File name:

PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com.rar

Full analysis: https://app.any.run/tasks/0ff6fa0a-db0e-4f07-9ebb-ccba1be45e6e
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: August 21, 2023, 07:52:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
formbook
stealer
spyware
UxCryptor
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

98717B0D79181A089B66C2825C6D13A2

SHA1:

547E945C1002F68ABB9C8AB76226368D0B18BCF6

SHA256:

FDC37AD631D8A06B8926097C9345565229F92F098CC8DA11B257689A00EBC6E2

SSDEEP:

196608:HhDX7zHdJiIsNxJ+cbfL8YjbbQ8BBy3hMm:HRXHdJBs7J/zL8efQEBIMm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Changes powershell execution policy (RemoteSigned)

      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 3984)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • mshta.exe (PID: 4052)
      • powershell.exe (PID: 1680)
      • mshta.exe (PID: 1028)
      • powershell.exe (PID: 3440)
      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Reads Microsoft Outlook installation path

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Reads Internet Explorer settings

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 4052)
      • mshta.exe (PID: 1028)

    • Executing commands from a ".bat" file

      • mshta.exe (PID: 4052)
      • mshta.exe (PID: 1028)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 3984)

    • The process executes Powershell scripts

      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 3984)

    • Powershell version downgrade attack

      • powershell.exe (PID: 1680)
      • powershell.exe (PID: 3440)

    • Reads security settings of Internet Explorer

      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Checks Windows Trust Settings

      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Reads settings of System Certificates

      • Creative_Cloud_Set-Up.exe (PID: 2032)

  • INFO

    • Checks supported languages

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • mode.com (PID: 2664)
      • mode.com (PID: 2684)
      • Creative_Cloud_Set-Up.exe (PID: 2032)
      • mode.com (PID: 2736)
      • mode.com (PID: 2740)

    • Manual execution by a user

      • explorer.exe (PID: 2384)
      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • cmd.exe (PID: 2600)
      • Creative_Cloud_Set-Up.exe (PID: 2032)
      • notepad.exe (PID: 3256)
      • cmd.exe (PID: 720)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3488)

    • Reads CPU info

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Reads the computer name

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Creates files or folders in the user directory

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Create files in a temporary directory

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Reads the machine GUID from the registry

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Checks proxy server information

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • mshta.exe (PID: 4052)
      • mshta.exe (PID: 1028)
      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Process checks are UAC notifies on

      • Creative_Cloud_Set-Up.exe (PID: 2080)
      • Creative_Cloud_Set-Up.exe (PID: 2032)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 4052)
      • mshta.exe (PID: 1028)

    • The process uses the downloaded file

      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 3984)
      • powershell.exe (PID: 1680)
      • powershell.exe (PID: 3440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
25
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe explorer.exe no specs creative_cloud_set-up.exe cmd.exe no specs mode.com no specs net.exe no specs net1.exe no specs mshta.exe no specs cmd.exe mode.com no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe no specs mode.com no specs net.exe no specs net1.exe no specs mshta.exe no specs cmd.exe mode.com no specs net.exe no specs net1.exe no specs powershell.exe no specs notepad.exe no specs creative_cloud_set-up.exe

Process information

PID
CMD
Path
Indicators
Parent process
720C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\3. Utilities\bypass payment\Patch.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
980net session C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\net.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
1028mshta vbscript:CreateObject("Shell.Application").ShellExecute("cmd","/c C:\Users\admin\AppData\Local\Temp\PHOTOS~1.COM\37966~1.UTI\BYPASS~1\Patch.bat ::","","runas",1)(window.close)C:\Windows\System32\mshta.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\mshta.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1048C:\Windows\system32\net1 session C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
1208net session C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\net.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
1528net session C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\net.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
1680powershell -ExecutionPolicy RemoteSigned -File .\portable.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2032"C:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\1. Creative_Cloud_Set-Up\Creative_Cloud_Set-Up.exe" C:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\1. Creative_Cloud_Set-Up\Creative_Cloud_Set-Up.exe
explorer.exe
User:
admin
Company:
Adobe Inc.
Integrity Level:
MEDIUM
Description:
Adobe Installer
Exit code:
0
Version:
2.11.0.30
Modules
Images
c:\users\admin\appdata\local\temp\photoshopbeta24.7activatoraigenerativefill_downloadpirate.com\1. creative_cloud_set-up\creative_cloud_set-up.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2080"C:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\1. Creative_Cloud_Set-Up\Creative_Cloud_Set-Up.exe" C:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\1. Creative_Cloud_Set-Up\Creative_Cloud_Set-Up.exe
explorer.exe
User:
admin
Company:
Adobe Inc.
Integrity Level:
MEDIUM
Description:
Adobe Installer
Exit code:
0
Version:
2.11.0.30
Modules
Images
c:\users\admin\appdata\local\temp\photoshopbeta24.7activatoraigenerativefill_downloadpirate.com\1. creative_cloud_set-up\creative_cloud_set-up.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2384"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\sechost.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
Total events
9 391
Read events
9 163
Write events
228
Delete events
0

Modification events

(PID) Process:(3488) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
6
Suspicious files
25
Text files
32
Unknown types
4

Dropped files

PID
Process
Filename
Type
3488WinRAR.exeC:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\2. CCStopper_v1.2.2-hotfix.1\scripts\Functions.ps1text
MD5:BF4369A88EF0580936630DDBEB9758CB
SHA256:497A25B71D74DEFCBB41E5F40627F4839208730892C732C068793E5679D1B838
3488WinRAR.exeC:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\3. Utilities\bypass payment\readme.txttext
MD5:E5FA616E8F245AA019E30F9F948E55B6
SHA256:0E6C836D4ABFF6C50C7362CB4E885F4EB10210017B451A2C243A94D11B67D421
3488WinRAR.exeC:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\2. CCStopper_v1.2.2-hotfix.1\scripts\FirewallBlock.ps1text
MD5:E5A8737939EC235AA748D9172E758833
SHA256:49320F6F67EAEA3929184F43B6143BC823C4C5042E94026EFCE6071F8AB48036
3488WinRAR.exeC:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\2. CCStopper_v1.2.2-hotfix.1\scripts\data\Hosts.txttext
MD5:6BE047F740B1CA759AE1E726D5B44E9B
SHA256:A893361F81FC8ACB26ECBB819D474F2A51009BCC6BE5DD6F444697F20403D7B2
3488WinRAR.exeC:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\3. Utilities\bypass payment\Resource\import.ps1text
MD5:DFEA6576CCC0FC7E2BAC188EF68E612A
SHA256:12E9A9B1B6F6720E4A0BCB7F8D8D5FE605AFFBD2A56BC6552A96BB29F4439F49
3488WinRAR.exeC:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\2. CCStopper_v1.2.2-hotfix.1\scripts\HostBlock.ps1text
MD5:838F6831A5C48880D1ABF67D8EFF0340
SHA256:FACA2A0503B830F1FA8918362568DD4E455364F6C820B5BC430B6A5EC4311015
3488WinRAR.exeC:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\2. CCStopper_v1.2.2-hotfix.1\scripts\HideCCFolder.ps1text
MD5:221EFC3DA59530B5D56EE12AF6EB7874
SHA256:E6764CE9FFB789E724FCACC9A8851629D5ADAE5C1BC8BC110D2AA4E747F8F768
3488WinRAR.exeC:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\3. Utilities\bypass payment\Patch.battext
MD5:17242BB383F1F5A2362A0BECD66A591D
SHA256:C574D4BA81A60BCCF241530040A3015CEBF55A3724B92B5472288FB15813C02C
3488WinRAR.exeC:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\2. CCStopper_v1.2.2-hotfix.1\scripts\RemoveAGS.ps1text
MD5:D6531922C8057CAC8215AD38957D7297
SHA256:E3399022827DB98D488485C8784A5B002B90B4D756ECA6C6E5BF965B8826AF96
3488WinRAR.exeC:\Users\admin\AppData\Local\Temp\PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com\1. Creative_Cloud_Set-Up\Creative_Cloud_Set-Up.exeexecutable
MD5:437249E32FCAF018309F414123521C11
SHA256:3E7D2B8FCE92ADC1769B6A5F2E47F88DDE663361AA4A13132B043E91750FAB71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
15
DNS requests
11
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2032
Creative_Cloud_Set-Up.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/DigiCertGlobalRootG2.crl
US
binary
1.10 Kb
whitelisted
2032
Creative_Cloud_Set-Up.exe
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e74d6e88368726d2
DE
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2080
Creative_Cloud_Set-Up.exe
13.32.99.117:443
client.messaging.adobe.com
AMAZON-02
US
suspicious
2080
Creative_Cloud_Set-Up.exe
13.32.99.120:443
client.messaging.adobe.com
AMAZON-02
US
suspicious
2032
Creative_Cloud_Set-Up.exe
13.32.99.117:443
client.messaging.adobe.com
AMAZON-02
US
suspicious
2032
Creative_Cloud_Set-Up.exe
178.79.242.128:80
ctldl.windowsupdate.com
LLNW
DE
malicious
2032
Creative_Cloud_Set-Up.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2032
Creative_Cloud_Set-Up.exe
178.79.242.0:80
ctldl.windowsupdate.com
LLNW
DE
whitelisted
2080
Creative_Cloud_Set-Up.exe
54.74.179.44:443
cc-api-data.adobe.io
AMAZON-02
IE
suspicious
2080
Creative_Cloud_Set-Up.exe
3.248.26.100:443
cc-api-data.adobe.io
AMAZON-02
IE
suspicious
2032
Creative_Cloud_Set-Up.exe
54.77.72.255:443
cc-api-data.adobe.io
AMAZON-02
IE
suspicious

DNS requests

Domain
IP
Reputation
client.messaging.adobe.com
  • 13.32.99.117
  • 13.32.99.120
  • 13.32.99.32
  • 13.32.99.75
whitelisted
cc-api-data.adobe.io
  • 54.74.179.44
  • 3.248.26.100
  • 54.77.72.255
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
ctldl.windowsupdate.com
  • 178.79.242.128
  • 178.79.242.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl3.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
—
—
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PhotoshopBeta24.7ActivatorAIGenerativeFill_DownloadPirate.com.rar