File name:

1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe

Full analysis: https://app.any.run/tasks/e4d24471-8234-471b-8a1e-b18637a8cfd8
Verdict: Malicious activity
Analysis date: May 07, 2026, 09:01:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
mpress
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections
MD5:

9BB17F1CE277E1ACF38B5B8683D21812

SHA1:

C32B7F0DC34F30C5F766DEA22CF5C21AD8E47FC5

SHA256:

1F40E9CEFFB37D50A0AF6816C82566A2E9D0AFC497ECB03FCDD06F564BFBE718

SSDEEP:

98304:MeB348iBntrO2q/WkzBj3fKVJ3n50mlQVVI4t6uMx91ePjBevF1ErpDwiRneEFKx:wwJf48FCRYrkUP6QzLkhrxNykzkd4Qg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 3416)
      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 4304)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 4304)

    • Executable content was dropped or overwritten

      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 4304)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 6628)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6628)

  • INFO

    • Checks supported languages

      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 4304)

    • The sample compiled with chinese language support

      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 4304)

    • Create files in a temporary directory

      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 4304)

    • Reads the machine GUID from the registry

      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 4304)

    • Reads the computer name

      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 4304)

    • The sample compiled with english language support

      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 4304)

    • JScript runtime error (SCRIPT)

      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 4304)

    • Mpress packer has been detected

      • 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe (PID: 4304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2026:05:05 18:41:02+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 4063232
InitializedDataSize: 30146560
UninitializedDataSize: -
EntryPoint: 0x20e8358
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.4.7
ProductVersionNumber: 1.4.4.7
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 1.4.4.7
FileDescription: Swwp自动化工具，一键安装/清理/激活solidworks,智能识别安装错误并处理
ProductName: Swwp自动化工具
ProductVersion: 1.4.4.7
CompanyName: Swwp
LegalCopyright: 微信关注：swwp自动化工具，获取更多资讯
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start THREAT 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe cmd.exe no specs conhost.exe no specs systeminfo.exe no specs tiworker.exe no specs 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1352\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2116systeminfoC:\Windows\SysWOW64\systeminfo.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Displays system information
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\systeminfo.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3416"C:\Users\admin\Desktop\1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe" C:\Users\admin\Desktop\1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe—explorer.exe
User:
admin
Company:
Swwp
Integrity Level:
MEDIUM
Description:
Swwp自动化工具，一键安装/清理/激活solidworks,智能识别安装错误并处理
Exit code:
3221226540
Version:
1.4.4.7
Modules
Images
c:\users\admin\desktop\1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4304"C:\Users\admin\Desktop\1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe" C:\Users\admin\Desktop\1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe
explorer.exe
User:
admin
Company:
Swwp
Integrity Level:
HIGH
Description:
Swwp自动化工具，一键安装/清理/激活solidworks,智能识别安装错误并处理
Version:
1.4.4.7
Modules
Images
c:\users\admin\desktop\1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
6628 /c systeminfoC:\Windows\SysWOW64\cmd.exe—1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7768C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Exit code:
0
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
Total events
9 058
Read events
9 010
Write events
5
Delete events
43

Modification events

(PID) Process:(4304) 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PackagedCom\ProgIdIndex
Operation:delete keyName:(default)
Value:
(PID) Process:(4304) 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
Operation:delete keyName:(default)
Value:
(PID) Process:(4304) 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wow64\x86\xtajit
Operation:delete keyName:(default)
Value:
(PID) Process:(4304) 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls
Operation:delete keyName:(default)
Value:
(PID) Process:(4304) 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Option
Operation:delete keyName:(default)
Value:
(PID) Process:(4304) 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:delete keyName:(default)
Value:
(PID) Process:(2116) systeminfo.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E
Operation:writeName:@%SystemRoot%\system32\mlang.dll,-4386
Value:
English (United States)
(PID) Process:(4304) 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\LanguageOverlay\OverlayPackages\en-US
Operation:delete keyName:(default)
Value:
(PID) Process:(4304) 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings
Operation:writeName:JITDebug
Value:
0
(PID) Process:(4304) 1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
37180E0000000000
Executable files
7
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7768TiWorker.exeC:\Windows\Logs\CBS\CBS.log —
MD5:—
SHA256:—
43041f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeC:\TEMP\7z\7z.dllexecutable
MD5:4165A1EBA27DD6609C90F10BCB875A49
SHA256:405E9A77857753D21E060DCFFAB12F820FA7593AE152B45588703BF312B5FF44
43041f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeC:\Users\admin\AppData\Local\Temp\7-zip32.dllexecutable
MD5:B47F35506E4C1A5F7DA6B5F3FB3B735F
SHA256:8702364360F9070AEB7CE22B81AE02E558938D1E703A26245E2B0E0611B041E5
43041f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeC:\TEMP\7z\7-zip.dllexecutable
MD5:8B8670DF5CCD10D7F43A71C9827AD659
SHA256:73B61B8A6E58FBFA99D7659E4BD3E4FCABEB98F12039C93EEA54E09687D98498
43041f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeC:\Users\admin\Desktop\Swwp×Ô¶¯»¯¹¤¾ß¡ªÄãµÄsolidworksºÃ°ïÊÖ.lnkbinary
MD5:BEC5F8C53223A0A7D74B426B7BC0B2C9
SHA256:5913CE14C1D93C373B231631D1DFBC902D341144496387D6A501DBC3D969ACAC
43041f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeC:\TEMP\7z\7za.exeexecutable
MD5:1DC8C4FF8F4BF0AFDC5B71223CC18010
SHA256:BDAE6B4D7779F8AB53D3B34CA1A53DFD406C2964569ED3EF00077E203F488711
43041f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeC:\TEMP\dm.dllexecutable
MD5:9B3F76647DB04320F175F030DDDAF465
SHA256:9655CEE86CA3F32BEE059823D39EBA449F91306A666E13F33A9E000FEEA4C8BE
43041f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeC:\TEMP\7z\7z.exeexecutable
MD5:70E8D86A49B0763449A4144627147CEE
SHA256:ED24ED04B5D4A20B3F50FC088A455195C756D7B5315D1965E8C569472B43D939
43041f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exeC:\Users\admin\AppData\Local\Temp\E2EECore.2.7.2.dllexecutable
MD5:8B6C94BBDBFB213E94A5DCB4FAC28CE3
SHA256:982A177924762F270B36FE34C7D6847392B48AE53151DC2011078DCEEF487A53
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
42
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3612
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
2676
slui.exe
POST
500
48.192.1.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
5316
svchost.exe
POST
200
20.190.160.128:443
https://login.live.com/RST2.srf
US
xml
1.24 Kb
whitelisted
—
—
POST
400
40.126.31.73:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
204 b
whitelisted
5316
svchost.exe
POST
400
20.190.160.128:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
204 b
whitelisted
4304
1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe
GET
405
116.62.115.187:443
https://api-v3.speedtest.cn/ip
CN
html
2.59 Kb
unknown
4304
1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe
POST
200
154.83.13.107:80
http://www.swwps.cn/swwp/update/getupdatezx
HK
text
578 b
unknown
5316
svchost.exe
POST
200
40.126.31.73:443
https://login.live.com/RST2.srf
US
xml
1.24 Kb
whitelisted
5484
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
104.126.37.131:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
5484
svchost.exe
23.216.77.28:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5484
svchost.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5276
MoUsoCoreWorker.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
2676
slui.exe
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5316
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
www.bing.com
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.152
  • 104.126.37.136
  • 104.126.37.153
  • 104.126.37.146
  • 104.126.37.160
  • 104.126.37.155
  • 104.126.37.145
whitelisted
google.com
  • 192.178.183.138
  • 192.178.183.113
  • 192.178.183.100
  • 192.178.183.101
  • 192.178.183.139
  • 192.178.183.102
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.52.181.212
  • 88.221.169.152
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.67
  • 20.190.160.132
  • 40.126.32.76
  • 20.190.160.5
  • 40.126.32.72
  • 40.126.32.136
  • 40.126.32.134
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
api-v3.speedtest.cn
  • 116.62.115.187
unknown
www.swwps.cn
  • 154.83.13.107
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1f40e9ceffb37d50a0af6816c82566a2e9d0afc497ecb03fcdd06f564bfbe718.exe