File name:

11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72

Full analysis: https://app.any.run/tasks/1fd60877-71c4-4856-80e5-dcc41977250b
Verdict: Malicious activity
Analysis date: May 09, 2025, 23:29:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

F3DFD75498F2298BD9B31F2BF10DB93C

SHA1:

D8A406D1F4E8671B7D13A8733BE2B89D3171000B

SHA256:

11549C2555997F9F8701311CBA99125BCFA3D12608DBC8F1A9E7B87A5EE2BD72

SSDEEP:

49152:CasTVnWhlzoPNWagabWJ58dHB25IrWwgLxG9tHUn7B1B3L/n7YHGiEdcJVaCLJnS:fxoPEjayah25IK/sTHUFXjCL6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • Executable content was dropped or overwritten

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • Application launched itself

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • Reads security settings of Internet Explorer

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

  • INFO

    • Create files in a temporary directory

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • Checks supported languages

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)
      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

    • The sample compiled with english language support

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7172)

    • Reads the computer name

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

    • Checks proxy server information

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

    • Reads the machine GUID from the registry

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)

    • Reads the software policy settings

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)
      • slui.exe (PID: 7280)

    • Creates files or folders in the user directory

      • 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe (PID: 7300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:07:25 00:55:41+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 118272
UninitializedDataSize: 1024
EntryPoint: 0x30d9
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.3.0.0
ProductVersionNumber: 3.3.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: nonstudent overspringninger
CompanyName: misfiling
FileDescription: halvaksernes
FileVersion: 3.3.0.0
InternalName: uniflorous.exe
LegalTrademarks: indvarslede brdskrifters daimioate
ProductVersion: 3.3.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
5
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe sppextcomobj.exe no specs slui.exe 11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7172"C:\Users\admin\AppData\Local\Temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe" C:\Users\admin\AppData\Local\Temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
explorer.exe
User:
admin
Company:
misfiling
Integrity Level:
MEDIUM
Description:
halvaksernes
Exit code:
0
Version:
3.3.0.0
Modules
Images
c:\users\admin\appdata\local\temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7248C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7280"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7300"C:\Users\admin\AppData\Local\Temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe" C:\Users\admin\AppData\Local\Temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
User:
admin
Company:
misfiling
Integrity Level:
MEDIUM
Description:
halvaksernes
Exit code:
0
Version:
3.3.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
8104C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 374
Read events
1 374
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
13
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\Badevrelsers.imp —
MD5:—
SHA256:—
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\Reformvenlige\Sengebordet\skndselsgerningernes.txttext
MD5:95ED6F195FF187A0E20ED34B2E683929
SHA256:6EACAEB9D244617B8FE5ADA2448B142B02AB4F57E4A69EEE261AE51169CFC79B
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\genbrugsanlggenes.jpgimage
MD5:389A9AFE982F15E69A83A891C571E09E
SHA256:DF6A9E9DB4D035A5F6EFDE677F04D450BDD4185F5052C1FFA08E446102D11F3A
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\AppData\Local\Temp\Setup.initext
MD5:08CA75DA54EB4810D18796C97F510A55
SHA256:E628D2EE9FE054256B42FFDEC449254437949DEB45B13354D515579CE3E0618E
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\AppData\Local\Temp\nscBB35.tmp\System.dllexecutable
MD5:2AE993A2FFEC0C137EB51C8832691BCB
SHA256:681382F3134DE5C6272A49DD13651C8C201B89C247B471191496E7335702FA59
730011549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
730011549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4D9F3BF05A4A27CF9A3E6282AE396A1F
SHA256:E6CB44884823879A461A9DE1E7B165B4913BEFB2E0049D514CFA7E2CDB0069BA
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\Chondrocarcinoma.Flabinary
MD5:039226C034C69CFF3A8F759E98620785
SHA256:73B4C859D04E90D04A8EFAC5FA675CA9C785EFFACA5DB63BA13805EE78FA4223
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\Juleaftnens.Fesbinary
MD5:A58A55043A77356547AD2E44E086753B
SHA256:9E762D00B83CF52B7C712DBBDA473F221DCE20847A96457C1CE4EBE45F48B47F
717211549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exeC:\Users\admin\lapperierne\Loyalizes\Reformvenlige\jinricksha.optbinary
MD5:911ECE7EB0F37D98B451FE870345548C
SHA256:D4EF916C46A943E767F6452FF1BC5E6C4CE538DA505CB0212274D3ABFC42DC0B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
23
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.177:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
GET
200
142.250.184.227:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
GET
200
142.250.184.227:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
GET
200
142.250.184.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEA85wFTvuwmlCdtY0UxEIqg%3D
unknown
—
—
whitelisted
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
GET
200
142.250.184.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEH0th7t%2BrhK7Cmbia6iF80g%3D
unknown
—
—
whitelisted
7940
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7940
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5404
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.177:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
142.250.185.238:443
drive.google.com
GOOGLE
US
whitelisted
6544
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7300
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72.exe
142.250.184.227:80
c.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.177
  • 23.48.23.169
  • 23.48.23.138
  • 23.48.23.164
  • 23.48.23.158
  • 23.48.23.141
  • 23.48.23.162
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
drive.google.com
  • 142.250.185.238
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.3
  • 20.190.160.4
  • 20.190.160.17
  • 40.126.32.72
  • 20.190.160.64
  • 40.126.32.76
  • 40.126.32.140
whitelisted
c.pki.goog
  • 142.250.184.227
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
o.pki.goog
  • 142.250.184.195
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
11549c2555997f9f8701311cba99125bcfa3d12608dbc8f1a9e7b87a5ee2bd72