download:

bbflbk5.exe

Full analysis: https://app.any.run/tasks/eec03cce-a968-4208-bc5a-381b52c1520b
Verdict: Malicious activity
Analysis date: February 21, 2020, 20:16:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

A248D3B13E3CE03D9619F4B18762B5E6

SHA1:

029D03F381862F0A7944E9E890D794AE9A0D34B1

SHA256:

FF546D3339BD56676C8A21A80D60136FA41AD046FADE665932C94DA0F5BE67F4

SSDEEP:

393216:06ARBUkMvOFEDHLY/dQrrI1a6rH92vsZ0SiURihZFVe2UGESc3mpFyFKyrfvP18Y:0xRBTbF0rY+Q1atLKyWF5b3mpWK61dmq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • bbflbk5.exe (PID: 2220)
      • FlashBack Recorder.exe (PID: 2628)
      • DefConfig.exe (PID: 2536)
      • DefConfig.exe (PID: 2112)
      • DefConfig.exe (PID: 3444)
      • FlashBack Player.exe (PID: 3816)

    • Application was dropped or rewritten from another process

      • FlashBack Recorder.exe (PID: 2628)
      • DefConfig.exe (PID: 2536)
      • DefConfig.exe (PID: 2112)
      • ns1AB2.tmp (PID: 1944)
      • ns1EAC.tmp (PID: 3224)
      • ns1B9E.tmp (PID: 2244)
      • FlashBack Player.exe (PID: 3816)
      • DefConfig.exe (PID: 3444)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • bbflbk5.exe (PID: 2220)

    • Creates a software uninstall entry

      • bbflbk5.exe (PID: 2220)

    • Modifies the open verb of a shell class

      • bbflbk5.exe (PID: 2220)

    • Creates files in the user directory

      • DefConfig.exe (PID: 2536)
      • bbflbk5.exe (PID: 2220)
      • DefConfig.exe (PID: 3444)
      • FlashBack Recorder.exe (PID: 2628)
      • FlashBack Player.exe (PID: 3816)
      • DefConfig.exe (PID: 2112)

    • Creates files in the program directory

      • FlashBack Recorder.exe (PID: 2628)
      • DefConfig.exe (PID: 3444)
      • bbflbk5.exe (PID: 2220)

    • Reads Internet Cache Settings

      • FlashBack Recorder.exe (PID: 2628)
      • FlashBack Player.exe (PID: 3816)

    • Starts application with an unusual extension

      • bbflbk5.exe (PID: 2220)

    • Creates COM task schedule object

      • bbflbk5.exe (PID: 2220)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • bbflbk5.exe (PID: 2220)

    • Manual execution by user

      • FlashBack Player.exe (PID: 3816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 23:27:32+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 28160
InitializedDataSize: 152576
UninitializedDataSize: 2048
EntryPoint: 0x3927
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.42.0.4556
ProductVersionNumber: 5.42.0.4556
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Blueberry Software (UK) Ltd.
CompanyWebsite: http://www.bbflashback.com/
FileDescription: -
FileVersion: 5.42.0.4556
LegalCopyright: -
ProductName: FlashBack Pro 5
ProductVersion: 5.42.0.4556

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Dec-2018 22:27:32
Detected languages:
  • English - United States
CompanyName: Blueberry Software (UK) Ltd.
CompanyWebsite: http://www.bbflashback.com/
FileDescription: -
FileVersion: 5.42.0.4556
LegalCopyright: -
ProductName: FlashBack Pro 5
ProductVersion: 5.42.0.4556

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 15-Dec-2018 22:27:32
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006C0B
0x00006E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.42225
.rdata
0x00008000
0x000013EA
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.21633
.data
0x0000A000
0x00022CF8
0x00001800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.56705
.ndata
0x0002D000
0x00039000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00066000
0x00008E20
0x00009000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.46528

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28794
1070
UNKNOWN
English - United States
RT_MANIFEST
2
4.70165
9640
UNKNOWN
English - United States
RT_ICON
3
3.26807
4264
UNKNOWN
English - United States
RT_ICON
4
4.47002
1384
UNKNOWN
English - United States
RT_ICON
5
4.48066
1128
UNKNOWN
English - United States
RT_ICON
6
4.87093
872
UNKNOWN
English - United States
RT_ICON
103
2.66969
90
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG
107
2.52183
160
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
10
Malicious processes
3
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start start bbflbk5.exe ns1ab2.tmp no specs defconfig.exe no specs ns1b9e.tmp no specs defconfig.exe no specs ns1eac.tmp no specs defconfig.exe no specs flashback recorder.exe flashback player.exe no specs bbflbk5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1944"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1AB2.tmp" C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe -add "File Copy" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\FileCopyPublisher.dll" "FlashBack5"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1AB2.tmp—bbflbk5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nso8fa8.tmp\ns1ab2.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2112"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe" -add "YouTube" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\YouTubePublisher.dll" "FlashBack5"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe—ns1EAC.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\blueberry software\flashback pro 5\uploadprofiles\defconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2220"C:\Users\admin\Desktop\bbflbk5.exe" C:\Users\admin\Desktop\bbflbk5.exe
explorer.exe
User:
admin
Company:
Blueberry Software (UK) Ltd.
Integrity Level:
HIGH
Exit code:
0
Version:
5.42.0.4556
Modules
Images
c:\users\admin\desktop\bbflbk5.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2244"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1B9E.tmp" C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe -add "FTP" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\FtpPublisher.dll" "FlashBack5"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1B9E.tmp—bbflbk5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nso8fa8.tmp\ns1b9e.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2536"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe" -add "FTP" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\FtpPublisher.dll" "FlashBack5"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe—ns1B9E.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\blueberry software\flashback pro 5\uploadprofiles\defconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2628"C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Recorder.exe" C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Recorder.exe
bbflbk5.exe
User:
admin
Company:
Blueberry Consultants Ltd.
Integrity Level:
HIGH
Description:
FlashBack Pro 5 Recorder
Exit code:
0
Version:
5.42.0.4556
Modules
Images
c:\program files\blueberry software\flashback pro 5\flashback recorder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\blueberry software\flashback pro 5\rtl260.bpl
c:\windows\system32\mpr.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3224"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1EAC.tmp" C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe -add "YouTube" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\YouTubePublisher.dll" "FlashBack5"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1EAC.tmp—bbflbk5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nso8fa8.tmp\ns1eac.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3444"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe" -add "File Copy" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\FileCopyPublisher.dll" "FlashBack5"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe—ns1AB2.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\blueberry software\flashback pro 5\uploadprofiles\defconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3816"C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Player.exe" C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Player.exe—explorer.exe
User:
admin
Company:
Blueberry Consultants Ltd.
Integrity Level:
MEDIUM
Description:
FlashBack Pro 5 Player
Exit code:
0
Version:
5.42.0.4556
Modules
Images
c:\program files\blueberry software\flashback pro 5\flashback player.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\blueberry software\flashback pro 5\rtl260.bpl
c:\windows\system32\mpr.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3956"C:\Users\admin\Desktop\bbflbk5.exe" C:\Users\admin\Desktop\bbflbk5.exe—explorer.exe
User:
admin
Company:
Blueberry Software (UK) Ltd.
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
5.42.0.4556
Modules
Images
c:\users\admin\desktop\bbflbk5.exe
c:\systemroot\system32\ntdll.dll
Total events
573
Read events
321
Write events
252
Delete events
0

Modification events

(PID) Process:(2220) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Blueberry Software\FlashBack Pro 5\Components
Operation:writeName:PreInstall
Value:
1
(PID) Process:(2220) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{811F7815-CA60-44f0-8116-36EBEC978693}
Operation:writeName:
Value:
FBPLAYERAPI
(PID) Process:(2220) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\FBPLAYERAPI.DLL
Operation:writeName:AppID
Value:
{811F7815-CA60-44f0-8116-36EBEC978693}
(PID) Process:(2220) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FBPLAYERAPI.FBPLAYERAPI.1
Operation:writeName:
Value:
CFBPLAYERAPI Object
(PID) Process:(2220) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FBPLAYERAPI.FBPLAYERAPI.1\CLSID
Operation:writeName:
Value:
{9011568A-520F-40c3-81B7-19F1755B12D2}
(PID) Process:(2220) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FBPLAYERAPI.FBPLAYERAPI
Operation:writeName:
Value:
CFBPLAYERAPI Object
(PID) Process:(2220) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FBPLAYERAPI.FBPLAYERAPI\CLSID
Operation:writeName:
Value:
{9011568A-520F-40c3-81B7-19F1755B12D2}
(PID) Process:(2220) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FBPLAYERAPI.FBPLAYERAPI\CurVer
Operation:writeName:
Value:
FBPLAYERAPI.FBPLAYERAPI.1
(PID) Process:(2220) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9011568A-520F-40c3-81B7-19F1755B12D2}
Operation:writeName:
Value:
CFBPLAYERAPI Object
(PID) Process:(2220) bbflbk5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9011568A-520F-40c3-81B7-19F1755B12D2}\ProgID
Operation:writeName:
Value:
FBPLAYERAPI.FBPLAYERAPI.1
Executable files
86
Suspicious files
5
Text files
125
Unknown types
33

Dropped files

PID
Process
Filename
Type
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\UserInfo.dllexecutable
MD5:9EB662F3B5FBDA28BFFE020E0AB40519
SHA256:9AA388C7DE8E96885ADCB4325AF871B470AC50EDB60D4B0D876AD43F5332FFD1
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\spltmp.bmpimage
MD5:773A9A6E0A41F2F7BEFDADFC49BB03C9
SHA256:75F9D45676036C8E7F2373B64C1B13DBD2865E1311DED0040DA3DF8CAC5080B2
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\advsplash.dllexecutable
MD5:0BC74B02DD858ABAD27F4C86DC72FE2F
SHA256:4EF1281CF084598B059D4B6E369E9DB820D7E9341A9F1A194556E6C345D1B0B6
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\nsDialogs.dllexecutable
MD5:466179E1C8EE8A1FF5E4427DBB6C4A01
SHA256:1E40211AF65923C2F4FD02CE021458A7745D28E2F383835E3015E96575632172
2220bbflbk5.exeC:\Program Files\Blueberry Software\FlashBack Pro 5\bcbie260.bplexecutable
MD5:DB388F32B782F86FB24835837906216D
SHA256:3C5F469163285C3DC9C468DFDBF854112B16A6495BA6230C73885165D5F5A883
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\InstallOptions.dllexecutable
MD5:05BF02DA51E717F79F6B5CBEA7BC0710
SHA256:CA092BA7F275B0C9000098CDD1A9876FE8DC050FCB40A0E8A1AB8335236E9DC5
2220bbflbk5.exeC:\Program Files\Blueberry Software\FlashBack Pro 5\cc32260mt.dllexecutable
MD5:E3CD31F8220C39A34C3592DCBE66939C
SHA256:B9E1F7468804F0B4AD99C2DF42571CAE69A72897F95DF073A623D13A9255619C
2220bbflbk5.exeC:\Program Files\Blueberry Software\FlashBack Pro 5\soaprtl260.bplexecutable
MD5:7A5E310B561402FF7A2F38A6ECDC98AA
SHA256:A2D7BA4E8A04CB42213D6E3D5224DC974B5D96BF92E0F80F1E9D383229411B7B
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2628
FlashBack Recorder.exe
POST
200
104.27.151.13:80
http://regsys.ws.bbsoftware.co.uk/regsys.svc
US
text
2.21 Kb
malicious
2628
FlashBack Recorder.exe
POST
200
54.171.208.68:80
http://stats.ws.bbsoftware.co.uk/stats.asmx
IE
xml
399 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2628
FlashBack Recorder.exe
104.27.151.13:80
regsys.ws.bbsoftware.co.uk
Cloudflare Inc
US
shared
2628
FlashBack Recorder.exe
54.171.208.68:80
stats.ws.bbsoftware.co.uk
Amazon.com, Inc.
IE
suspicious

DNS requests

Domain
IP
Reputation
regsys.ws.bbsoftware.co.uk
  • 104.27.151.13
  • 104.27.150.13
malicious
stats.ws.bbsoftware.co.uk
  • 54.171.208.68
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bbflbk5.exe