File name:

3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.zip

Full analysis: https://app.any.run/tasks/08944d07-920c-4607-aee7-3298d3caf649
Verdict: Malicious activity
Threats:

Fabookie is an infostealer malware that was first observed as early as October 2021. The threat is known for targeting account credentials of Facebook users. The collected information is then sold by the attackers to other criminals. Fabookie is often distributed via loaders such as SmokeLoader.

Malware Trends Tracker     >>>
Analysis date: May 22, 2024, 10:05:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
fabookie
stealer
payload
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

FC7CC4028B5BB9C5D5EA4D731803BC87

SHA1:

8E67A7365378B049CA42990B6EFB5AE4560C7750

SHA256:

D705BB73BFA982782031FE88B19F1D1AEBF340A6CF206B2A203B90071169D440

SSDEEP:

6144:KLQM6JPBRaTNYfRhtcn51+0WiChi8pW46yjviHyuh:KkPBATm57y1+ji38s46yjaSuh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6444)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)

    • Scans artifacts that could help determine the target

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)

    • Creates a writable file in the system directory

      • svchost.exe (PID: 6732)
      • svchost.exe (PID: 6644)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • TextInputHost.exe (PID: 6928)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 7052)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)

    • Reads the date of Windows installation

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 7052)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)

    • Application launched itself

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 7052)
      • svchost.exe (PID: 6596)

    • Executable content was dropped or overwritten

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)

    • Starts CMD.EXE for commands execution

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 6196)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 6196)

    • Process drops legitimate windows executable

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)

    • Executes as Windows Service

      • wmpnetwk.exe (PID: 5952)
      • wmixedwk.exe (PID: 5380)

    • Creates file in the systems drive root

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)
      • cmd.exe (PID: 6620)

    • Executing commands from a ".bat" file

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6448)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6620)

    • Process requests binary or script from the Internet

      • WINWORD.EXE (PID: 1012)

  • INFO

    • Checks supported languages

      • TextInputHost.exe (PID: 6928)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 7052)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)
      • wmpnetwk.exe (PID: 5952)
      • wmixedwk.exe (PID: 5380)

    • Reads the computer name

      • TextInputHost.exe (PID: 6928)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 7052)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)
      • wmpnetwk.exe (PID: 5952)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6444)

    • Manual execution by a user

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 7052)
      • mspaint.exe (PID: 1676)
      • WINWORD.EXE (PID: 1012)

    • Checks proxy server information

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 7052)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)

    • Creates files or folders in the user directory

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 7052)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)

    • Process checks computer location settings

      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 7052)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)

    • Creates files in the program directory

      • SearchIndexer.exe (PID: 6820)
      • 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe (PID: 6236)
      • svchost.exe (PID: 6732)
      • svchost.exe (PID: 6644)
      • svchost.exe (PID: 6596)
      • svchost.exe (PID: 6624)

    • Executes as Windows Service

      • SearchIndexer.exe (PID: 6820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2024:05:22 10:04:46
ZipCRC: 0x94647184
ZipCompressedSize: 176443
ZipUncompressedSize: 333824
ZipFileName: 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
24
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe textinputhost.exe no specs 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe cmd.exe no specs conhost.exe no specs takeown.exe no specs icacls.exe no specs searchindexer.exe no specs wmpnetwk.exe no specs wmixedwk.exe no specs svchost.exe no specs cmd.exe no specs conhost.exe no specs svchost.exe svchost.exe svchost.exe cmd.exe no specs conhost.exe no specs sc.exe no specs ping.exe no specs mspaint.exe no specs winword.exe ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1012"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\responserentals.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1676"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\societysec.jpg"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3396"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "5E15320E-8C56-474C-BF94-433574EEEF5D" "9B45096D-6E7E-42F1-8260-664BE4FD90A4" "1012"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\sechost.dll
4148takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" C:\Windows\System32\takeown.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Takes ownership of a file
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\takeown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4480ping 127.0.0.1 -n 3C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
4484sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= ownC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
5108icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:FC:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5380"C:\Program Files\Windows Media Player\wmixedwk.exe"C:\Program Files\Windows Media Player\wmixedwk.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Antimalware Service Executable
Exit code:
0
Version:
4.3.9600.16384 (winblue_rtm.130821-1623)
Modules
Images
c:\program files\windows media player\wmixedwk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\windows media player\mpsvc.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5952"C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Antimalware Service Executable
Exit code:
0
Version:
4.3.9600.16384 (winblue_rtm.130821-1623)
Modules
Images
c:\program files\windows media player\wmpnetwk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\windows media player\mpsvc.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6196"C:\Windows\System32\cmd.exe" cmd /c takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" && icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:FC:\Windows\System32\cmd.exe—3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
30 398
Read events
29 935
Write events
408
Delete events
55

Modification events

(PID) Process:(6444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.zip
(PID) Process:(6444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
5
Suspicious files
34
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
62363b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\aaaaaaaa[1].jpg —
MD5:—
SHA256:—
62363b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exeC:\Program Files\Windows Media Player\mpsvc.dll —
MD5:—
SHA256:—
62363b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exeC:\Program Files\Windows Media Player\wmpnetwk.exe —
MD5:—
SHA256:—
6820SearchIndexer.exeC:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb —
MD5:—
SHA256:—
6444WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6444.15250\3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.binexecutable
MD5:A59664F37C25EDAA69C39A65490ED3A9
SHA256:3B50FE74F6B83D53EFAB2EE7E197026977DAC17FDD3302C7DF454FAC19ABB12D
70523b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\xxxxxxxx[1].jpgimage
MD5:3200DC4E4F84ECA82267063AA1055D0C
SHA256:60EB602D492C656CBCC7BDB8A2520BE9815C4A5F1E21D0435CC2B60819970240
62363b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\xxxxxxxx[1].jpgimage
MD5:3200DC4E4F84ECA82267063AA1055D0C
SHA256:60EB602D492C656CBCC7BDB8A2520BE9815C4A5F1E21D0435CC2B60819970240
62363b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\123[1].456executable
MD5:7B207CE9F9D71DFC2EAA2E959634A54D
SHA256:757AF7A540628004B446117BE432342674F7830FA008F97A5F4A1AC386954BC2
1012WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Personalization\Governance\Anonymous\floodgatecampaigns.json —
MD5:—
SHA256:—
62363b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exeC:\kkxqbh.battext
MD5:DA93AB45D66917DED40DC4A6D4EAC550
SHA256:281824120CE3FC3BAD1F7035C2FEEB127B93D7481112A71571F931FC009E387C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
74
TCP/UDP connections
67
DNS requests
27
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
95.100.146.17:443
https://r.bing.com/rb/17/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=DygxeIQBhwGKAYEBe369AcABMbABMcMB&or=w
unknown
—
21.3 Kb
—
—
—
GET
200
95.100.146.17:443
https://r.bing.com/rb/1a/cir3,ortl,cc,nc/oT6Um3bDKq3bSDJ4e0e-YJ5MXCI.css?bu=B68CP54ChwFZWbkC&or=w
unknown
—
5.88 Kb
—
7052
3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe
GET
200
103.146.158.221:80
http://sta.alie3ksgee.com/xxxxxxxx.jpg
unknown
—
—
unknown
6236
3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe
GET
200
103.146.158.221:80
http://sta.alie3ksgee.com/xxxxxxxx.jpg
unknown
—
—
unknown
—
—
GET
200
95.100.146.35:443
https://r.bing.com/rb/3J/ortl,cc,nc/4-xJy3tX6bM2BGl5zKioiEcQ1TU.css?bu=A4gCjAKPAg&or=w
unknown
—
15.5 Kb
—
6236
3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe
GET
200
103.146.158.221:80
http://sta.alie3ksgee.com/aaaaaaaa.jpg
unknown
—
—
unknown
—
—
GET
200
95.100.146.35:443
https://r.bing.com/rb/6t/cir3,ortl,cc,nc/nKv8Dr5AaiEnGKVhQG5dLl1N7PA.css?bu=MbEKqwq3CqsKmwurCqELqwqpC6sKsAurCrYLqwq8C6sKwgurCskKqwrPCqsKwwqrCqsKkgurCt4KqwrkCqsK2AqrCuoK9Ar3CqsKqwqPC_0KqwqDC4YLqwrsC6sKyAurCpoM&or=w
unknown
—
443 Kb
—
—
—
GET
200
95.100.146.34:443
https://r.bing.com/rb/6t/ortl,cc,nc/JmfAIE20nOCyQ3TY7bnLsgT0ICc.css?bu=CYcMqwqMDKsKkAyrCqsKqwqrCg&or=w
unknown
—
428 Kb
—
—
—
GET
200
95.100.146.18:443
https://r.bing.com/rb/6t/ortl,cc,nc/QNBBNqWD9F_Blep-UqQSqnMp-FI.css?bu=AasK&or=w
unknown
—
6 b
—
4680
SearchApp.exe
GET
200
95.100.146.8:443
https://r.bing.com/rp/1Sd5265G8OlnRColAI8O_SxSQ1Q.br.js
unknown
text
123 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
1324
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
184.86.251.27:443
—
Akamai International B.V.
DE
unknown
5140
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3396
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4680
SearchApp.exe
184.86.251.9:443
—
Akamai International B.V.
DE
unknown
7052
3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe
103.146.158.221:80
sta.alie3ksgee.com
YISU CLOUD LTD
HK
unknown
5456
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
sta.alie3ksgee.com
  • 103.146.158.221
unknown
login.live.com
  • 40.126.31.67
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.71
  • 20.190.159.4
  • 20.190.159.64
  • 20.190.159.75
  • 40.126.31.71
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 23.211.9.92
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
go.microsoft.com
  • 2.19.246.123
whitelisted
cl.alie3ksgff.com
  • 149.28.212.217
unknown
myxqbh.top
  • 182.108.14.161
unknown

Threats

PID
Process
Class
Message
7052
3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.exe
A Network Trojan was detected
SUSPICIOUS [ANY.RUN] Suspicious User Agent HTTPREAD
—
—
A Network Trojan was detected
PAYLOAD [ANY.RUN] Win32/Fabookie Jpeg Embeded Payload
—
—
A Network Trojan was detected
SUSPICIOUS [ANY.RUN] Suspicious User Agent HTTPREAD
—
—
A Network Trojan was detected
PAYLOAD [ANY.RUN] Win32/Fabookie Jpeg Embeded Payload
2184
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.bin.zip