File name:

SetupPortForwardNetworkUtilities.exe

Full analysis: https://app.any.run/tasks/b3d84a2d-bbb9-4a70-a650-d8d39c1b126c
Verdict: Malicious activity
Analysis date: October 22, 2023, 06:07:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F173C344B00B26AC42756404DFD5B3B9

SHA1:

21C5EBC09E378B6D7EDA6F4FDE5685C3813875B5

SHA256:

FC3C7E07734E2EC24BCB7F0AED7BD64071C3F3CD556A2DC650B63178BB8710C6

SSDEEP:

98304:UbUB5RgCBCuai/C8HCCto8USLcXSiJyy3CKUyATQ1b4hgFvvZ3rxJEFRjJXjlWUF:tT1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SetupPortForwardNetworkUtilities.exe (PID: 2752)
      • SetupPortForwardNetworkUtilities.tmp (PID: 604)
      • Launcher.exe (PID: 760)
      • UpdateHelper.exe (PID: 3432)
      • SetupPortForwardNetworkUtilities.exe (PID: 4056)

    • Creates a writable file the system directory

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)

    • Registers / Runs the DLL via REGSVR32.EXE

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 1864)
      • regsvr32.exe (PID: 124)
      • Launcher.exe (PID: 760)
      • UpdateHelper.exe (PID: 3432)
      • PFPortChecker.exe (PID: 188)

    • Application was dropped or rewritten from another process

      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • UpdateHelper.exe (PID: 3432)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2816)

    • Reads the Windows owner or organization settings

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)

    • Reads settings of System Certificates

      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)

    • Reads the Internet Settings

      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • FindPassword.exe (PID: 3284)
      • PFPortChecker.exe (PID: 188)
      • PFRouterDetector.exe (PID: 3700)

    • Checks Windows Trust Settings

      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)

    • Reads Internet Explorer settings

      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)

    • Reads Microsoft Outlook installation path

      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)

    • Reads security settings of Internet Explorer

      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)

    • Adds/modifies Windows certificates

      • PortForwardNetworkUtilities.exe (PID: 3324)

  • INFO

    • Create files in a temporary directory

      • SetupPortForwardNetworkUtilities.exe (PID: 2752)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)
      • SetupPortForwardNetworkUtilities.exe (PID: 4056)

    • Checks supported languages

      • SetupPortForwardNetworkUtilities.exe (PID: 2752)
      • SetupPortForwardNetworkUtilities.tmp (PID: 604)
      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • UpdateHelper.exe (PID: 3432)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)
      • SetupPortForwardNetworkUtilities.tmp (PID: 1052)
      • SetupPortForwardNetworkUtilities.exe (PID: 4056)

    • Application was dropped or rewritten from another process

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)
      • SetupPortForwardNetworkUtilities.tmp (PID: 1052)

    • Reads the computer name

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)
      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • UpdateHelper.exe (PID: 3432)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)
      • SetupPortForwardNetworkUtilities.tmp (PID: 1052)

    • Creates files or folders in the user directory

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • Launcher.exe (PID: 760)
      • UpdateHelper.exe (PID: 3432)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)

    • Creates files in the program directory

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)

    • Reads mouse settings

      • regsvr32.exe (PID: 2816)

    • Reads the machine GUID from the registry

      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • UpdateHelper.exe (PID: 3432)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)

    • Reads Environment values

      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)

    • Checks proxy server information

      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (51.8)
.exe | InstallShield setup (20.3)
.exe | Win32 EXE PECompact compressed (generic) (19.6)
.dll | Win32 Dynamic Link Library (generic) (3.1)
.exe | Win32 Executable (generic) (2.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:10:12 13:15:57+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 682496
InitializedDataSize: 37888
UninitializedDataSize: -
EntryPoint: 0xa7ed0
OSVersion: 6
ImageVersion: 6
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Portforward, LLC
FileDescription: Port Forward Network Utilities Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: Port Forward Network Utilities
ProductVersion: 3.3.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
13
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start setupportforwardnetworkutilities.exe no specs setupportforwardnetworkutilities.tmp no specs setupportforwardnetworkutilities.exe setupportforwardnetworkutilities.tmp no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs launcher.exe portforwardnetworkutilities.exe updatehelper.exe no specs findpassword.exe pfrouterdetector.exe pfportchecker.exe

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSWINSCK.OCX"C:\Windows\System32\regsvr32.exe—SetupPortForwardNetworkUtilities.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
188"C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\PFPortChecker.exe" C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\PFPortChecker.exe
PortForwardNetworkUtilities.exe
User:
admin
Company:
portforward.com
Integrity Level:
MEDIUM
Description:
PFPortchecker by portforward.com helps check if your ports are properly forwarded.
Exit code:
3221225547
Version:
2.00.0002
Modules
Images
c:\users\admin\appdata\roaming\portforward.com\portforwardnetworkutilities\pfportchecker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
604"C:\Users\admin\AppData\Local\Temp\is-P4T07.tmp\SetupPortForwardNetworkUtilities.tmp" /SL5="$B01D0,2669572,721408,C:\Users\admin\AppData\Local\Temp\SetupPortForwardNetworkUtilities.exe" /SPAWNWND=$1601A2 /NOTIFYWND=$50306 C:\Users\admin\AppData\Local\Temp\is-P4T07.tmp\SetupPortForwardNetworkUtilities.tmp—SetupPortForwardNetworkUtilities.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-p4t07.tmp\setupportforwardnetworkutilities.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
760"C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\Launcher.exe"C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\Launcher.exe
SetupPortForwardNetworkUtilities.tmp
User:
admin
Integrity Level:
MEDIUM
Description:
Launcher
Exit code:
0
Version:
3.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\portforward.com\portforwardnetworkutilities\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Users\admin\AppData\Local\Temp\is-NEIE6.tmp\SetupPortForwardNetworkUtilities.tmp" /SL5="$50306,2669572,721408,C:\Users\admin\AppData\Local\Temp\SetupPortForwardNetworkUtilities.exe" C:\Users\admin\AppData\Local\Temp\is-NEIE6.tmp\SetupPortForwardNetworkUtilities.tmp—SetupPortForwardNetworkUtilities.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-neie6.tmp\setupportforwardnetworkutilities.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1864"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\msinet.ocx"C:\Windows\System32\regsvr32.exe—SetupPortForwardNetworkUtilities.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
2752"C:\Users\admin\AppData\Local\Temp\SetupPortForwardNetworkUtilities.exe" C:\Users\admin\AppData\Local\Temp\SetupPortForwardNetworkUtilities.exe—explorer.exe
User:
admin
Company:
Portforward, LLC
Integrity Level:
MEDIUM
Description:
Port Forward Network Utilities Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\setupportforwardnetworkutilities.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2816"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSCOMCTL.OCX"C:\Windows\System32\regsvr32.exe—SetupPortForwardNetworkUtilities.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3284"C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\FindPassword.exe" C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\FindPassword.exe
PortForwardNetworkUtilities.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FindPassword
Exit code:
0
Version:
3.9.0.0
Modules
Images
c:\users\admin\appdata\roaming\portforward.com\portforwardnetworkutilities\findpassword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sspicli.dll
c:\windows\apppatch\aclayers.dll
3324"C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\PortForwardNetworkUtilities.exe" C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\PortForwardNetworkUtilities.exe
Launcher.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Port Forward Network Utilities
Exit code:
0
Version:
3.9.0.0
Modules
Images
c:\users\admin\appdata\roaming\portforward.com\portforwardnetworkutilities\portforwardnetworkutilities.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
Total events
24 922
Read events
24 693
Write events
163
Delete events
66

Modification events

(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{996BF5E0-8044-4650-ADEB-0B013914E99C}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F91CAF91-225B-43A7-BB9E-472F991FC402}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
Executable files
51
Suspicious files
60
Text files
108
Unknown types
0

Dropped files

PID
Process
Filename
Type
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\is-P718T.tmpexecutable
MD5:18D1F33BD5F99622F37451C442F07DD1
SHA256:CA688C7DAB7D5BF519DBA43337554F6E310E635E93D22E44C365AA13ECA21062
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\is-K9Q3B.tmpexecutable
MD5:B4E4E1756E921CF0C95BC3F19B2B69E3
SHA256:F49D28EEA86D6CC19AE825D9DC6A753A8292792E2792F781E5E8912B01789E14
2752SetupPortForwardNetworkUtilities.exeC:\Users\admin\AppData\Local\Temp\is-NEIE6.tmp\SetupPortForwardNetworkUtilities.tmpexecutable
MD5:B4E4E1756E921CF0C95BC3F19B2B69E3
SHA256:F49D28EEA86D6CC19AE825D9DC6A753A8292792E2792F781E5E8912B01789E14
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\Launcher.exeexecutable
MD5:18D1F33BD5F99622F37451C442F07DD1
SHA256:CA688C7DAB7D5BF519DBA43337554F6E310E635E93D22E44C365AA13ECA21062
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\unins000.exeexecutable
MD5:B4E4E1756E921CF0C95BC3F19B2B69E3
SHA256:F49D28EEA86D6CC19AE825D9DC6A753A8292792E2792F781E5E8912B01789E14
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\UpdateHelper.exeexecutable
MD5:479BE8B5639F27104943AC9097D310AB
SHA256:E373C3AFB9BEE4922012DD261CC663A8309CFE00E2C2BFB8A6E3F43E063B8BD0
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\is-SHCDV.tmpexecutable
MD5:479BE8B5639F27104943AC9097D310AB
SHA256:E373C3AFB9BEE4922012DD261CC663A8309CFE00E2C2BFB8A6E3F43E063B8BD0
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\is-7FGLI.tmpexecutable
MD5:7C359500407DD393A276010AB778D5AF
SHA256:A4009288982E4C30D22B544167F72DB882E34F0FDA7D4061B2C02C84688C0ED1
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\NDP472-KB4054531-Web.exeexecutable
MD5:C84209349F18AFE5A41CE04E9AE8F487
SHA256:4E49C56E4CF9DF2E837A8A3010F5A8B4DEB096429D56E7FD9FF70AB394663678
604SetupPortForwardNetworkUtilities.tmpC:\Windows\System32\MSWINSCK.OCXexecutable
MD5:E8A2190A9E8EE5E5D2E0B599BBF9DDA6
SHA256:80AB0B86DE58A657956B2A293BD9957F78E37E7383C86D6CD142208C153B6311
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
41
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
188
PFPortChecker.exe
GET
—
104.26.3.145:80
http://portchecker.portforward.com/portcheck3.cgi?port=8110&protocol=tcp&version=0
unknown
—
—
unknown
3324
PortForwardNetworkUtilities.exe
GET
200
8.253.204.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2972a951780979bb
unknown
compressed
61.6 Kb
unknown
3324
PortForwardNetworkUtilities.exe
GET
200
8.253.204.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6eb2ef66de06aab0
unknown
compressed
4.66 Kb
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEHD0QOf%2BZcI%2BCqdNUkBCweA%3D
unknown
binary
471 b
unknown
3324
PortForwardNetworkUtilities.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gts1c3/MFAwTjBMMEowSDAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCDx9GnoHWsw4QZ9qW7IsCPg%3D%3D
unknown
binary
470 b
unknown
188
PFPortChecker.exe
GET
301
104.26.2.145:80
http://www.portforward.com/help/portcheck_help.htm
unknown
html
340 b
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCiqTpRpOc3bRIUpkAuvtnV
unknown
binary
472 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
760
Launcher.exe
172.67.68.62:443
portforward.com
CLOUDFLARENET
US
unknown
3324
PortForwardNetworkUtilities.exe
198.251.114.35:443
secure.portforward.com
CCOUNTRY
US
unknown
3324
PortForwardNetworkUtilities.exe
8.253.204.120:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3324
PortForwardNetworkUtilities.exe
172.67.68.62:443
portforward.com
CLOUDFLARENET
US
unknown
3324
PortForwardNetworkUtilities.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3284
FindPassword.exe
198.251.114.35:443
secure.portforward.com
CCOUNTRY
US
unknown
3700
PFRouterDetector.exe
192.168.100.2:80
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
portforward.com
  • 172.67.68.62
  • 104.26.2.145
  • 104.26.3.145
whitelisted
secure.portforward.com
  • 198.251.114.35
unknown
ctldl.windowsupdate.com
  • 8.253.204.120
  • 67.27.233.126
  • 67.27.159.254
  • 67.27.235.254
  • 67.27.235.126
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.portforward.com
  • 104.26.2.145
  • 172.67.68.62
  • 104.26.3.145
unknown
pagead2.googlesyndication.com
  • 216.58.212.34
whitelisted
ocsp.pki.goog
  • 172.217.17.99
whitelisted
ssl.google-analytics.com
  • 142.250.187.104
whitelisted
googleads.g.doubleclick.net
  • 142.250.184.130
whitelisted
partner.googleadservices.com
  • 142.250.187.162
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SetupPortForwardNetworkUtilities.exe