URL:

http://www.freeformsnow.com

Full analysis: https://app.any.run/tasks/e3fed995-9b70-45dd-bb71-12769a668145
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: January 22, 2020, 18:14:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
adload
Indicators:
MD5:

5FBE56C2A25504F2435177AB3482427D

SHA1:

EA6009C55D034CC787B9FDAD8263EAC704221ADE

SHA256:

2CB87662EE221CF24ED76C313F406EF00A7CAF9A591D0270BD433C3E10415A77

SSDEEP:

3:N1KJS4L0YL+I:Cc4P+I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 180)

    • Application was dropped or rewritten from another process

      • FindingFormsProTab-30775625.exe (PID: 4032)
      • Helper.exe (PID: 2412)

    • ADLOAD was detected

      • FindingFormsProTab-30775625.exe (PID: 4032)

    • Changes the autorun value in the registry

      • FindingFormsProTab-30775625.exe (PID: 4032)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 180)
      • FindingFormsProTab-30775625.exe (PID: 4032)
      • iexplore.exe (PID: 1136)

    • Reads Internet Cache Settings

      • FindingFormsProTab-30775625.exe (PID: 4032)

    • Changes the started page of IE

      • FindingFormsProTab-30775625.exe (PID: 4032)

    • Starts Internet Explorer

      • FindingFormsProTab-30775625.exe (PID: 4032)

    • Creates files in the user directory

      • FindingFormsProTab-30775625.exe (PID: 4032)

    • Creates a software uninstall entry

      • FindingFormsProTab-30775625.exe (PID: 4032)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1136)
      • iexplore.exe (PID: 180)
      • iexplore.exe (PID: 2548)

    • Changes internet zones settings

      • iexplore.exe (PID: 1136)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1136)

    • Reads internet explorer settings

      • iexplore.exe (PID: 180)
      • iexplore.exe (PID: 2548)

    • Creates files in the user directory

      • iexplore.exe (PID: 180)
      • iexplore.exe (PID: 2548)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1136)

    • Application launched itself

      • iexplore.exe (PID: 1136)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1136)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start iexplore.exe iexplore.exe #ADLOAD findingformsprotab-30775625.exe iexplore.exe no specs iexplore.exe helper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
180"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1136 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1136"C:\Program Files\Internet Explorer\iexplore.exe" "http://www.freeformsnow.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2396"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://search.hfindingformspro.com/?uc=20200122&i_id=forms_spt__1.30&ap=appfocus1&uid=f6fa5b75-9e0e-456e-859f-8ac289aedc53&source=-lp0-bb9-iei-msnC:\Program Files\Internet Explorer\IEXPLORE.EXE—FindingFormsProTab-30775625.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2412"C:\Users\admin\AppData\Roaming\{28e56cfb-e30e-4f66-85d8-339885b726b8}\Helper.exe" http:%2F%2Fsearch.hfindingformspro.com%2F%3Fuc=20200122%26i_id=forms_spt__1.30%26ap=appfocus1%26uid=f6fa5b75-9e0e-456e-859f-8ac289aedc53%26source=-lp0-bb9-iei-msn-su 21600 falseC:\Users\admin\AppData\Roaming\{28e56cfb-e30e-4f66-85d8-339885b726b8}\Helper.exe—FindingFormsProTab-30775625.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.5
Modules
Images
c:\users\admin\appdata\roaming\{28e56cfb-e30e-4f66-85d8-339885b726b8}\helper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2548"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1136 CREDAT:791837 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
4032"C:\Users\admin\Downloads\FindingFormsProTab-30775625.exe" C:\Users\admin\Downloads\FindingFormsProTab-30775625.exe
iexplore.exe
User:
admin
Company:
SpringTech (Cayman) Ltd.
Integrity Level:
MEDIUM
Exit code:
0
Version:
5.5.0.1
Modules
Images
c:\users\admin\downloads\findingformsprotab-30775625.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
1 352
Read events
1 187
Write events
158
Delete events
7

Modification events

(PID) Process:(1136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
4027748268
(PID) Process:(1136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30789967
(PID) Process:(1136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A0000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(1136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
5
Suspicious files
64
Text files
27
Unknown types
26

Dropped files

PID
Process
Filename
Type
180iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab7AB0.tmp —
MD5:—
SHA256:—
180iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar7AB1.tmp —
MD5:—
SHA256:—
180iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab7AD1.tmp —
MD5:—
SHA256:—
180iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar7AD2.tmp —
MD5:—
SHA256:—
180iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab7B31.tmp —
MD5:—
SHA256:—
180iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar7B32.tmp —
MD5:—
SHA256:—
1136iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
180iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015binary
MD5:—
SHA256:—
180iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416binary
MD5:—
SHA256:—
180iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6A2279C2CA42EBEE26F14589F0736E50der
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
89
DNS requests
38
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
180
iexplore.exe
GET
302
52.72.75.0:80
http://www.freeformsnow.com/
US
html
146 b
whitelisted
180
iexplore.exe
GET
200
172.217.22.3:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
180
iexplore.exe
GET
200
172.217.22.3:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCXb1jFw60uiQgAAAAAJez1
US
der
472 b
whitelisted
180
iexplore.exe
GET
200
172.217.22.3:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
180
iexplore.exe
GET
200
172.217.22.3:80
http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEApJpWdKa1WWCAAAAAAoea4%3D
US
der
471 b
whitelisted
180
iexplore.exe
GET
200
172.217.22.3:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCXb1jFw60uiQgAAAAAJez1
US
der
472 b
whitelisted
180
iexplore.exe
GET
200
172.217.22.3:80
http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEGe6hz9FTw%2F8CAAAAAAl7PQ%3D
US
der
471 b
whitelisted
180
iexplore.exe
GET
200
172.217.22.3:80
http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEGe6hz9FTw%2F8CAAAAAAl7PQ%3D
US
der
471 b
whitelisted
180
iexplore.exe
GET
200
172.217.22.3:80
http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEApJpWdKa1WWCAAAAAAoea4%3D
US
der
471 b
whitelisted
180
iexplore.exe
GET
200
143.204.208.180:80
http://crl.rootca1.amazontrust.com/rootca1.crl
US
der
439 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
180
iexplore.exe
52.72.75.0:80
www.freeformsnow.com
Amazon.com, Inc.
US
unknown
180
iexplore.exe
52.72.75.0:443
www.freeformsnow.com
Amazon.com, Inc.
US
unknown
180
iexplore.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
180
iexplore.exe
13.35.254.82:80
x.ss2.us
—
US
suspicious
180
iexplore.exe
13.35.254.192:80
o.ss2.us
—
US
unknown
1136
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
180
iexplore.exe
143.204.208.59:80
s.ss2.us
—
US
suspicious
180
iexplore.exe
143.204.208.108:80
ocsp.rootg2.amazontrust.com
—
US
whitelisted
180
iexplore.exe
143.204.208.180:80
crl.rootca1.amazontrust.com
—
US
whitelisted
180
iexplore.exe
52.1.83.215:443
config.hfindingformspro.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
www.freeformsnow.com
  • 52.72.75.0
  • 52.70.3.52
unknown
x.ss2.us
  • 13.35.254.82
  • 13.35.254.176
  • 13.35.254.34
  • 13.35.254.54
whitelisted
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
o.ss2.us
  • 13.35.254.192
  • 13.35.254.76
  • 13.35.254.216
  • 13.35.254.205
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
s.ss2.us
  • 143.204.208.59
  • 143.204.208.159
  • 143.204.208.204
  • 143.204.208.48
whitelisted
ocsp.rootg2.amazontrust.com
  • 143.204.208.108
  • 143.204.208.192
  • 143.204.208.90
  • 143.204.208.23
whitelisted
ocsp.rootca1.amazontrust.com
  • 13.35.254.52
  • 13.35.254.57
  • 13.35.254.41
  • 13.35.254.226
shared
crl.rootca1.amazontrust.com
  • 143.204.208.180
  • 143.204.208.29
  • 143.204.208.198
  • 143.204.208.199
whitelisted

Threats

PID
Process
Class
Message
180
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
180
iexplore.exe
Misc activity
ET INFO EXE - Served Attached HTTP
4032
FindingFormsProTab-30775625.exe
A Network Trojan was detected
ET MALWARE MSIL/Adload.AT Beacon
4032
FindingFormsProTab-30775625.exe
A Network Trojan was detected
ET MALWARE MSIL/Adload.AT Beacon
4032
FindingFormsProTab-30775625.exe
A Network Trojan was detected
ET MALWARE MSIL/Adload.AT Beacon
4032
FindingFormsProTab-30775625.exe
A Network Trojan was detected
ET MALWARE MSIL/Adload.AT Beacon
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.freeformsnow.com