File name:

SetupPortForwardNetworkUtilities.exe

Full analysis: https://app.any.run/tasks/b3d84a2d-bbb9-4a70-a650-d8d39c1b126c
Verdict: Malicious activity
Analysis date: October 22, 2023, 06:07:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F173C344B00B26AC42756404DFD5B3B9

SHA1:

21C5EBC09E378B6D7EDA6F4FDE5685C3813875B5

SHA256:

FC3C7E07734E2EC24BCB7F0AED7BD64071C3F3CD556A2DC650B63178BB8710C6

SSDEEP:

98304:UbUB5RgCBCuai/C8HCCto8USLcXSiJyy3CKUyATQ1b4hgFvvZ3rxJEFRjJXjlWUF:tT1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SetupPortForwardNetworkUtilities.exe (PID: 2752)
      • SetupPortForwardNetworkUtilities.tmp (PID: 604)
      • SetupPortForwardNetworkUtilities.exe (PID: 4056)
      • Launcher.exe (PID: 760)
      • UpdateHelper.exe (PID: 3432)

    • Registers / Runs the DLL via REGSVR32.EXE

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)

    • Creates a writable file the system directory

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 124)
      • regsvr32.exe (PID: 1864)
      • Launcher.exe (PID: 760)
      • UpdateHelper.exe (PID: 3432)
      • PFPortChecker.exe (PID: 188)

    • Application was dropped or rewritten from another process

      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • UpdateHelper.exe (PID: 3432)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)

    • Process drops legitimate windows executable

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2816)

    • Reads the Internet Settings

      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)

    • Reads settings of System Certificates

      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)

    • Checks Windows Trust Settings

      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)

    • Reads Internet Explorer settings

      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)

    • Reads Microsoft Outlook installation path

      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)

    • Reads security settings of Internet Explorer

      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)

    • Adds/modifies Windows certificates

      • PortForwardNetworkUtilities.exe (PID: 3324)

  • INFO

    • Checks supported languages

      • SetupPortForwardNetworkUtilities.exe (PID: 2752)
      • SetupPortForwardNetworkUtilities.tmp (PID: 1052)
      • SetupPortForwardNetworkUtilities.exe (PID: 4056)
      • SetupPortForwardNetworkUtilities.tmp (PID: 604)
      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • UpdateHelper.exe (PID: 3432)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)

    • Reads the computer name

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)
      • SetupPortForwardNetworkUtilities.tmp (PID: 1052)
      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • UpdateHelper.exe (PID: 3432)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)

    • Create files in a temporary directory

      • SetupPortForwardNetworkUtilities.exe (PID: 2752)
      • SetupPortForwardNetworkUtilities.exe (PID: 4056)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)

    • Creates files in the program directory

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)

    • Application was dropped or rewritten from another process

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)
      • SetupPortForwardNetworkUtilities.tmp (PID: 1052)

    • Creates files or folders in the user directory

      • SetupPortForwardNetworkUtilities.tmp (PID: 604)
      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • UpdateHelper.exe (PID: 3432)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)

    • Reads mouse settings

      • regsvr32.exe (PID: 2816)

    • Reads Environment values

      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)

    • Reads the machine GUID from the registry

      • Launcher.exe (PID: 760)
      • PortForwardNetworkUtilities.exe (PID: 3324)
      • UpdateHelper.exe (PID: 3432)
      • FindPassword.exe (PID: 3284)
      • PFRouterDetector.exe (PID: 3700)
      • PFPortChecker.exe (PID: 188)

    • Checks proxy server information

      • PortForwardNetworkUtilities.exe (PID: 3324)
      • PFPortChecker.exe (PID: 188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (51.8)
.exe | InstallShield setup (20.3)
.exe | Win32 EXE PECompact compressed (generic) (19.6)
.dll | Win32 Dynamic Link Library (generic) (3.1)
.exe | Win32 Executable (generic) (2.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:10:12 13:15:57+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 682496
InitializedDataSize: 37888
UninitializedDataSize: -
EntryPoint: 0xa7ed0
OSVersion: 6
ImageVersion: 6
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Portforward, LLC
FileDescription: Port Forward Network Utilities Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: Port Forward Network Utilities
ProductVersion: 3.3.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
13
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start setupportforwardnetworkutilities.exe no specs setupportforwardnetworkutilities.tmp no specs setupportforwardnetworkutilities.exe setupportforwardnetworkutilities.tmp no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs launcher.exe portforwardnetworkutilities.exe updatehelper.exe no specs findpassword.exe pfrouterdetector.exe pfportchecker.exe

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSWINSCK.OCX"C:\Windows\System32\regsvr32.exe—SetupPortForwardNetworkUtilities.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
188"C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\PFPortChecker.exe" C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\PFPortChecker.exe
PortForwardNetworkUtilities.exe
User:
admin
Company:
portforward.com
Integrity Level:
MEDIUM
Description:
PFPortchecker by portforward.com helps check if your ports are properly forwarded.
Exit code:
3221225547
Version:
2.00.0002
Modules
Images
c:\users\admin\appdata\roaming\portforward.com\portforwardnetworkutilities\pfportchecker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
604"C:\Users\admin\AppData\Local\Temp\is-P4T07.tmp\SetupPortForwardNetworkUtilities.tmp" /SL5="$B01D0,2669572,721408,C:\Users\admin\AppData\Local\Temp\SetupPortForwardNetworkUtilities.exe" /SPAWNWND=$1601A2 /NOTIFYWND=$50306 C:\Users\admin\AppData\Local\Temp\is-P4T07.tmp\SetupPortForwardNetworkUtilities.tmp—SetupPortForwardNetworkUtilities.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-p4t07.tmp\setupportforwardnetworkutilities.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
760"C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\Launcher.exe"C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\Launcher.exe
SetupPortForwardNetworkUtilities.tmp
User:
admin
Integrity Level:
MEDIUM
Description:
Launcher
Exit code:
0
Version:
3.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\portforward.com\portforwardnetworkutilities\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Users\admin\AppData\Local\Temp\is-NEIE6.tmp\SetupPortForwardNetworkUtilities.tmp" /SL5="$50306,2669572,721408,C:\Users\admin\AppData\Local\Temp\SetupPortForwardNetworkUtilities.exe" C:\Users\admin\AppData\Local\Temp\is-NEIE6.tmp\SetupPortForwardNetworkUtilities.tmp—SetupPortForwardNetworkUtilities.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-neie6.tmp\setupportforwardnetworkutilities.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1864"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\msinet.ocx"C:\Windows\System32\regsvr32.exe—SetupPortForwardNetworkUtilities.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
2752"C:\Users\admin\AppData\Local\Temp\SetupPortForwardNetworkUtilities.exe" C:\Users\admin\AppData\Local\Temp\SetupPortForwardNetworkUtilities.exe—explorer.exe
User:
admin
Company:
Portforward, LLC
Integrity Level:
MEDIUM
Description:
Port Forward Network Utilities Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\setupportforwardnetworkutilities.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2816"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSCOMCTL.OCX"C:\Windows\System32\regsvr32.exe—SetupPortForwardNetworkUtilities.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3284"C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\FindPassword.exe" C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\FindPassword.exe
PortForwardNetworkUtilities.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FindPassword
Exit code:
0
Version:
3.9.0.0
Modules
Images
c:\users\admin\appdata\roaming\portforward.com\portforwardnetworkutilities\findpassword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sspicli.dll
c:\windows\apppatch\aclayers.dll
3324"C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\PortForwardNetworkUtilities.exe" C:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\PortForwardNetworkUtilities.exe
Launcher.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Port Forward Network Utilities
Exit code:
0
Version:
3.9.0.0
Modules
Images
c:\users\admin\appdata\roaming\portforward.com\portforwardnetworkutilities\portforwardnetworkutilities.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
Total events
24 922
Read events
24 693
Write events
163
Delete events
66

Modification events

(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{996BF5E0-8044-4650-ADEB-0B013914E99C}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F91CAF91-225B-43A7-BB9E-472F991FC402}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2816) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
Executable files
51
Suspicious files
60
Text files
108
Unknown types
0

Dropped files

PID
Process
Filename
Type
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\uninstall-old-versions.battext
MD5:4726D83BF119A6DAE34873A314859843
SHA256:E109604B8D05C0D57EA578087E741B149A31F310FF509A393D7CC22563599A70
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\is-7FGLI.tmpexecutable
MD5:7C359500407DD393A276010AB778D5AF
SHA256:A4009288982E4C30D22B544167F72DB882E34F0FDA7D4061B2C02C84688C0ED1
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\Launcher.exeexecutable
MD5:18D1F33BD5F99622F37451C442F07DD1
SHA256:CA688C7DAB7D5BF519DBA43337554F6E310E635E93D22E44C365AA13ECA21062
2752SetupPortForwardNetworkUtilities.exeC:\Users\admin\AppData\Local\Temp\is-NEIE6.tmp\SetupPortForwardNetworkUtilities.tmpexecutable
MD5:B4E4E1756E921CF0C95BC3F19B2B69E3
SHA256:F49D28EEA86D6CC19AE825D9DC6A753A8292792E2792F781E5E8912B01789E14
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\Ionic.Zip.Reduced.dllexecutable
MD5:7C359500407DD393A276010AB778D5AF
SHA256:A4009288982E4C30D22B544167F72DB882E34F0FDA7D4061B2C02C84688C0ED1
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\is-P718T.tmpexecutable
MD5:18D1F33BD5F99622F37451C442F07DD1
SHA256:CA688C7DAB7D5BF519DBA43337554F6E310E635E93D22E44C365AA13ECA21062
604SetupPortForwardNetworkUtilities.tmpC:\Users\Public\Desktop\Port Forward Network Utilities.lnkbinary
MD5:927E72A6D772219A344DB7C1192E4F91
SHA256:4FA7A1518B89D630732F122E092FB55751B37BBAD84687D965FDBA5D0D2B4544
604SetupPortForwardNetworkUtilities.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Port Forward Network Utilities.lnkbinary
MD5:900EDD563F684495AC2B1C2CDF7A043D
SHA256:C1DF8B46E9D5A27C114818218CA53B6D0B335EE067EEB256DC36FEC15DACCD67
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\is-SHCDV.tmpexecutable
MD5:479BE8B5639F27104943AC9097D310AB
SHA256:E373C3AFB9BEE4922012DD261CC663A8309CFE00E2C2BFB8A6E3F43E063B8BD0
604SetupPortForwardNetworkUtilities.tmpC:\Users\admin\AppData\Roaming\Portforward.com\PortForwardNetworkUtilities\UpdateHelper.exeexecutable
MD5:479BE8B5639F27104943AC9097D310AB
SHA256:E373C3AFB9BEE4922012DD261CC663A8309CFE00E2C2BFB8A6E3F43E063B8BD0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
41
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
188
PFPortChecker.exe
GET
—
104.26.3.145:80
http://portchecker.portforward.com/portcheck3.cgi?port=8110&protocol=tcp&version=0
unknown
—
—
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEHD0QOf%2BZcI%2BCqdNUkBCweA%3D
unknown
binary
471 b
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gts1c3/MFAwTjBMMEowSDAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCDx9GnoHWsw4QZ9qW7IsCPg%3D%3D
unknown
binary
470 b
unknown
3324
PortForwardNetworkUtilities.exe
GET
200
8.253.204.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6eb2ef66de06aab0
unknown
compressed
4.66 Kb
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEAcDs2L1Wc0XCtxy6AEnTYA%3D
unknown
binary
471 b
unknown
3324
PortForwardNetworkUtilities.exe
GET
200
8.253.204.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2972a951780979bb
unknown
compressed
61.6 Kb
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDznawigtEEIxJzi7y6NmOs
unknown
binary
472 b
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCiqTpRpOc3bRIUpkAuvtnV
unknown
binary
472 b
unknown
188
PFPortChecker.exe
GET
200
172.217.17.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
760
Launcher.exe
172.67.68.62:443
portforward.com
CLOUDFLARENET
US
unknown
3324
PortForwardNetworkUtilities.exe
198.251.114.35:443
secure.portforward.com
CCOUNTRY
US
unknown
3324
PortForwardNetworkUtilities.exe
8.253.204.120:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3324
PortForwardNetworkUtilities.exe
172.67.68.62:443
portforward.com
CLOUDFLARENET
US
unknown
3324
PortForwardNetworkUtilities.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3284
FindPassword.exe
198.251.114.35:443
secure.portforward.com
CCOUNTRY
US
unknown
3700
PFRouterDetector.exe
192.168.100.2:80
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
portforward.com
  • 172.67.68.62
  • 104.26.2.145
  • 104.26.3.145
whitelisted
secure.portforward.com
  • 198.251.114.35
unknown
ctldl.windowsupdate.com
  • 8.253.204.120
  • 67.27.233.126
  • 67.27.159.254
  • 67.27.235.254
  • 67.27.235.126
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.portforward.com
  • 104.26.2.145
  • 172.67.68.62
  • 104.26.3.145
unknown
pagead2.googlesyndication.com
  • 216.58.212.34
whitelisted
ocsp.pki.goog
  • 172.217.17.99
whitelisted
ssl.google-analytics.com
  • 142.250.187.104
whitelisted
googleads.g.doubleclick.net
  • 142.250.184.130
whitelisted
partner.googleadservices.com
  • 142.250.187.162
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SetupPortForwardNetworkUtilities.exe