File name:

11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72

Full analysis: https://app.any.run/tasks/1fd60877-71c4-4856-80e5-dcc41977250b
Verdict: Malicious activity
Analysis date: May 09, 2025, 23:29:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

F3DFD75498F2298BD9B31F2BF10DB93C

SHA1:

D8A406D1F4E8671B7D13A8733BE2B89D3171000B

SHA256:

11549C2555997F9F8701311CBA99125BCFA3D12608DBC8F1A9E7B87A5EE2BD72

SSDEEP:

49152:CasTVnWhlzoPNWagabWJ58dHB25IrWwgLxG9tHUn7B1B3L/n7YHGiEdcJVaCLJnS:fxoPEjayah25IK/sTHUFXjCL6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • Application launched itself

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • Reads security settings of Internet Explorer

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

    • The process creates files with name similar to system file names

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

  • INFO

    • Create files in a temporary directory

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • Checks supported languages

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)
      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • The sample compiled with english language support

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • Reads the computer name

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

    • Reads the machine GUID from the registry

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

    • Creates files or folders in the user directory

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

    • Checks proxy server information

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

    • Reads the software policy settings

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)
      • slui.exe (PID: 7280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:07:25 00:55:41+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 118272
UninitializedDataSize: 1024
EntryPoint: 0x30d9
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.3.0.0
ProductVersionNumber: 3.3.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: nonstudent overspringninger
CompanyName: misfiling
FileDescription: halvaksernes
FileVersion: 3.3.0.0
InternalName: uniflorous.exe
LegalTrademarks: indvarslede brdskrifters daimioate
ProductVersion: 3.3.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
5
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe sppextcomobj.exe no specs slui.exe 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7172"C:\Users\admin\AppData\Local\Temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe" C:\Users\admin\AppData\Local\Temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
explorer.exe
User:
admin
Company:
misfiling
Integrity Level:
MEDIUM
Description:
halvaksernes
Exit code:
0
Version:
3.3.0.0
Modules
Images
c:\users\admin\appdata\local\temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7248C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7280"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7300"C:\Users\admin\AppData\Local\Temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe" C:\Users\admin\AppData\Local\Temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
User:
admin
Company:
misfiling
Integrity Level:
MEDIUM
Description:
halvaksernes
Exit code:
0
Version:
3.3.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
8104C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 374
Read events
1 374
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
13
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\Badevrelsers.imp —
MD5:—
SHA256:—
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\Juleaftnens.Fesbinary
MD5:A58A55043A77356547AD2E44E086753B
SHA256:9E762D00B83CF52B7C712DBBDA473F221DCE20847A96457C1CE4EBE45F48B47F
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\Reformvenlige\jinricksha.optbinary
MD5:911ECE7EB0F37D98B451FE870345548C
SHA256:D4EF916C46A943E767F6452FF1BC5E6C4CE538DA505CB0212274D3ABFC42DC0B
730011549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:C5052223B0D2EB1F309CFAF7A480785D
SHA256:49B0D4EFE4140E454873066A729DB71AA8D1BFBC938E838B32483DBEFAF15EE0
730011549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\Reformvenlige\Sengebordet\svigagtig.valbinary
MD5:E2D91A5A0BFEECFB36E575BEA8E819B6
SHA256:9A868E05E2149D8D8C557E9069E0D24AE2F2772A7964DF8B5DB6E0D8F71C56E9
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\Reformvenlige\Sengebordet\videobaandoptageren.senbinary
MD5:4E20466A2E3331CBF104CA19BDF75A42
SHA256:8C1956D0850C367B9F5FD86DC70E57705ABD7718E5F0915DFC20A2379B056879
730011549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\AppData\Local\Temp\Setup.initext
MD5:08CA75DA54EB4810D18796C97F510A55
SHA256:E628D2EE9FE054256B42FFDEC449254437949DEB45B13354D515579CE3E0618E
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\Reformvenlige\Sengebordet\skndselsgerningernes.txttext
MD5:95ED6F195FF187A0E20ED34B2E683929
SHA256:6EACAEB9D244617B8FE5ADA2448B142B02AB4F57E4A69EEE261AE51169CFC79B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
23
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
GET
200
142.250.184.227:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
GET
200
142.250.184.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEA85wFTvuwmlCdtY0UxEIqg%3D
unknown
—
—
whitelisted
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
GET
200
142.250.184.227:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.177:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7940
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7940
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
GET
200
142.250.184.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEH0th7t%2BrhK7Cmbia6iF80g%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5404
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.177:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
142.250.185.238:443
drive.google.com
GOOGLE
US
whitelisted
6544
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
142.250.184.227:80
c.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.177
  • 23.48.23.169
  • 23.48.23.138
  • 23.48.23.164
  • 23.48.23.158
  • 23.48.23.141
  • 23.48.23.162
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
drive.google.com
  • 142.250.185.238
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.3
  • 20.190.160.4
  • 20.190.160.17
  • 40.126.32.72
  • 20.190.160.64
  • 40.126.32.76
  • 40.126.32.140
whitelisted
c.pki.goog
  • 142.250.184.227
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
o.pki.goog
  • 142.250.184.195
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72