File name:

Invoice_Payment_Confirmation_INV#240085_pdf.exe

Full analysis: https://app.any.run/tasks/c0389adc-c649-4f36-8f4e-e544fb564a51
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: November 14, 2024, 02:43:55
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
formbook
xloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

1B597C240CD23FDA73024ED811E4A906

SHA1:

F773BDD6E924B65284D8A9EF67F61615A9764A8E

SHA256:

8A91C4BF99A674909E6993D52E061547517056D36F9B8E828A9148EB412FFA73

SSDEEP:

49152:VRnuBD7tSq0QcNj+NM2bm5JcxboHf2ZIfDdLc3LVd4Z/c5GdgCB2hgvRzpg5fVB7:7uBftSXNj+NM2bm5JcxboHf2ZCDdLc3q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Dunlop.exe (PID: 5508)

    • FORMBOOK has been detected (YARA)

      • Dunlop.exe (PID: 5508)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Invoice_Payment_Confirmation_INV#240085_pdf.exe (PID: 6704)

    • Starts itself from another location

      • Invoice_Payment_Confirmation_INV#240085_pdf.exe (PID: 6704)

    • Executes application which crashes

      • Dunlop.exe (PID: 5508)

  • INFO

    • Reads mouse settings

      • Invoice_Payment_Confirmation_INV#240085_pdf.exe (PID: 6704)
      • Dunlop.exe (PID: 5508)

    • Checks supported languages

      • Invoice_Payment_Confirmation_INV#240085_pdf.exe (PID: 6704)
      • Dunlop.exe (PID: 5508)

    • Creates files or folders in the user directory

      • Invoice_Payment_Confirmation_INV#240085_pdf.exe (PID: 6704)
      • Dunlop.exe (PID: 5508)

    • Create files in a temporary directory

      • Invoice_Payment_Confirmation_INV#240085_pdf.exe (PID: 6704)
      • Dunlop.exe (PID: 5508)

    • Reads the machine GUID from the registry

      • Invoice_Payment_Confirmation_INV#240085_pdf.exe (PID: 6704)

    • The process uses AutoIt

      • Dunlop.exe (PID: 5508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(5508) Dunlop.exe
C2www.kimosskrupulslacker.cfd/f29s/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)rostnixon.net
exxxwordz.xyz
ndradesanches.shop
eneral-vceef.xyz
isanbowl.top
aresrasherregard.cfd
dzas-yeah.xyz
0083.miami
hongziyin01.top
jdhfmq.live
alembottling.net
vtyo-phone.xyz
kaqb-decade.xyz
odel-lsmfz.xyz
aradise.tech
uan123-rtp43.xyz
pusptracking.xyz
uqhi42.xyz
mihy-professor.xyz
mnz-your.xyz
iscussion-tjard.xyz
peak-ajau.xyz
ixedcontainerlogistics.today
ranxxletzz.xyz
ccloudserve.xyz
haloryner.website
ro-arenamega.pro
tjcb-wait.xyz
lywjv-issue.xyz
rta-away.xyz
ay888.website
asderkadinkollari.net
specially-smou.xyz
ound-qlhmm.xyz
nit-dreeu.xyz
ea-obgocc.xyz
rostavive-org.xyz
zpp-at.xyz
duxrib.xyz
uohz.net
etsgroove.app
awqs-wonder.xyz
acaxtecameralcarers.cfd
idstream.xyz
umayunileusesingests.shop
avada-cash-out.tech
byataltatweer.net
omething-nvho.xyz
yntomist.pics
aomei517.top
how-ydhtlu.xyz
ise-bjnh.xyz
ovt-jobs-lisitings00810.today
mmgiare.xyz
plqz-move.xyz
onheronummaryorkney.cfd
oqo-over.xyz
aee.pro
as-nhynby.xyz
dnaqm-walk.xyz
aranvickersvirilia.cfd
wqvn-environment.xyz
attern-equd.xyz
ivinetranquilityjourney.pics
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:11:13 23:04:29+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 570880
InitializedDataSize: 535040
UninitializedDataSize: -
EntryPoint: 0x25f74
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start invoice_payment_confirmation_inv#240085_pdf.exe #FORMBOOK dunlop.exe svchost.exe no specs werfault.exe sppextcomobj.exe no specs slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3644C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4904C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5508 -s 744C:\Windows\SysWOW64\WerFault.exe
Dunlop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5508"C:\Users\admin\AppData\Local\Temp\Invoice_Payment_Confirmation_INV#240085_pdf.exe" C:\Users\admin\AppData\Local\Thebesian\Dunlop.exe
Invoice_Payment_Confirmation_INV#240085_pdf.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\thebesian\dunlop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
Formbook
(PID) Process(5508) Dunlop.exe
C2www.kimosskrupulslacker.cfd/f29s/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)rostnixon.net
exxxwordz.xyz
ndradesanches.shop
eneral-vceef.xyz
isanbowl.top
aresrasherregard.cfd
dzas-yeah.xyz
0083.miami
hongziyin01.top
jdhfmq.live
alembottling.net
vtyo-phone.xyz
kaqb-decade.xyz
odel-lsmfz.xyz
aradise.tech
uan123-rtp43.xyz
pusptracking.xyz
uqhi42.xyz
mihy-professor.xyz
mnz-your.xyz
iscussion-tjard.xyz
peak-ajau.xyz
ixedcontainerlogistics.today
ranxxletzz.xyz
ccloudserve.xyz
haloryner.website
ro-arenamega.pro
tjcb-wait.xyz
lywjv-issue.xyz
rta-away.xyz
ay888.website
asderkadinkollari.net
specially-smou.xyz
ound-qlhmm.xyz
nit-dreeu.xyz
ea-obgocc.xyz
rostavive-org.xyz
zpp-at.xyz
duxrib.xyz
uohz.net
etsgroove.app
awqs-wonder.xyz
acaxtecameralcarers.cfd
idstream.xyz
umayunileusesingests.shop
avada-cash-out.tech
byataltatweer.net
omething-nvho.xyz
yntomist.pics
aomei517.top
how-ydhtlu.xyz
ise-bjnh.xyz
ovt-jobs-lisitings00810.today
mmgiare.xyz
plqz-move.xyz
onheronummaryorkney.cfd
oqo-over.xyz
aee.pro
as-nhynby.xyz
dnaqm-walk.xyz
aranvickersvirilia.cfd
wqvn-environment.xyz
attern-equd.xyz
ivinetranquilityjourney.pics
6680"C:\Users\admin\AppData\Local\Temp\Invoice_Payment_Confirmation_INV#240085_pdf.exe" C:\Windows\SysWOW64\svchost.exe—Dunlop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
6704"C:\Users\admin\AppData\Local\Temp\Invoice_Payment_Confirmation_INV#240085_pdf.exe" C:\Users\admin\AppData\Local\Temp\Invoice_Payment_Confirmation_INV#240085_pdf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\invoice_payment_confirmation_inv#240085_pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6952C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7144"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 693
Read events
3 693
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
10
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4904WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Dunlop.exe_aad921de21be7099b0cc8d78f0489d4355af1d7e_28474208_fa448d12-027b-4380-ab38-4c2ac5c470c5\Report.wer —
MD5:—
SHA256:—
5508Dunlop.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dunlop.vbsbinary
MD5:704DEE7300C09130927867D63D332769
SHA256:386BD1BD5F8921CB843DAEA59A1FCF305A6424B26ED53E5DA2214A8EFFD4EE4A
4904WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD4CE.tmp.WERInternalMetadata.xmlxml
MD5:E737C3D8787668EAA9B986B91BB028F4
SHA256:558544A8E010EAC6167D9D5735A90FEDC742C9D495C3B9812AA7924019FBD890
4904WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD347.tmp.dmpbinary
MD5:B9C3FA9160ABF97FDE73306256F49BC2
SHA256:4761DD2DC6524B89D5326EC208CDC3633B4326F6D1569AEDC7A89E69DC650E8B
4904WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:CBF6A056BC4A293B8F31018293C6C92E
SHA256:CDAD98EED377B34ECAFCFE70D74552D9B0A7AF5A6130338B501B68A4CD3CE64E
6704Invoice_Payment_Confirmation_INV#240085_pdf.exeC:\Users\admin\AppData\Local\Temp\autC879.tmpbinary
MD5:6DFE90F2047D6FB875801A796E81BD8C
SHA256:E2095CD308D15ACB8B4CF182BF5CF67A77BD7C83EABA8510D9D06D16C089F03B
5508Dunlop.exeC:\Users\admin\AppData\Local\Temp\autCDE8.tmpbinary
MD5:6DFE90F2047D6FB875801A796E81BD8C
SHA256:E2095CD308D15ACB8B4CF182BF5CF67A77BD7C83EABA8510D9D06D16C089F03B
4904WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Dunlop.exe.5508.dmpbinary
MD5:2C9D4C9E4CC1C1BDFB031219EC4D2CFB
SHA256:CEDE68D0B65D7E2AF1AC59B8210799C907EBC9CD29648847527AA417EBF549F7
4904WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:A28769D641220C05BA5BFF94B5752B49
SHA256:A2AFB62A79B8A653ABE6C6CC37B882BF37DB43D4A10A1C589C8127216B6ADD09
6704Invoice_Payment_Confirmation_INV#240085_pdf.exeC:\Users\admin\AppData\Local\Thebesian\Dunlop.exeexecutable
MD5:1B597C240CD23FDA73024ED811E4A906
SHA256:8A91C4BF99A674909E6993D52E061547517056D36F9B8E828A9148EB412FFA73
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
45
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
624
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.20.245.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4904
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4904
WerFault.exe
GET
200
2.20.245.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6848
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6908
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6908
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3396
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
2.20.245.138:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5488
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4360
SearchApp.exe
104.126.37.144:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 2.20.245.138
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.144
  • 104.126.37.123
  • 104.126.37.128
  • 104.126.37.176
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.2
  • 20.190.159.0
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.4
  • 40.126.31.71
  • 20.190.159.68
whitelisted
th.bing.com
  • 104.126.37.176
  • 104.126.37.144
  • 104.126.37.123
  • 104.126.37.128
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.20
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Invoice_Payment_Confirmation_INV#240085_pdf.exe