File name:

139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f

Full analysis: https://app.any.run/tasks/dc7fb618-e8ab-4b38-baa2-185d5059ea10
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 01:15:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
formbook
xloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

A42EB64A66E65DB582055E78981F3B51

SHA1:

A52AC1689E6F75F310DCBD44426404339A68E895

SHA256:

139B85B4080A02BD329B10968F2A0365E7769F175E60CC7CE1E4A98AF8AFD41F

SSDEEP:

24576:LcwghQB+MxLo6oPYwadS8CIi2CiLVgJOY/k1ZFBtftSdAUm:LcwghQB+MxLo6oPY1dS8CIi2CiLVgJOq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • FORMBOOK has been detected (YARA)

      • 139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe (PID: 4120)

  • SUSPICIOUS

    • Application launched itself

      • 139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe (PID: 6620)

    • Executes application which crashes

      • 139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe (PID: 4120)

  • INFO

    • Reads the machine GUID from the registry

      • 139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe (PID: 6620)

    • Reads the computer name

      • 139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe (PID: 6620)

    • Checks supported languages

      • 139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe (PID: 6620)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 664)

    • Reads the software policy settings

      • slui.exe (PID: 4428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:28 02:15:30+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 800256
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xc5582
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Change Tracking
FileVersion: 1.0.0.0
InternalName: FTDW.exe
LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFileName: FTDW.exe
ProductName: Change Tracking
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe no specs sppextcomobj.exe no specs slui.exe 139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe no specs #FORMBOOK 139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe werfault.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4120 -s 228C:\Windows\SysWOW64\WerFault.exe—139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1660"C:\Users\admin\AppData\Local\Temp\139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe"C:\Users\admin\AppData\Local\Temp\139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe—139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2384C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4120"C:\Users\admin\AppData\Local\Temp\139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe"C:\Users\admin\AppData\Local\Temp\139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe
139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Exit code:
3221225477
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4428"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6620"C:\Users\admin\AppData\Local\Temp\139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe" C:\Users\admin\AppData\Local\Temp\139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6724C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
2 307
Read events
2 307
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
664WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_139b85b4080a02bd_b738286bb081faf5f82c5cb752d733988af334e_2278c3b1_1d373765-d462-4cc2-bdb8-59571f0d92a9\Report.wer —
MD5:—
SHA256:—
664WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2289.tmp.dmpbinary
MD5:AFE4802F32EE4CB5BAFBFC9F0DF3AA66
SHA256:BA1181686B024C667D26D50F7B07304A8FFE45A819D79EF3EF6256A05697B4FE
664WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER22F8.tmp.xmlxml
MD5:FD43AA204D60A2BCCE78E8C5E2769D55
SHA256:43E19BB0CD07B0D17AE017EC2A26F9846AC1845E380641B4E71A8A6AA1270E5B
664WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f.exe.4120.dmpbinary
MD5:B6D605D862E65EDFEF8948A0978855B8
SHA256:378DA4C44D3E2F0794735EEF9135D25F8A14E82C393DFC528AC12CEB741DBD05
664WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER22C8.tmp.WERInternalMetadata.xmlbinary
MD5:DFC884463EFD34F09A2321BC444CCE36
SHA256:B8C7723D189AAF26E8D314DD34ECDD08673BA11A76B3B122B4CB3B1E15D60F77
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3268
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3268
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
google.com
  • 142.250.185.110
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.73
  • 20.190.159.23
  • 20.190.159.129
  • 20.190.159.68
  • 40.126.31.128
  • 40.126.31.3
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f