File name:

cfosspeed-v1253-build2534.exe

Full analysis: https://app.any.run/tasks/d979e1b9-d3ec-465c-b8ad-c6f0b0d2050e
Verdict: Malicious activity
Analysis date: February 26, 2024, 14:16:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4F530F5EB72084BC8DA6FF6B079B8C59

SHA1:

6DC463CACB323868D65E7F600D024629FD1E6750

SHA256:

A67CAF8C0954AB0B7D0B2DD15E6196A3877BE633F2FBA625371209FFD019FA83

SSDEEP:

98304:mmctp5aGq5abF4EPbswuXKBiCvVBqv9RNge0VJTjjaT4enz5itmhxg9uwJ64qi+v:moRZHWdplTvJg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cfosspeed-v1253-build2534.exe (PID: 2848)
      • setup.exe (PID: 1492)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4000)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • setup.exe (PID: 1492)

    • Drops a system driver (possible attempt to evade defenses)

      • cfosspeed-v1253-build2534.exe (PID: 2848)
      • setup.exe (PID: 1492)

    • Executable content was dropped or overwritten

      • cfosspeed-v1253-build2534.exe (PID: 2848)
      • setup.exe (PID: 1492)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4000)

    • Suspicious use of NETSH.EXE

      • setup.exe (PID: 1492)

    • Reads settings of System Certificates

      • setup.exe (PID: 1492)
      • MicrosoftEdgeUpdate.exe (PID: 2256)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 4000)
      • MicrosoftEdgeUpdate.exe (PID: 4004)

    • Process drops legitimate windows executable

      • setup.exe (PID: 1492)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4000)
      • MicrosoftEdgeUpdate.exe (PID: 4004)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 4004)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 4004)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 3488)

    • Creates a software uninstall entry

      • MicrosoftEdgeUpdate.exe (PID: 4004)

    • Reads the Internet Settings

      • MicrosoftEdgeUpdate.exe (PID: 2256)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 2256)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 2256)

    • Executes as Windows Service

      • MicrosoftEdgeUpdate.exe (PID: 2152)

  • INFO

    • Checks supported languages

      • cfosspeed-v1253-build2534.exe (PID: 2848)
      • setup.exe (PID: 1492)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4000)
      • MicrosoftEdgeUpdate.exe (PID: 4004)
      • MicrosoftEdgeUpdate.exe (PID: 4044)
      • MicrosoftEdgeUpdate.exe (PID: 3488)
      • MicrosoftEdgeUpdate.exe (PID: 2256)
      • MicrosoftEdgeUpdate.exe (PID: 1928)
      • MicrosoftEdgeUpdate.exe (PID: 2152)

    • Reads Windows Product ID

      • setup.exe (PID: 1492)

    • Create files in a temporary directory

      • cfosspeed-v1253-build2534.exe (PID: 2848)
      • MicrosoftEdgeUpdate.exe (PID: 2256)
      • setup.exe (PID: 1492)

    • Reads Environment values

      • setup.exe (PID: 1492)
      • MicrosoftEdgeUpdate.exe (PID: 2256)

    • Reads the computer name

      • setup.exe (PID: 1492)
      • MicrosoftEdgeUpdate.exe (PID: 4044)
      • MicrosoftEdgeUpdate.exe (PID: 4004)
      • MicrosoftEdgeUpdate.exe (PID: 3488)
      • MicrosoftEdgeUpdate.exe (PID: 2256)
      • MicrosoftEdgeUpdate.exe (PID: 1928)
      • MicrosoftEdgeUpdate.exe (PID: 2152)

    • Reads product name

      • setup.exe (PID: 1492)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 1492)

    • Process checks computer location settings

      • setup.exe (PID: 1492)

    • Creates files in the program directory

      • setup.exe (PID: 1492)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4000)

    • Reads the software policy settings

      • setup.exe (PID: 1492)
      • MicrosoftEdgeUpdate.exe (PID: 2256)
      • MicrosoftEdgeUpdate.exe (PID: 2152)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 2256)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 2256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:10:15 12:08:51+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 39936
InitializedDataSize: 160256
UninitializedDataSize: -
EntryPoint: 0x3c98
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
11
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cfosspeed-v1253-build2534.exe setup.exe netsh.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe cfosspeed-v1253-build2534.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1492"C:\Users\admin\AppData\Local\Temp\$cfsfx.0\setup.exe" -parentdir:"C:\Users\admin\Desktop\"C:\Users\admin\AppData\Local\Temp\$cfsfx.0\setup.exe
cfosspeed-v1253-build2534.exe
User:
admin
Company:
cFos Software GmbH
Integrity Level:
HIGH
Description:
cFosSpeed Installer
Exit code:
0
Version:
12.53.2534
Modules
Images
c:\users\admin\appdata\local\temp\$cfsfx.0\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1928"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{BE760A15-4E3F-4D9B-9C86-EDD7A0967E46}" /silentC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2152"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2256"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkU3NjBBMTUtNEUzRi00RDlCLTlDODYtRUREN0EwOTY3RTQ2fSIgdXNlcmlkPSJ7NEQ1RjZBQTEtOEYyNS00RDZBLUI1MzAtMjI1NjhFOEM0RkNCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDODU2MTI3My02OTgwLTRBRDUtOUJFOC03OUVGN0YzMENBQTV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iMyIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4yNDU0NiIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4ODYiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRFTEwiIHByb2R1Y3RfbmFtZT0iREVMTCIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3NS4yOSIgbmV4dHZlcnNpb249IjEuMy4xODUuMTciIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE1OTQ5MTIxMDkzIiBpbnN0YWxsX3RpbWVfbXM9Ijc1MCIvPjwvYXBwPjwvcmVxdWVzdD4C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2304netsh int tcp show globalC:\Windows\System32\netsh.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2848"C:\Users\admin\Desktop\cfosspeed-v1253-build2534.exe" C:\Users\admin\Desktop\cfosspeed-v1253-build2534.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\cfosspeed-v1253-build2534.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
3488"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3672"C:\Users\admin\Desktop\cfosspeed-v1253-build2534.exe" C:\Users\admin\Desktop\cfosspeed-v1253-build2534.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\cfosspeed-v1253-build2534.exe
c:\windows\system32\ntdll.dll
4000C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
4004"C:\Program Files\Microsoft\Temp\EU5196.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files\Microsoft\Temp\EU5196.tmp\MicrosoftEdgeUpdate.exe—MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files\microsoft\temp\eu5196.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
22 778
Read events
14 950
Write events
7 730
Delete events
98

Modification events

(PID) Process:(2304) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2304) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-100
Value:
DHCP Quarantine Enforcement Client
(PID) Process:(2304) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-101
Value:
Provides DHCP based enforcement for NAP
(PID) Process:(2304) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-103
Value:
1.0
(PID) Process:(2304) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-102
Value:
Microsoft Corporation
(PID) Process:(2304) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-1
Value:
IPsec Relying Party
(PID) Process:(2304) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-2
Value:
Provides IPsec based enforcement for Network Access Protection
(PID) Process:(2304) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-4
Value:
1.0
(PID) Process:(2304) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-3
Value:
Microsoft Corporation
(PID) Process:(2304) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\tsgqec.dll,-100
Value:
RD Gateway Quarantine Enforcement Client
Executable files
263
Suspicious files
8
Text files
1 052
Unknown types
6

Dropped files

PID
Process
Filename
Type
2848cfosspeed-v1253-build2534.exeC:\Users\admin\AppData\Local\Temp\$cfsfx.0\cfosspeed32.cabcompressed
MD5:2F5F6B61EED49227B89A40B1CA5851C5
SHA256:00D4B663A9AFDEC974BB93585FB2E06783807DEA2B0C4FA39CFD16E81FE7E3C0
2848cfosspeed-v1253-build2534.exeC:\Users\admin\AppData\Local\Temp\$cfsfx.0\cfosspeedsh.cabcompressed
MD5:D2638164E16AB7585C19968E8209867B
SHA256:9C160CE5F5C9B0C33EE8F403EDBD8277E8ED0A03304DD1771FC344620D07B5DC
2848cfosspeed-v1253-build2534.exeC:\Users\admin\AppData\Local\Temp\$cfsfx.0\programdata\pub\slot_tpl.htmhtml
MD5:EAFF81F3F5F6B2FF2E688A87E2B7180B
SHA256:FE99CC0A2ECF6A4B5043BF370E53D27B563027BF14F08B226E8AB43419118CBE
2848cfosspeed-v1253-build2534.exeC:\Users\admin\AppData\Local\Temp\$cfsfx.0\programdata\pub\pingstat_tpl.htmhtml
MD5:868D01A6F5E2D7B418D547E5FF2F3555
SHA256:E8DA00EEDB95A942F57D3BF171C301CD43358AED11462E64A4FF106649E627B1
2848cfosspeed-v1253-build2534.exeC:\Users\admin\AppData\Local\Temp\$cfsfx.0\programdata\pub\console_tpl.htmhtml
MD5:2B3CEC6042F36546857A07CF51C91FED
SHA256:46118C3E9E6557E364C985A0DF3A1D7A74587D64920D093702E5B8F42DC2543C
2848cfosspeed-v1253-build2534.exeC:\Users\admin\AppData\Local\Temp\$cfsfx.0\cfosspeed64.cabcompressed
MD5:0C95376B506E3D74EC7C2A98027F0A31
SHA256:89659535887ECECE82DB72F6C844A7384E30B1CCC16D3F7D4F1FA3B94C5C5A39
2848cfosspeed-v1253-build2534.exeC:\Users\admin\AppData\Local\Temp\$cfsfx.0\programdata\pub\analyzer_tpl.htmhtml
MD5:14EB0FD12487119582F5A51B37B73A30
SHA256:4D6314714007AF68E1A2AF6AB85D91A8054F837D42E88F9BC9153065998E405C
2848cfosspeed-v1253-build2534.exeC:\Users\admin\AppData\Local\Temp\$cfsfx.0\programdata\pub\bgraph_tpl.htmhtml
MD5:BC7DAEB0AD5F1F3DE0DD3D640F9D8ACC
SHA256:50377D5EC96EE30F2CE6E577BB24F299F5C5713C947B7C6CEEE0C2CF4C711BE3
2848cfosspeed-v1253-build2534.exeC:\Users\admin\AppData\Local\Temp\$cfsfx.0\programdata\pub\preferences_tpl.htmhtml
MD5:2A50363252F1CA4B16FCE767377E70B1
SHA256:3AB5AA2D72E87C99B8BC5F73C77A228424B88AE88A9C4F3CDC1020D6B9975491
2848cfosspeed-v1253-build2534.exeC:\Users\admin\AppData\Local\Temp\$cfsfx.0\programdata\pub\adapterinfo_tpl.htmxml
MD5:BBBAD469C318A11A25FCFC9EB39E6804
SHA256:B74D16380691FD36047053FAEF9F95E431F9ADE895FDB261BFE826A87E0C17A9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
14
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2256
MicrosoftEdgeUpdate.exe
GET
304
95.101.75.101:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1075684ea1a754ec
unknown
—
—
—
856
svchost.exe
HEAD
—
104.109.143.13:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d87a3bbd-7fe5-4ec3-b806-293cca78b363?P1=1709561855&P2=404&P3=2&P4=eRy1HMaksYJUh8iDImvS%2f3nwYTEPOhQozhqS7ZfjTXJPk12eIbw4Q7QtWKAzXftWHqiKGG6i5lvh0n1CfhkjWw%3d%3d
unknown
—
—
—
2256
MicrosoftEdgeUpdate.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
—
1080
svchost.exe
GET
200
95.101.75.101:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0754c686571bd23f
unknown
compressed
65.2 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1492
setup.exe
104.81.142.98:443
go.microsoft.com
AKAMAI-AS
NL
unknown
1492
setup.exe
152.199.21.175:443
msedge.sf.dl.delivery.mp.microsoft.com
EDGECAST
DE
unknown
2256
MicrosoftEdgeUpdate.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2152
MicrosoftEdgeUpdate.exe
20.114.58.89:443
msedge.api.cdp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2256
MicrosoftEdgeUpdate.exe
20.189.173.16:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2256
MicrosoftEdgeUpdate.exe
95.101.75.101:80
ctldl.windowsupdate.com
Akamai International B.V.
NL
unknown
2256
MicrosoftEdgeUpdate.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown

DNS requests

Domain
IP
Reputation
cfos.de
  • —
unknown
go.microsoft.com
  • 104.81.142.98
unknown
msedge.sf.dl.delivery.mp.microsoft.com
  • 152.199.21.175
unknown
config.edge.skype.com
  • 13.107.42.16
unknown
msedge.api.cdp.microsoft.com
  • 20.114.58.89
unknown
self.events.data.microsoft.com
  • 20.189.173.16
unknown
ctldl.windowsupdate.com
  • 95.101.75.101
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 104.109.143.13
unknown

Threats

No threats detected
Process
Message
setup.exe
file 'C:\Program Files\cFosSpeed\cFosSpeed.ini' open error 3
setup.exe
file 'C:\Program Files\cFosSpeed\cFosSpeed.ini' open error 3
setup.exe
file 'C:\Program Files\cFosSpeed\cFosSpeed.ini' open error 3
setup.exe
file 'C:\Program Files\cFosSpeed\cFosSpeed.ini' open error 3
setup.exe
Unable to open device 'CFOSSPEED$D'.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
cfosspeed-v1253-build2534.exe