File name:

po_BB1BDEF.exe

Full analysis: https://app.any.run/tasks/698d1fdc-a6ca-4da5-82a0-0e2aa31b3d91
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 07:20:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
formbook
stealer
xloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

D48F764B428ACB6654E004C3B3AEE289

SHA1:

23F0AF084A3D767FA9B89E0BFFC12C5BBE8850A1

SHA256:

26E09E4C1374B7CD4447977B1AFF280901E5EB83C33C05A34B020B1DDC552821

SSDEEP:

24576:YQuzFu/yuoAukQuHOuQcuguux6u3nuPCuo1uExuHPuLAuQhuMxuaVu70um9uK2ht:YQuzFu/yuoAukQuHOuQcuguux6u3nuPM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • FORMBOOK has been detected

      • control.exe (PID: 3676)
      • chkdsk.exe (PID: 1244)

    • Changes the autorun value in the registry

      • control.exe (PID: 3676)

    • Actions looks like stealing of personal data

      • control.exe (PID: 3676)
      • cmd.exe (PID: 5008)

    • Connects to the CnC server

      • explorer.exe (PID: 5492)

    • FORMBOOK has been detected (YARA)

      • control.exe (PID: 3676)

    • Steals credentials from Web Browsers

      • control.exe (PID: 3676)

    • FORMBOOK has been detected (SURICATA)

      • explorer.exe (PID: 5492)

  • SUSPICIOUS

    • Application launched itself

      • po_BB1BDEF.exe (PID: 3364)
      • jroplb7npx3fg.exe (PID: 812)

    • Starts CMD.EXE for commands execution

      • control.exe (PID: 3676)

    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 5492)

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 5492)
      • dllhost.exe (PID: 5740)

  • INFO

    • Checks supported languages

      • po_BB1BDEF.exe (PID: 3364)
      • po_BB1BDEF.exe (PID: 4244)
      • jroplb7npx3fg.exe (PID: 4740)
      • jroplb7npx3fg.exe (PID: 812)

    • Manual execution by a user

      • control.exe (PID: 3676)

    • Reads the computer name

      • po_BB1BDEF.exe (PID: 3364)
      • po_BB1BDEF.exe (PID: 4244)
      • jroplb7npx3fg.exe (PID: 4740)
      • jroplb7npx3fg.exe (PID: 812)

    • Creates files or folders in the user directory

      • control.exe (PID: 3676)

    • Reads security settings of Internet Explorer

      • control.exe (PID: 3676)
      • dllhost.exe (PID: 5740)

    • Reads the software policy settings

      • slui.exe (PID: 6272)
      • SIHClient.exe (PID: 5404)
      • slui.exe (PID: 2320)

    • Checks proxy server information

      • slui.exe (PID: 6272)

    • Create files in a temporary directory

      • explorer.exe (PID: 5492)
      • cmd.exe (PID: 5008)

    • Creates files in the program directory

      • dllhost.exe (PID: 5740)

    • Checks transactions between databases Windows and Oracle

      • explorer.exe (PID: 5492)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 3112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(3676) control.exe
C2www.kabsolug.com/h336/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)ristorantepagus.com
lamerma.com
hotfansclub.com
kooperasile.com
papersgestao.com
hub114.com
formereye.com
makrobet936.com
314vdy.info
tcwqbz.com
fuyuntemai.com
thebowtour.com
palulakids.com
petsfiction.com
xn--udsw77e.com
velomecha.com
ajollim.com
beautyzonebyheidi.com
tashastrendynails.com
rains.ink
loveshe.ink
loveandlaceave.com
soukexpress.com
xn--glcksmenschen-xob.net
wonderfulontap.com
lowcarbfood-tips.com
idived.info
hongchen.ltd
kidenkaihatsu.com
sensingbridge-platform.com
eventsignscompany.com
victorcollege.com
jykefan.com
upforanadventure.today
spamooni.com
balancefabrikken.com
philnex.net
109manbet.com
laneydennis.com
platonh.com
it-aac.biz
kine-lutterbach.com
makarimalnakheel.com
unternehmervertraute.com
xhtd870.com
ugod.ltd
wynmh.info
illusion.ltd
xn--yet430b2reomo.net
longsyogaroom.com
renewhorizons.com
fjernvarmefyn.net
yiyao258.com
likaifandian.com
vaperezult.com
br-l.com
salvadorgiralt.cat
ourmagicbus.net
vincentcampo.com
huadaolife.net
yunche365.com
claimsirma.info
edocroissier.com
blueskyplusindicator.com
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (63.9)
.exe | Win32 Executable MS Visual C++ (generic) (24.3)
.dll | Win32 Dynamic Link Library (generic) (5.1)
.exe | Win32 Executable (generic) (3.5)
.exe | Generic Win/DOS Executable (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:09:19 08:45:58+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 176128
InitializedDataSize: 405504
UninitializedDataSize: -
EntryPoint: 0x1928
OSVersion: 4
ImageVersion: 2.9
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.9.0.2
ProductVersionNumber: 2.9.0.2
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: skovgangsmanden
CompanyName: ubisOFT
FileDescription: Petitjournalist1
LegalCopyright: Indkapsling
LegalTrademarks: BORGMESTERKONTORETS
ProductName: Storhedsvanviddets
FileVersion: 2.09.0002
ProductVersion: 2.09.0002
InternalName: venstrefljes
OriginalFileName: venstrefljes.exe
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
19
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start po_bb1bdef.exe no specs po_bb1bdef.exe no specs sppextcomobj.exe no specs slui.exe #FORMBOOK control.exe cmd.exe no specs conhost.exe no specs #FORMBOOK explorer.exe cmd.exe conhost.exe no specs firefox.exe no specs sihclient.exe slui.exe Copy/Move/Rename/Delete/Link Object jroplb7npx3fg.exe no specs jroplb7npx3fg.exe no specs #FORMBOOK chkdsk.exe no specs svchost.exe officeclicktorun.exe

Process information

PID
CMD
Path
Indicators
Parent process
812"C:\Program Files (x86)\H4hwtpjsp\jroplb7npx3fg.exe"C:\Program Files (x86)\H4hwtpjsp\jroplb7npx3fg.exe—explorer.exe
User:
admin
Company:
ubisOFT
Integrity Level:
MEDIUM
Description:
Petitjournalist1
Exit code:
0
Version:
2.09.0002
Modules
Images
c:\program files (x86)\h4hwtpjsp\jroplb7npx3fg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1072\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1244"C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Check Disk Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chkdsk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1616/c del "C:\Users\admin\AppData\Local\Temp\po_BB1BDEF.exe"C:\Windows\SysWOW64\cmd.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2088"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—control.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
3221225534
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2320"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3112"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /serviceC:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Click-to-Run (SxS)
Version:
16.0.16026.20140
Modules
Images
c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
3364"C:\Users\admin\AppData\Local\Temp\po_BB1BDEF.exe" C:\Users\admin\AppData\Local\Temp\po_BB1BDEF.exe—explorer.exe
User:
admin
Company:
ubisOFT
Integrity Level:
MEDIUM
Description:
Petitjournalist1
Exit code:
0
Version:
2.09.0002
Modules
Images
c:\users\admin\appdata\local\temp\po_bb1bdef.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
3676"C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\control.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Formbook
(PID) Process(3676) control.exe
C2www.kabsolug.com/h336/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)ristorantepagus.com
lamerma.com
hotfansclub.com
kooperasile.com
papersgestao.com
hub114.com
formereye.com
makrobet936.com
314vdy.info
tcwqbz.com
fuyuntemai.com
thebowtour.com
palulakids.com
petsfiction.com
xn--udsw77e.com
velomecha.com
ajollim.com
beautyzonebyheidi.com
tashastrendynails.com
rains.ink
loveshe.ink
loveandlaceave.com
soukexpress.com
xn--glcksmenschen-xob.net
wonderfulontap.com
lowcarbfood-tips.com
idived.info
hongchen.ltd
kidenkaihatsu.com
sensingbridge-platform.com
eventsignscompany.com
victorcollege.com
jykefan.com
upforanadventure.today
spamooni.com
balancefabrikken.com
philnex.net
109manbet.com
laneydennis.com
platonh.com
it-aac.biz
kine-lutterbach.com
makarimalnakheel.com
unternehmervertraute.com
xhtd870.com
ugod.ltd
wynmh.info
illusion.ltd
xn--yet430b2reomo.net
longsyogaroom.com
renewhorizons.com
fjernvarmefyn.net
yiyao258.com
likaifandian.com
vaperezult.com
br-l.com
salvadorgiralt.cat
ourmagicbus.net
vincentcampo.com
huadaolife.net
yunche365.com
claimsirma.info
edocroissier.com
blueskyplusindicator.com
Total events
12 083
Read events
12 068
Write events
15
Delete events
0

Modification events

(PID) Process:(3676) control.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:CBWPEZ70
Value:
C:\Program Files (x86)\H4hwtpjsp\jroplb7npx3fg.exe
(PID) Process:(3676) control.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3676) control.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3676) control.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5404) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Expires
Value:
2024-07-19 22:38:28
(PID) Process:(5404) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:LastModified
Value:
2001-01-01 00:00:00
(PID) Process:(5404) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:PotentialFailover
Value:
0
(PID) Process:(5404) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Data
Value:
<?xml version="1.0" encoding="UTF-8"?><ServiceEnvironment ServiceID="E7A50285-D08D-499D-9FF8-180FDC2332BC" ID="SIHProd" Revision="1"><WUClientData /><StoreClientData /><SIHClientData><Engine elementVersion="1" /><Actions elementVersion="1" /></SIHClientData></ServiceEnvironment>
(PID) Process:(5404) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:ETag
Value:
"Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"
(PID) Process:(5404) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Expires
Value:
2024-07-20 10:38:27
Executable files
2
Suspicious files
9
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
3676control.exeC:\Users\admin\AppData\Roaming\7QPMP-5T\7QPlogri.inibinary
MD5:D63A82E5D81E02E399090AF26DB0B9CB
SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE
3676control.exeC:\Users\admin\AppData\Roaming\7QPMP-5T\7QPlogrc.inibinary
MD5:E03F207A7B9CFC4D877ED2EC64BE028E
SHA256:B17183098B6E349844A3151456EDF62C8E41B2348D2445A610C0FF1E29963067
3676control.exeC:\Users\admin\AppData\Roaming\7QPMP-5T\7QPlogrv.inibinary
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5
SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507
5492explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
3364po_BB1BDEF.exeC:\Windows\win.inibinary
MD5:6BF517432F65EB7F0D18D574BF14124C
SHA256:6E2B70DFCCABF3CC651545676A3A566C9CFAE03F15F772886646ABCE1DA35B46
3676control.exeC:\Users\admin\AppData\Roaming\7QPMP-5T\7QPlogim.jpegbinary
MD5:DCD6DB0A6F1D00520EC98D9FBF01D8B0
SHA256:79B37678A582EE99DD9C21CA03765782BBE31C85E0F10AF5C28282D42F0E1ACF
5740dllhost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msbinary
MD5:45EB0DEA7AA18E6862E00097FC696875
SHA256:775606C864E5B008B4F65283F1707E0D7E0C716E10B573393B0C41249639A378
4244po_BB1BDEF.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\win.inibinary
MD5:6BF517432F65EB7F0D18D574BF14124C
SHA256:6E2B70DFCCABF3CC651545676A3A566C9CFAE03F15F772886646ABCE1DA35B46
5404SIHClient.exeC:\Windows\Logs\SIH\SIH.20250325.072149.192.1.etletl
MD5:BCA9F73B04ADB98ABEF7A4157C1C9238
SHA256:—
5492explorer.exeC:\Users\admin\AppData\Local\Temp\H4hwtpjsp\jroplb7npx3fg.exeexecutable
MD5:D48F764B428ACB6654E004C3B3AEE289
SHA256:26E09E4C1374B7CD4447977B1AFF280901E5EB83C33C05A34B020B1DDC552821
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
95
DNS requests
33
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5492
explorer.exe
GET
404
49.13.77.253:80
http://www.likaifandian.com/h336/?Htt4c=oFQ8ejEx&XRmPgzh=Q9C4Qg5P14pwh2bCMZ4g8s1XAFDnU3Lt316xvUOlawnBnEkjdViWkWO6KUQpAa/2l7yQ
unknown
—
—
malicious
5492
explorer.exe
GET
404
49.13.77.253:80
http://www.formereye.com/h336/?XRmPgzh=Jdetwel3z7MCLM4UAzwVjh6akKOD+VauZOwXZqMvFct71FKVeNHjfV3k+/AZedQqPJc7&Htt4c=oFQ8ejEx
unknown
—
—
malicious
5492
explorer.exe
GET
404
154.204.241.62:80
http://www.yunche365.com/h336/?Htt4c=oFQ8ejEx&XRmPgzh=6qBxjA0iCvNrFyB1cWS42UIoS4O3xUnwrrLewC3dkBfArdrJlcm54qMdhVSmUL+qH3ei
unknown
—
—
malicious
5492
explorer.exe
POST
404
49.13.77.253:80
http://www.formereye.com/h336/
unknown
—
—
unknown
5492
explorer.exe
POST
404
154.204.241.62:80
http://www.yunche365.com/h336/
unknown
—
—
unknown
5492
explorer.exe
GET
404
49.13.77.253:80
http://www.upforanadventure.today/h336/?XRmPgzh=vc9kHMnrJRwMff3xghBgiF5PhSTVsq6U+BAHUxgNSizA2FOtNJymMSLmrhalI/tEe3iz&Htt4c=oFQ8ejEx
unknown
—
—
malicious
5492
explorer.exe
GET
404
34.69.219.172:80
http://www.vincentcampo.com/h336/?Htt4c=oFQ8ejEx&XRmPgzh=4F27rN9xDd840ODlvYpv6MJf+ReqfUKORmOYkv5fscAl+JqpOVtmpxT2do8fYeYixSCn
unknown
—
—
malicious
5492
explorer.exe
GET
404
49.13.77.253:80
http://www.papersgestao.com/h336/?XRmPgzh=g7ve/GtVvOIHrKn0il8LpxdFZ3JdCLP3UE0qM4IK9gAqOWKmNE1frGZCMyYN6ZaBd6Fn&Htt4c=oFQ8ejEx
unknown
—
—
malicious
5492
explorer.exe
POST
404
49.13.77.253:80
http://www.upforanadventure.today/h336/
unknown
—
—
unknown
5492
explorer.exe
POST
404
34.69.219.172:80
http://www.vincentcampo.com/h336/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5492
explorer.exe
49.13.77.253:80
www.likaifandian.com
Hetzner Online GmbH
DE
malicious
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4220
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.likaifandian.com
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.130
  • 20.190.160.65
  • 20.190.160.3
  • 20.190.160.128
  • 20.190.160.67
  • 40.126.32.76
  • 40.126.32.138
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
  • 2603:1030:800:5::bfee:a08d
whitelisted
241.42.69.40.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
po_BB1BDEF.exe