File name:

RunWay.exe

Full analysis: https://app.any.run/tasks/23f8c517-e94c-47b0-99a3-f6b64113873e
Verdict: Malicious activity
Analysis date: April 27, 2025, 15:34:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

0B5A958C0DB880331244DC5C5860FA30

SHA1:

3840D4FDE5BE11960FF51037D4DA48120CCDA430

SHA256:

2355248070B08D290A07E9A6FF8F8EED856A1BDFB28E256368AFDB89FFC38E35

SSDEEP:

786432:3UHxvVRDp271lL5NaYsT3W/OLtWhWya91fPiQJbxkO:IxvfDp271lL5xs7W/ULya91fPiQJbxkO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • RunWay.exe (PID: 4120)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • RunWay.exe (PID: 4120)

    • The process creates files with name similar to system file names

      • RunWay.exe (PID: 4120)

    • Executable content was dropped or overwritten

      • RunWay.exe (PID: 4120)

    • Reads security settings of Internet Explorer

      • RunWay.exe (PID: 4120)

    • Process drops legitimate windows executable

      • RunWay.exe (PID: 4120)

    • Drops 7-zip archiver for unpacking

      • RunWay.exe (PID: 4120)

    • Creates a software uninstall entry

      • RunWay.exe (PID: 4120)

    • There is functionality for taking screenshot (YARA)

      • RunWay.exe (PID: 4120)

    • Application launched itself

      • runWay.exe (PID: 2136)

  • INFO

    • The sample compiled with english language support

      • RunWay.exe (PID: 4120)

    • Checks supported languages

      • RunWay.exe (PID: 4120)
      • runWay.exe (PID: 2136)
      • runWay.exe (PID: 4040)
      • runWay.exe (PID: 6516)
      • runWay.exe (PID: 5384)

    • Reads the computer name

      • RunWay.exe (PID: 4120)
      • runWay.exe (PID: 2136)
      • runWay.exe (PID: 4040)
      • runWay.exe (PID: 6516)

    • Create files in a temporary directory

      • RunWay.exe (PID: 4120)
      • runWay.exe (PID: 2136)

    • Creates files or folders in the user directory

      • RunWay.exe (PID: 4120)
      • runWay.exe (PID: 2136)
      • runWay.exe (PID: 6516)

    • Manual execution by a user

      • runWay.exe (PID: 2692)
      • runWay.exe (PID: 2136)

    • Checks proxy server information

      • runWay.exe (PID: 2136)
      • slui.exe (PID: 3332)

    • Reads the machine GUID from the registry

      • runWay.exe (PID: 2136)

    • Process checks computer location settings

      • runWay.exe (PID: 2136)
      • runWay.exe (PID: 5384)

    • Reads the software policy settings

      • slui.exe (PID: 3332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.2.0
ProductVersionNumber: 1.4.2.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: runWay LLC
FileDescription: runWay LLC
FileVersion: 1.4.2
LegalCopyright: Copyright © 2025 runWay LLC
ProductName: runWay
ProductVersion: 1.4.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start runway.exe runway.exe no specs runway.exe runway.exe no specs runway.exe runway.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2136"C:\Users\admin\AppData\Local\Programs\runWay\runWay.exe" C:\Users\admin\AppData\Local\Programs\runWay\runWay.exe
explorer.exe
User:
admin
Company:
runWay LLC
Integrity Level:
HIGH
Description:
runWay
Exit code:
0
Version:
1.4.2
Modules
Images
c:\users\admin\appdata\local\programs\runway\runway.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2692"C:\Users\admin\AppData\Local\Programs\runWay\runWay.exe" C:\Users\admin\AppData\Local\Programs\runWay\runWay.exe—explorer.exe
User:
admin
Company:
runWay LLC
Integrity Level:
MEDIUM
Description:
runWay
Exit code:
3221226540
Version:
1.4.2
Modules
Images
c:\users\admin\appdata\local\programs\runway\runway.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3332C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4040"C:\Users\admin\AppData\Local\Programs\runWay\runWay.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\runWay" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1736,i,6122111143698004813,4983148970680085,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\Programs\runWay\runWay.exe—runWay.exe
User:
admin
Company:
runWay LLC
Integrity Level:
LOW
Description:
runWay
Exit code:
0
Version:
1.4.2
Modules
Images
c:\users\admin\appdata\local\programs\runway\runway.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
4120"C:\Users\admin\AppData\Local\Temp\RunWay.exe" C:\Users\admin\AppData\Local\Temp\RunWay.exe
explorer.exe
User:
admin
Company:
runWay LLC
Integrity Level:
MEDIUM
Description:
runWay LLC
Exit code:
0
Version:
1.4.2
Modules
Images
c:\users\admin\appdata\local\temp\runway.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5384"C:\Users\admin\AppData\Local\Programs\runWay\runWay.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\runWay" --app-path="C:\Users\admin\AppData\Local\Programs\runWay\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3004 --field-trial-handle=1736,i,6122111143698004813,4983148970680085,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Users\admin\AppData\Local\Programs\runWay\runWay.exe—runWay.exe
User:
admin
Company:
runWay LLC
Integrity Level:
HIGH
Description:
runWay
Exit code:
0
Version:
1.4.2
Modules
Images
c:\users\admin\appdata\local\programs\runway\runway.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6516"C:\Users\admin\AppData\Local\Programs\runWay\runWay.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\runWay" --mojo-platform-channel-handle=2112 --field-trial-handle=1736,i,6122111143698004813,4983148970680085,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Local\Programs\runWay\runWay.exe
runWay.exe
User:
admin
Company:
runWay LLC
Integrity Level:
HIGH
Description:
runWay
Exit code:
0
Version:
1.4.2
Modules
Images
c:\users\admin\appdata\local\programs\runway\runway.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
2 707
Read events
2 676
Write events
13
Delete events
18

Modification events

(PID) Process:(4120) RunWay.exeKey:HKEY_CURRENT_USER\SOFTWARE\c4d471bd-a4de-5fea-bac8-b772a9787189
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Programs\runWay
(PID) Process:(4120) RunWay.exeKey:HKEY_CURRENT_USER\SOFTWARE\c4d471bd-a4de-5fea-bac8-b772a9787189
Operation:writeName:KeepShortcuts
Value:
true
(PID) Process:(4120) RunWay.exeKey:HKEY_CURRENT_USER\SOFTWARE\c4d471bd-a4de-5fea-bac8-b772a9787189
Operation:writeName:ShortcutName
Value:
runWay
(PID) Process:(4120) RunWay.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c4d471bd-a4de-5fea-bac8-b772a9787189
Operation:writeName:DisplayName
Value:
runWay 1.4.2
(PID) Process:(4120) RunWay.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c4d471bd-a4de-5fea-bac8-b772a9787189
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\runWay\Uninstall runWay.exe" /currentuser
(PID) Process:(4120) RunWay.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c4d471bd-a4de-5fea-bac8-b772a9787189
Operation:writeName:QuietUninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\runWay\Uninstall runWay.exe" /currentuser /S
(PID) Process:(4120) RunWay.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c4d471bd-a4de-5fea-bac8-b772a9787189
Operation:writeName:DisplayVersion
Value:
1.4.2
(PID) Process:(4120) RunWay.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c4d471bd-a4de-5fea-bac8-b772a9787189
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Local\Programs\runWay\runWay.exe,0
(PID) Process:(4120) RunWay.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c4d471bd-a4de-5fea-bac8-b772a9787189
Operation:writeName:Publisher
Value:
runWay LLC
(PID) Process:(4120) RunWay.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c4d471bd-a4de-5fea-bac8-b772a9787189
Operation:writeName:NoModify
Value:
1
Executable files
20
Suspicious files
169
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
4120RunWay.exeC:\Users\admin\AppData\Local\Temp\nsdD7A6.tmp\app-32.7z —
MD5:—
SHA256:—
4120RunWay.exeC:\Users\admin\AppData\Local\Temp\nsdD7A6.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
4120RunWay.exeC:\Users\admin\AppData\Local\Temp\nsdD7A6.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
4120RunWay.exeC:\Users\admin\AppData\Local\Temp\nsdD7A6.tmp\nsis7z.dllexecutable
MD5:80E44CE4895304C6A3A831310FBF8CD0
SHA256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
4120RunWay.exeC:\Users\admin\AppData\Local\Temp\nsdD7A6.tmp\7z-out\locales\ca.pakbinary
MD5:4CD6B3A91669DDCFCC9EEF9B679AB65C
SHA256:56EFFF228EE3E112357D6121B2256A2C3ACD718769C89413DE82C9D4305459C6
4120RunWay.exeC:\Users\admin\AppData\Local\Temp\nsdD7A6.tmp\7z-out\LICENSE.electron.txttext
MD5:4D42118D35941E0F664DDDBD83F633C5
SHA256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
4120RunWay.exeC:\Users\admin\AppData\Local\Temp\nsdD7A6.tmp\7z-out\chrome_200_percent.pakbinary
MD5:48515D600258D60019C6B9C6421F79F6
SHA256:07BEE34E189FE9A8789AED78EA59AD41414B6E611E7D74DA62F8E6CA36AF01CE
4120RunWay.exeC:\Users\admin\AppData\Local\Temp\nsdD7A6.tmp\7z-out\chrome_100_percent.pakbinary
MD5:8626E1D68E87F86C5B4DABDF66591913
SHA256:2CAA1DA9B6A6E87BDB673977FEE5DD771591A1B6ED5D3C5F14B024130A5D1A59
4120RunWay.exeC:\Users\admin\AppData\Local\Temp\nsdD7A6.tmp\SpiderBanner.dllexecutable
MD5:17309E33B596BA3A5693B4D3E85CF8D7
SHA256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
4120RunWay.exeC:\Users\admin\AppData\Local\Temp\nsdD7A6.tmp\7z-out\locales\af.pakbinary
MD5:464E5EEABA5EFF8BC93995BA2CB2D73F
SHA256:0AD547BB1DC57907ADEB02E1BE3017CCE78F6E60B8B39395FE0E8B62285797A1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2136
runWay.exe
GET
200
95.179.216.217:80
http://95.179.216.217:80/uSBEIWt0PYtjZzrmVLmEbg%3D%3D
unknown
—
—
unknown
4212
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4212
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.52.56.216:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6516
runWay.exe
142.250.184.202:443
fonts.googleapis.com
GOOGLE
US
whitelisted
2136
runWay.exe
172.217.18.14:443
calendar.app.google
GOOGLE
US
whitelisted
2136
runWay.exe
216.58.206.46:443
calendar.google.com
GOOGLE
US
whitelisted
2136
runWay.exe
95.179.216.217:80
—
AS-CHOOPA
FR
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.176
  • 23.48.23.147
  • 23.48.23.173
  • 23.48.23.164
  • 23.48.23.194
  • 23.48.23.145
  • 23.48.23.180
  • 23.48.23.141
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
fonts.googleapis.com
  • 142.250.184.202
whitelisted
calendar.app.google
  • 172.217.18.14
unknown
calendar.google.com
  • 216.58.206.46
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RunWay.exe