetup.exe (PID: 7616)
      • dragon.exe (PID: 3840)
      • dragon.exe (PID: 7724)
      • dragon.exe (PID: 7860)
      • dragon_updater.exe (PID: 7996)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)
      • isesrv.exe (PID: 6040)
      • vkise.exe (PID: 7172)
      • msiexec.exe (PID: 7564)
      • msiexec.exe (PID: 7080)

    • Process checks computer location settings

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • cmdinstall.exe (PID: 7124)
      • cmdinstall.exe (PID: 6752)
      • ise_installer.exe (PID: 6136)
      • isestart.exe (PID: 6888)

    • Create files in a temporary directory

      • cmd_fw_installer_138430009_eb.exe (PID: 4788)
      • cmdinstall.exe (PID: 7124)
      • dragonsetup.exe (PID: 7616)
      • ise_installer.exe (PID: 6136)
      • vkise.exe (PID: 7172)

    • Creates files in the program directory

      • cmdinstall.exe (PID: 6752)
      • dragonsetup.exe (PID: 7616)
      • isestart.exe (PID: 6888)
      • isesrv.exe (PID: 6040)
      • vkise.exe (PID: 7172)

    • Reads the software policy settings

      • slui.exe (PID: 7680)
      • vkise.exe (PID: 7172)
      • msiexec.exe (PID: 7564)

    • Checks proxy server information

      • slui.exe (PID: 7680)
      • dragon.exe (PID: 3840)
      • dragonsetup.exe (PID: 7616)

    • UPX packer has been detected

      • dragonsetup.exe (PID: 7616)

    • Creates files or folders in the user directory

      • dragon.exe (PID: 7724)
      • dragon.exe (PID: 3840)

    • Reads Microsoft Office registry keys

      • dragon.exe (PID: 3840)

    • Reads the machine GUID from the registry

      • vkise.exe (PID: 7172)
      • msiexec.exe (PID: 7564)

    • Application launched itself

      • msiexec.exe (PID: 7564)
      • MSI8D03.tmp (PID: 6332)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:02:18 14:47:52+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 144384
InitializedDataSize: 1587200
UninitializedDataSize: -
EntryPoint: 0x1d0f6
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 12.2.2.8012
ProductVersionNumber: 12.2.2.8012
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: COMODO
FileVersion: 12, 2, 2, 8012
FileDescription: COMODO Internet Security
LegalCopyright: 2005-2021 COMODO. All rights reserved.
ProductName: COMODO Internet Security
ProductVersion: 12, 2, 2, 8012
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
19
Malicious processes
14
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd_fw_installer_138430009_eb.exe cmdinstall.exe cmdinstall.exe slui.exe THREAT dragonsetup.exe dragon.exe dragon.exe dragon.exe dragon_updater.exe conhost.exe ise_installer.exe isestart.exe isesrv.exe vkise.exe msiexec.exe msiexec.exe msiexec.exe no specs msi8d03.tmp no specs msi8d03.tmp

Process information

PID
CMD
Path
Indicators
Parent process
3840"C:\Program Files (x86)\Comodo\Dragon\dragon.exe" --no-first-run --register-dragon-browserC:\Program Files (x86)\Comodo\Dragon\dragon.exe
dragonsetup.exe
User:
admin
Company:
Comodo
Integrity Level:
HIGH
Description:
Comodo Dragon
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files (x86)\comodo\dragon\dragon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4788"C:\Users\admin\Desktop\cmd_fw_installer_138430009_eb.exe" C:\Users\admin\Desktop\cmd_fw_installer_138430009_eb.exe
explorer.exe
User:
admin
Company:
COMODO
Integrity Level:
MEDIUM
Description:
COMODO Internet Security
Version:
12, 2, 2, 8012
Modules
Images
c:\users\admin\desktop\cmd_fw_installer_138430009_eb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6040"C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe" -serviceC:\Program Files (x86)\Comodo\Internet Security Essentials\isesrv.exe
services.exe
User:
SYSTEM
Company:
COMODO
Integrity Level:
SYSTEM
Description:
Internet Security Essentials
Version:
1, 6, 472587, 185
Modules
Images
c:\program files (x86)\comodo\internet security essentials\isesrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6136"C:\ProgramData\\Comodo\Installer\ise_installer.exe" /quiet /chid=138430009 /aff=138430009C:\ProgramData\Comodo\Installer\ise_installer.exe
cmdinstall_138430009_eb.exe
User:
admin
Company:
COMODO
Integrity Level:
HIGH
Description:
Internet Security Essentials
Exit code:
0
Version:
1, 6, 472587, 185
Modules
Images
c:\programdata\comodo\installer\ise_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6332"C:\WINDOWS\Installer\MSI8D03.tmp" -rptype 0 -descr "Installing COMODO Firewall" -logfile "C:\Users\admin\AppData\Local\Temp\COMODO Internet Security dbgout.log"C:\Windows\Installer\MSI8D03.tmp—msiexec.exe
User:
admin
Company:
COMODO
Integrity Level:
HIGH
Description:
COMODO Internet Security
Version:
12, 2, 2, 8012
6752"C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe" -log -theme "lycia" -setupname "cmd_fw_installer_138430009_eb.exe" -type "web" -mode "cfwfree" -sfx "C:\Users\admin\Desktop" -elevated -logfile "C:\Users\admin\AppData\Local\Temp\\cmdinstall.exe_24-07-28_15.52.50.log" -parent 7124 "admin" 1964 C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe
cmdinstall.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\windows\syswow64\ondemandconnroutehelper.dll
c:\windows\syswow64\wbem\wbemprox.dll
c:\windows\syswow64\wbemcomn.dll
c:\windows\syswow64\wbem\wbemsvc.dll
c:\windows\syswow64\wbem\fastprox.dll
c:\windows\syswow64\amsi.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\x86\mpoav.dll
6872"C:\WINDOWS\Installer\MSI8D03.tmp" -rptype 0 -descr "Installing COMODO Firewall" -logfile "C:\Users\admin\AppData\Local\Temp\COMODO Internet Security dbgout.log" -workingC:\Windows\Installer\MSI8D03.tmp
MSI8D03.tmp
User:
SYSTEM
Company:
COMODO
Integrity Level:
SYSTEM
Description:
COMODO Internet Security
Version:
12, 2, 2, 8012
6888"C:\Users\admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe" /quiet /chid=138430009 /aff=138430009C:\Users\admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe
ise_installer.exe
User:
admin
Company:
COMODO
Integrity Level:
HIGH
Description:
Internet Security Essentials
Exit code:
0
Version:
1, 6, 472587, 185
Modules
Images
c:\users\admin\appdata\local\temp\7zipsfx.001\bin\ise_installer\isestart.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7080C:\Windows\System32\MsiExec.exe -Embedding 148C6D4038557AE360C86437AF7028CBC:\Windows\System32\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7124"C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe" -log -setupname "cmd_fw_installer_138430009_eb.exe" -sfx "C:\Users\admin\Desktop" -theme lycia -type web -mode cfwfree C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe
cmd_fw_installer_138430009_eb.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\syswow64\ondemandconnroutehelper.dll
c:\windows\syswow64\wbem\wbemprox.dll
c:\windows\syswow64\wbemcomn.dll
c:\windows\syswow64\wbem\wbemsvc.dll
c:\windows\syswow64\wbem\fastprox.dll
c:\windows\syswow64\amsi.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\x86\mpoav.dll
Total events
23 063
Read events
22 909
Write events
151
Delete events
3

Modification events

(PID) Process:(4788) cmd_fw_installer_138430009_eb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4788) cmd_fw_installer_138430009_eb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4788) cmd_fw_installer_138430009_eb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4788) cmd_fw_installer_138430009_eb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6752) cmdinstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO
Operation:writeName:GlobalMachineId
Value:
1D80DD99B7B912A24BF6239858F84A685883C189
(PID) Process:(6752) cmdinstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO
Operation:writeName:MachineId
Value:
12B921A21758A328BFD969FB7176EDDE
(PID) Process:(7616) dragonsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO\Dragon
Operation:writeName:PAAR_MACHINE_ID
Value:
12B921A21758A328BFD969FB7176EDDE
(PID) Process:(7616) dragonsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO\75.0.3770.100
Operation:writeName:VERSION
Value:
(PID) Process:(7616) dragonsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO\75.0.3770.100
Operation:writeName:MODE
Value:
1
(PID) Process:(7616) dragonsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO\75.0.3770.100
Operation:writeName:NEED
Value:
1
Executable files
71
Suspicious files
96
Text files
93
Unknown types
5

Dropped files

PID
Process
Filename
Type
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1040.langxml
MD5:AC859B160B3B1BB0903F4A5A59C30C9A
SHA256:B67F64E249F2E1C2FDA1344F37693FD1105A422809C4D43743B65D346F92BFCB
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\themes\ilycia.setexecutable
MD5:7B85F91536C8342AC64D3EDECE2AF7FE
SHA256:918E7AAD857776A895ECDF850665C355026882BCF1E0EBA279FF4F7AA4B6BBAE
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1025.langxml
MD5:159295A63CF16D39C9D0944C696D6D22
SHA256:B006045A62B6D1B336206FC522DCA7EE6968A6127A6BFB0C35E9E64F6BD7A7FA
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1028.langxml
MD5:98E6CA1FB834AF2009E84E42180AAAEC
SHA256:A97B4EB25F9E900295F905AC8DEBE03DADBEE0051566DFB0C11529B7F8E886FD
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1026.langxml
MD5:4786A7FB4658F8F602CBF7FD1B258D1D
SHA256:557C24CF1E3888FF4A0B1DE77DFA09E5F3FE331DCF70B6AB9E5A12FC01B22B55
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1032.langxml
MD5:26BA47F25D22CFEBEFA3D4DAD607CB99
SHA256:FF662CC5FC59E4D111FB537D06BA9CA7DE7CF183C1BF94ED9FA11F4170827EF3
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1029.langxml
MD5:222E3AB01EECF99CF4DD23C35D82709E
SHA256:9766E8708E28C3B1F0767DC9B58CE3F0B3562D41DE94C17079FE411F528470FA
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1048.langxml
MD5:F6B3341A030E931A8644C9E4A979DF06
SHA256:A6085D7D214F74715E1AAA1B10A4ECBC254E57D53C5F23D0A234CFA7B8D52196
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1046.langxml
MD5:CA4963ED0D968765B9B275B45BAB8CEA
SHA256:50AA5CE89623AED285907A4E22510EE118A5937DCCBCE3C51947BBD8581A192C
4788cmd_fw_installer_138430009_eb.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\translations\1043.langxml
MD5:CCFC2C6F4FCFFD9434F4FBC028564127
SHA256:6A4D0C2C4C2A9B12472CB16A9C1723673197A4E2795148790E180D878827CB74
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
104
TCP/UDP connections
376
DNS requests
56
Threats
154

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSmEJ7s5DLYqQ4%2FaFKR54j1BHqdkgQUGqH4YRkgD8NBd0UojtE1XwYSBFUCEQCMd6AAj%2FTRsMY9nzpIg41r
unknown
—
—
whitelisted
6268
cmdinstall_138430009_eb.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT7fORrXjT27lkLixr8QTmACTI%2FtwQUZCKGtkqJyQQP0ARYkiuzbj0eJ2wCECtz23RjEUxaWzJK8jBXckk%3D
unknown
—
—
whitelisted
6268
cmdinstall_138430009_eb.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmEJ7s5DLYqQ4%2FaFKR54j1BHqdkgQUGqH4YRkgD8NBd0UojtE1XwYSBFUCED0aNXIwFYJjMNATcX6CQQg%3D
unknown
—
—
whitelisted
6268
cmdinstall_138430009_eb.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEG3UcusCrgQG492EP1%2FhReE%3D
unknown
—
—
whitelisted
6268
cmdinstall_138430009_eb.exe
GET
200
104.18.38.233:80
http://crl.sectigo.com/COMODOTimeStampingCA_2.crl
unknown
—
—
whitelisted
—
—
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRXzFDqgcxizGsL1BkUc1gIwekZcAQU34%2FzIAzpyqYE2FtYNyo9q0bcg0kCEBtCewYOKGa%2FtYbMJn4cPqo%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4324
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
92.123.104.46:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
7088
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
—
—
162.255.25.209:443
download.comodo.com
NUCDN
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 51.104.136.2
whitelisted
www.bing.com
  • 92.123.104.46
  • 92.123.104.38
  • 92.123.104.58
  • 92.123.104.34
  • 92.123.104.35
  • 92.123.104.50
  • 92.123.104.43
  • 92.123.104.59
  • 92.123.104.54
whitelisted
google.com
  • 142.250.181.238
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
download.comodo.com
  • 162.255.25.209
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.60
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

Found threats are available for the paid subscriptions
154 ETPRO signatures available at the full report
Process
Message
dragonsetup.exe
-------------------------------Previous Chromodo Shortcut does not exist -----------------------------
dragonsetup.exe
[Dragon] CSecureDNSPluginApp::InitInstance
dragonsetup.exe
[Dragon] CSecureDNSPluginApp::InitializeSecureDNS
dragonsetup.exe
[Dragon] CSecureDNSPluginApp::InitInstance
dragonsetup.exe
[Dragon] CSecureDNSPluginApp::InitInstance
dragon.exe
in DragonUpdateManager::CreateUpdater4.1
msiexec.exe
CISWIX: Cannot read string value 'Proxy': 2
msiexec.exe
CISWIX: PROXY 12.2.2.8012 (TestWindowsVersion): proxy dll path ()
msiexec.exe
CISWIX: PROXY 12.2.2.8012 (TestWindowsVersion): proxy path empty or does not exists
msiexec.exe
CISWIX: PROXY 12.2.2.8012 (TestWindowsVersion): Call original method
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cmd_fw_installer_138430009_eb.exe