| URL: | https://makemkv.com/download/Setup_MakeMKV_v1.18.1.exe |
| Full analysis: | https://app.any.run/tasks/9076a1f8-5283-40af-a477-85032af923fc |
| Verdict: | Malicious activity |
| Analysis date: | May 13, 2025, 15:18:18 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MD5: | 3622828536A5A6D7E7FEBF3FC2C32A05 |
| SHA1: | 9D213F52A1F3223DEC923AC0903DE020746CAA14 |
| SHA256: | ABC1D132AB59657B920623907A33F97C5F2E9E3C261FA172E34AE4C96B84FC0A |
| SSDEEP: | 3:N82NLn23rTSUdONn:22NDGTSUdONn |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- Setup_MakeMKV_v1.18.1.exe (PID: 300)
- wincdarb_inst64.exe (PID: 7800)
Malware-specific behavior (creating "System.dll" in Temp)
- Setup_MakeMKV_v1.18.1.exe (PID: 300)
There is functionality for taking screenshot (YARA)
- Setup_MakeMKV_v1.18.1.exe (PID: 300)
Creates a software uninstall entry
- Setup_MakeMKV_v1.18.1.exe (PID: 300)
Reads security settings of Internet Explorer
- makemkv.exe (PID: 5132)
Executes as Windows Service
- cdarbsvc_v1.2.0_x64.exe (PID: 7744)
INFO
Application launched itself
- firefox.exe (PID: 5548)
- firefox.exe (PID: 4756)
The sample compiled with english language support
- firefox.exe (PID: 5548)
- Setup_MakeMKV_v1.18.1.exe (PID: 300)
- wincdarb_inst64.exe (PID: 7800)
Executable content was dropped or overwritten
- firefox.exe (PID: 5548)
Manual execution by a user
- Setup_MakeMKV_v1.18.1.exe (PID: 300)
- Setup_MakeMKV_v1.18.1.exe (PID: 5244)
Checks supported languages
- Setup_MakeMKV_v1.18.1.exe (PID: 300)
- wincdarb_inst64.exe (PID: 7448)
- wincdarb_inst64.exe (PID: 7800)
- makemkv.exe (PID: 5132)
- cdarbsvc_v1.2.0_x64.exe (PID: 7744)
- makemkvcon64.exe (PID: 6344)
Reads the computer name
- Setup_MakeMKV_v1.18.1.exe (PID: 300)
- wincdarb_inst64.exe (PID: 7448)
- wincdarb_inst64.exe (PID: 7800)
- cdarbsvc_v1.2.0_x64.exe (PID: 7744)
Create files in a temporary directory
- Setup_MakeMKV_v1.18.1.exe (PID: 300)
Creates files in the program directory
- Setup_MakeMKV_v1.18.1.exe (PID: 300)
- wincdarb_inst64.exe (PID: 7800)
Local mutex for internet shortcut management
- makemkv.exe (PID: 5132)
Checks proxy server information
- makemkv.exe (PID: 5132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
160
Monitored processes
23
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 300 | "C:\Users\admin\Downloads\Setup_MakeMKV_v1.18.1.exe" | C:\Users\admin\Downloads\Setup_MakeMKV_v1.18.1.exe | explorer.exe | |
User: admin Company: GuinpinSoft inc Integrity Level: HIGH Description: MakeMKV installer Exit code: 0 Version: v1.18.1 | ||||
| 2040 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1808 -parentBuildID 20240213221259 -prefsHandle 1744 -prefMapHandle 1736 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ceb6a8f9-62c0-45ba-b864-7a27b7b3f34c} 5548 "\\.\pipe\gecko-crash-server-pipe.5548" 1a2bbeee710 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 1 Version: 123.0 | ||||
| 4756 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://makemkv.com/download/Setup_MakeMKV_v1.18.1.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 | ||||
| 5132 | "C:\Program Files (x86)\MakeMKV\MakeMKV.exe" | C:\Program Files (x86)\MakeMKV\makemkv.exe | — | Setup_MakeMKV_v1.18.1.exe |
User: admin Company: GuinpinSoft inc Integrity Level: HIGH Description: MakeMKV GUI application Exit code: 0 Version: v1.18.1 | ||||
| 5244 | "C:\Users\admin\Downloads\Setup_MakeMKV_v1.18.1.exe" | C:\Users\admin\Downloads\Setup_MakeMKV_v1.18.1.exe | — | explorer.exe |
User: admin Company: GuinpinSoft inc Integrity Level: MEDIUM Description: MakeMKV installer Exit code: 3221226540 Version: v1.18.1 | ||||
| 5548 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://makemkv.com/download/Setup_MakeMKV_v1.18.1.exe | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 | ||||
| 6032 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) | ||||
| 6344 | xxx guiserver A0001+shm | C:\Program Files (x86)\MakeMKV\makemkvcon64.exe | — | makemkv.exe |
User: admin Company: GuinpinSoft inc Integrity Level: HIGH Description: MakeMKV console application Exit code: 0 Version: v1.18.1 | ||||
| 7184 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2092 -parentBuildID 20240213221259 -prefsHandle 2084 -prefMapHandle 2072 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96697aaf-9e6e-4b92-98c9-8d05f2a55396} 5548 "\\.\pipe\gecko-crash-server-pipe.5548" 1a2aff81710 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 | ||||
| 7364 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2580 -childID 1 -isForBrowser -prefsHandle 2752 -prefMapHandle 2744 -prefsLen 26911 -prefMapSize 244583 -jsInitHandle 1368 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff410287-2cfa-4a45-906a-9981521ee582} 5548 "\\.\pipe\gecko-crash-server-pipe.5548" 1a2c14c0f50 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
33
Suspicious files
125
Text files
23
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5548 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
| 5548 | firefox.exe | C:\Users\admin\Downloads\Setup_MakeMKV_v1.dr0-HUQ2.18.1.exe.part | — | |
MD5:— | SHA256:— | |||
| 5548 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.js | text | |
MD5:2C99A16AED3906D92FFE3EF1808E2753 | SHA256:08412578CC3BB4922388F8FF8C23962F616B69A1588DA720ADE429129C73C452 | |||
| 5548 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.bin | binary | |
MD5:297E88D7CEB26E549254EC875649F4EB | SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702 | |||
| 5548 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\SiteSecurityServiceState.bin | binary | |
MD5:3E4B9FF6E4F150795F3AB6B6F8EBB37A | SHA256:AA07E227121171B851F7202696A0C00ACB3390A7B8FC222EC81D44FAAD5B9F2C | |||
| 5548 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
| 5548 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 5548 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmp | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 5548 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 5548 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
61
DNS requests
84
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5548 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
5548 | firefox.exe | POST | 200 | 142.250.186.163:80 | http://o.pki.goog/we2 | unknown | — | — | whitelisted |
5548 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
5548 | firefox.exe | POST | 200 | 142.250.186.163:80 | http://o.pki.goog/s/wr3/FIY | unknown | — | — | whitelisted |
5548 | firefox.exe | POST | 200 | 184.24.77.78:80 | http://r10.o.lencr.org/ | unknown | — | — | whitelisted |
5548 | firefox.exe | POST | 200 | 184.24.77.74:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
5548 | firefox.exe | POST | 200 | 184.24.77.74:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
5548 | firefox.exe | POST | 200 | 142.250.186.163:80 | http://o.pki.goog/s/we1/akc | unknown | — | — | whitelisted |
5548 | firefox.exe | POST | 200 | 142.250.186.163:80 | http://o.pki.goog/we2 | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 40.126.32.133:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
— | — | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
5548 | firefox.exe | 34.36.137.203:443 | contile.services.mozilla.com | — | — | whitelisted |
5548 | firefox.exe | 172.67.195.244:443 | makemkv.com | CLOUDFLARENET | US | whitelisted |
5548 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
5548 | firefox.exe | 142.250.186.138:443 | safebrowsing.googleapis.com | GOOGLE | US | whitelisted |
5548 | firefox.exe | 34.107.243.93:443 | push.services.mozilla.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
makemkv.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |