download:

bbflbk5.exe

Full analysis: https://app.any.run/tasks/abe39f97-933b-4b16-b181-1325b022bb13
Verdict: Malicious activity
Analysis date: March 18, 2020, 22:30:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

A248D3B13E3CE03D9619F4B18762B5E6

SHA1:

029D03F381862F0A7944E9E890D794AE9A0D34B1

SHA256:

FF546D3339BD56676C8A21A80D60136FA41AD046FADE665932C94DA0F5BE67F4

SSDEEP:

393216:06ARBUkMvOFEDHLY/dQrrI1a6rH92vsZ0SiURihZFVe2UGESc3mpFyFKyrfvP18Y:0xRBTbF0rY+Q1atLKyWF5b3mpWK61dmq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • bbflbk5.exe (PID: 2076)
      • DefConfig.exe (PID: 3056)
      • DefConfig.exe (PID: 3084)
      • DefConfig.exe (PID: 3252)
      • FlashBack Recorder.exe (PID: 3028)
      • FTSUploadAgent.exe (PID: 1748)
      • FlashBack Player.exe (PID: 2804)
      • FTSUploadAgent.exe (PID: 3748)

    • Application was dropped or rewritten from another process

      • DefConfig.exe (PID: 3084)
      • DefConfig.exe (PID: 3252)
      • DefConfig.exe (PID: 3056)
      • FlashBack Recorder.exe (PID: 3028)
      • nsE664.tmp (PID: 2780)
      • nsE8B7.tmp (PID: 3168)
      • nsE74F.tmp (PID: 2884)
      • RecorderChecker.exe (PID: 3708)
      • FlashBack Player.exe (PID: 2804)
      • FTSUploadAgent.exe (PID: 1748)
      • FTSUploadAgent.exe (PID: 3748)

  • SUSPICIOUS

    • Creates COM task schedule object

      • bbflbk5.exe (PID: 2076)

    • Creates files in the user directory

      • bbflbk5.exe (PID: 2076)
      • DefConfig.exe (PID: 3252)
      • DefConfig.exe (PID: 3056)
      • DefConfig.exe (PID: 3084)
      • FlashBack Recorder.exe (PID: 3028)
      • FTSUploadAgent.exe (PID: 3748)
      • FlashBack Player.exe (PID: 2804)

    • Starts application with an unusual extension

      • bbflbk5.exe (PID: 2076)

    • Modifies the open verb of a shell class

      • bbflbk5.exe (PID: 2076)

    • Creates a software uninstall entry

      • bbflbk5.exe (PID: 2076)

    • Creates files in the program directory

      • DefConfig.exe (PID: 3084)
      • FlashBack Recorder.exe (PID: 3028)
      • FlashBack Player.exe (PID: 2804)
      • bbflbk5.exe (PID: 2076)

    • Reads Internet Cache Settings

      • FlashBack Recorder.exe (PID: 3028)
      • FlashBack Player.exe (PID: 2804)

    • Executable content was dropped or overwritten

      • bbflbk5.exe (PID: 2076)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • bbflbk5.exe (PID: 2076)

    • Manual execution by user

      • FlashBack Recorder.exe (PID: 3028)
      • FlashBack Player.exe (PID: 2804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 23:27:32+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 28160
InitializedDataSize: 152576
UninitializedDataSize: 2048
EntryPoint: 0x3927
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.42.0.4556
ProductVersionNumber: 5.42.0.4556
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Blueberry Software (UK) Ltd.
CompanyWebsite: http://www.bbflashback.com/
FileDescription: -
FileVersion: 5.42.0.4556
LegalCopyright: -
ProductName: FlashBack Pro 5
ProductVersion: 5.42.0.4556

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Dec-2018 22:27:32
Detected languages:
  • English - United States
CompanyName: Blueberry Software (UK) Ltd.
CompanyWebsite: http://www.bbflashback.com/
FileDescription: -
FileVersion: 5.42.0.4556
LegalCopyright: -
ProductName: FlashBack Pro 5
ProductVersion: 5.42.0.4556

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 15-Dec-2018 22:27:32
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006C0B
0x00006E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.42225
.rdata
0x00008000
0x000013EA
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.21633
.data
0x0000A000
0x00022CF8
0x00001800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.56705
.ndata
0x0002D000
0x00039000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00066000
0x00008E20
0x00009000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.46528

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28794
1070
UNKNOWN
English - United States
RT_MANIFEST
2
4.70165
9640
UNKNOWN
English - United States
RT_ICON
3
3.26807
4264
UNKNOWN
English - United States
RT_ICON
4
4.47002
1384
UNKNOWN
English - United States
RT_ICON
5
4.48066
1128
UNKNOWN
English - United States
RT_ICON
6
4.87093
872
UNKNOWN
English - United States
RT_ICON
103
2.66969
90
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG
107
2.52183
160
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
13
Malicious processes
6
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start bbflbk5.exe nse664.tmp no specs defconfig.exe no specs nse74f.tmp no specs defconfig.exe no specs nse8b7.tmp no specs defconfig.exe no specs flashback recorder.exe ftsuploadagent.exe no specs recorderchecker.exe no specs flashback player.exe ftsuploadagent.exe no specs bbflbk5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1748"C:\Program Files\Blueberry Software\FlashBack Pro 5\FBO\FTSUploadAgent.exe" /p:bd4 /w:100254C:\Program Files\Blueberry Software\FlashBack Pro 5\FBO\FTSUploadAgent.exe—FlashBack Recorder.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FTSUploadAgent
Exit code:
0
Version:
1.0.0.7
Modules
Images
c:\program files\blueberry software\flashback pro 5\fbo\ftsuploadagent.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2076"C:\Users\admin\AppData\Local\Temp\bbflbk5.exe" C:\Users\admin\AppData\Local\Temp\bbflbk5.exe
explorer.exe
User:
admin
Company:
Blueberry Software (UK) Ltd.
Integrity Level:
HIGH
Exit code:
0
Version:
5.42.0.4556
Modules
Images
c:\users\admin\appdata\local\temp\bbflbk5.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2672"C:\Users\admin\AppData\Local\Temp\bbflbk5.exe" C:\Users\admin\AppData\Local\Temp\bbflbk5.exe—explorer.exe
User:
admin
Company:
Blueberry Software (UK) Ltd.
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
5.42.0.4556
Modules
Images
c:\users\admin\appdata\local\temp\bbflbk5.exe
c:\systemroot\system32\ntdll.dll
2780"C:\Users\admin\AppData\Local\Temp\nsk941C.tmp\nsE664.tmp" C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe -add "File Copy" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\FileCopyPublisher.dll" "FlashBack5"C:\Users\admin\AppData\Local\Temp\nsk941C.tmp\nsE664.tmp—bbflbk5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsk941c.tmp\nse664.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
2804"C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Player.exe" C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Player.exe
explorer.exe
User:
admin
Company:
Blueberry Consultants Ltd.
Integrity Level:
MEDIUM
Description:
FlashBack Pro 5 Player
Exit code:
0
Version:
5.42.0.4556
Modules
Images
c:\program files\blueberry software\flashback pro 5\flashback player.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\blueberry software\flashback pro 5\rtl260.bpl
c:\windows\system32\mpr.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2884"C:\Users\admin\AppData\Local\Temp\nsk941C.tmp\nsE74F.tmp" C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe -add "FTP" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\FtpPublisher.dll" "FlashBack5"C:\Users\admin\AppData\Local\Temp\nsk941C.tmp\nsE74F.tmp—bbflbk5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsk941c.tmp\nse74f.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3028"C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Recorder.exe" C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Recorder.exe
explorer.exe
User:
admin
Company:
Blueberry Consultants Ltd.
Integrity Level:
MEDIUM
Description:
FlashBack Pro 5 Recorder
Exit code:
0
Version:
5.42.0.4556
Modules
Images
c:\program files\blueberry software\flashback pro 5\flashback recorder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\blueberry software\flashback pro 5\rtl260.bpl
c:\windows\system32\mpr.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3056"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe" -add "YouTube" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\YouTubePublisher.dll" "FlashBack5"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe—nsE8B7.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\blueberry software\flashback pro 5\uploadprofiles\defconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3084"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe" -add "File Copy" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\FileCopyPublisher.dll" "FlashBack5"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe—nsE664.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\blueberry software\flashback pro 5\uploadprofiles\defconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3168"C:\Users\admin\AppData\Local\Temp\nsk941C.tmp\nsE8B7.tmp" C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe -add "YouTube" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\YouTubePublisher.dll" "FlashBack5"C:\Users\admin\AppData\Local\Temp\nsk941C.tmp\nsE8B7.tmp—bbflbk5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsk941c.tmp\nse8b7.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 125
Read events
857
Write events
268
Delete events
0

Modification events

(PID) Process:(2076) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Blueberry Software\FlashBack Pro 5\Components
Operation:writeName:PreInstall
Value:
1
(PID) Process:(2076) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{811F7815-CA60-44f0-8116-36EBEC978693}
Operation:writeName:
Value:
FBPLAYERAPI
(PID) Process:(2076) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\FBPLAYERAPI.DLL
Operation:writeName:AppID
Value:
{811F7815-CA60-44f0-8116-36EBEC978693}
(PID) Process:(2076) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FBPLAYERAPI.FBPLAYERAPI.1
Operation:writeName:
Value:
CFBPLAYERAPI Object
(PID) Process:(2076) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FBPLAYERAPI.FBPLAYERAPI.1\CLSID
Operation:writeName:
Value:
{9011568A-520F-40c3-81B7-19F1755B12D2}
(PID) Process:(2076) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FBPLAYERAPI.FBPLAYERAPI
Operation:writeName:
Value:
CFBPLAYERAPI Object
(PID) Process:(2076) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FBPLAYERAPI.FBPLAYERAPI\CLSID
Operation:writeName:
Value:
{9011568A-520F-40c3-81B7-19F1755B12D2}
(PID) Process:(2076) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FBPLAYERAPI.FBPLAYERAPI\CurVer
Operation:writeName:
Value:
FBPLAYERAPI.FBPLAYERAPI.1
(PID) Process:(2076) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9011568A-520F-40c3-81B7-19F1755B12D2}
Operation:writeName:
Value:
CFBPLAYERAPI Object
(PID) Process:(2076) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9011568A-520F-40c3-81B7-19F1755B12D2}\ProgID
Operation:writeName:
Value:
FBPLAYERAPI.FBPLAYERAPI.1
Executable files
85
Suspicious files
19
Text files
140
Unknown types
33

Dropped files

PID
Process
Filename
Type
2076bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nsk941C.tmp\links.initext
MD5:F3FBBFF673BBB0D1EE62FA77BCFBD88E
SHA256:664B69A2C207B89130BA3F934A85E06CB943983DAC2E5622BC5282DE603F1FD8
2076bbflbk5.exeC:\Program Files\Blueberry Software\FlashBack Pro 5\borlndmm.dllexecutable
MD5:F58A883F64B727BCEAB5ED06AA8F3335
SHA256:3BEED8F5DD120B3625210CEBE4E4F2B2DA97B698F73A083E75990089761B08D2
2076bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nsk941C.tmp\Processes.dllexecutable
MD5:40AD58D8DB6DA73489E634AD8BF3858A
SHA256:EFD3745A38A675691E6AAAFCC9CAE16739BCC7E4FCF6054AB6C6F125FF3A342C
2076bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nsk941C.tmp\StartMenu.dllexecutable
MD5:87DDE5538CCC83D54D1FEF0ABC91998D
SHA256:948998C5C1F9BF5CEBFF627BC397A4641ACC23FB9A3D32650DF4EA3D87F68EBB
2076bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nsk941C.tmp\InstallOptions.dllexecutable
MD5:05BF02DA51E717F79F6B5CBEA7BC0710
SHA256:CA092BA7F275B0C9000098CDD1A9876FE8DC050FCB40A0E8A1AB8335236E9DC5
2076bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nsk941C.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
2076bbflbk5.exeC:\Program Files\Blueberry Software\FlashBack Pro 5\inet260.bplexecutable
MD5:7486A77F527EA87C1F7664672C592427
SHA256:1DF1B6FF8C99E62AB8DB60322B96ED1D4D5F6F2D6C10F5B05DB6789663F9F022
2076bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nsk941C.tmp\nsDialogs.dllexecutable
MD5:466179E1C8EE8A1FF5E4427DBB6C4A01
SHA256:1E40211AF65923C2F4FD02CE021458A7745D28E2F383835E3015E96575632172
2076bbflbk5.exeC:\Program Files\Blueberry Software\FlashBack Pro 5\bcbie260.bplexecutable
MD5:DB388F32B782F86FB24835837906216D
SHA256:3C5F469163285C3DC9C468DFDBF854112B16A6495BA6230C73885165D5F5A883
2076bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nsk941C.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
6
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2804
FlashBack Player.exe
POST
200
54.171.208.68:80
http://updates.bbconsult.co.uk/Updates.asmx
IE
xml
512 b
suspicious
3028
FlashBack Recorder.exe
POST
200
54.171.208.68:80
http://stats.ws.bbsoftware.co.uk/stats.asmx
IE
xml
399 b
suspicious
2804
FlashBack Player.exe
POST
200
54.171.208.68:80
http://stats.ws.bbsoftware.co.uk/stats.asmx
IE
xml
399 b
suspicious
2804
FlashBack Player.exe
POST
200
104.27.150.13:80
http://regsys.ws.bbsoftware.co.uk/regsys.svc
US
text
2.19 Kb
malicious
2804
FlashBack Player.exe
POST
200
54.171.208.68:80
http://updates.bbconsult.co.uk/Updates.asmx
IE
xml
428 b
suspicious
2804
FlashBack Player.exe
POST
200
104.27.150.13:80
http://regsys.ws.bbsoftware.co.uk/regsys.svc
US
text
188 b
malicious
3028
FlashBack Recorder.exe
POST
200
54.171.208.68:80
http://updates.bbconsult.co.uk/Updates.asmx
IE
xml
428 b
suspicious
3028
FlashBack Recorder.exe
POST
200
54.171.208.68:80
http://stats.ws.bbsoftware.co.uk/stats.asmx
IE
xml
399 b
suspicious
3028
FlashBack Recorder.exe
POST
200
54.171.208.68:80
http://updates.bbconsult.co.uk/Updates.asmx
IE
xml
512 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3028
FlashBack Recorder.exe
104.27.150.13:80
regsys.ws.bbsoftware.co.uk
Cloudflare Inc
US
shared
2804
FlashBack Player.exe
104.27.150.13:80
regsys.ws.bbsoftware.co.uk
Cloudflare Inc
US
shared
3028
FlashBack Recorder.exe
54.171.208.68:80
stats.ws.bbsoftware.co.uk
Amazon.com, Inc.
IE
suspicious
2804
FlashBack Player.exe
54.171.208.68:80
stats.ws.bbsoftware.co.uk
Amazon.com, Inc.
IE
suspicious

DNS requests

Domain
IP
Reputation
regsys.ws.bbsoftware.co.uk
  • 104.27.150.13
  • 104.27.151.13
malicious
stats.ws.bbsoftware.co.uk
  • 54.171.208.68
suspicious
updates.bbconsult.co.uk
  • 54.171.208.68
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bbflbk5.exe