File name:

Fliqlo.scr

Full analysis: https://app.any.run/tasks/4a235066-b8b0-49cb-8dbf-a2da8362d7cf
Verdict: Malicious activity
Analysis date: July 01, 2024, 18:20:24
OS: Windows 10 Professional (build: 19045, 64 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

6156DFBD547C0074F66D3A06D840A665

SHA1:

491611F7F8E112275A3E47E84B4E4C5788F2369F

SHA256:

2E0A46B385F21C081F69C940BF850656538A43DD8A1860093B88737F4FF82F8D

SSDEEP:

768:WZLE4ljuHcqfqoHreSORn52qiYmLEi9HejBq77777Ktou4LGM0cm1:WZLE8qcq7u58YCEZB9BvCm1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Fliqlo.scr.exe (PID: 1304)

    • Scans artifacts that could help determine the target

      • Fliqlo.scr.exe (PID: 1304)

  • SUSPICIOUS

    • Changes Internet Explorer settings (feature browser emulation)

      • Fliqlo.scr.exe (PID: 1304)

    • Checks Windows Trust Settings

      • Fliqlo.scr.exe (PID: 1304)

    • Reads security settings of Internet Explorer

      • Fliqlo.scr.exe (PID: 1304)

    • Reads Internet Explorer settings

      • Fliqlo.scr.exe (PID: 1304)

    • Reads Microsoft Outlook installation path

      • Fliqlo.scr.exe (PID: 1304)

  • INFO

    • Reads the machine GUID from the registry

      • Fliqlo.scr.exe (PID: 1304)

    • Reads the computer name

      • Fliqlo.scr.exe (PID: 1304)

    • Checks proxy server information

      • Fliqlo.scr.exe (PID: 1304)

    • Checks supported languages

      • Fliqlo.scr.exe (PID: 1304)

    • Reads the software policy settings

      • Fliqlo.scr.exe (PID: 1304)

    • Creates files or folders in the user directory

      • Fliqlo.scr.exe (PID: 1304)

    • Process checks Internet Explorer phishing filters

      • Fliqlo.scr.exe (PID: 1304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:03:06 09:45:43+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 31744
InitializedDataSize: 355840
UninitializedDataSize: -
EntryPoint: 0x9a6a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.5.1.0
ProductVersionNumber: 1.5.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Flip clock screensaver
CompanyName: 9031
FileDescription: Fliqlo
FileVersion: 1.5.1.0
InternalName: Fliqlo.exe
LegalCopyright: © 2021 9031
LegalTrademarks: -
OriginalFileName: Fliqlo.exe
ProductName: Fliqlo
ProductVersion: 1.5.1
AssemblyVersion: 1.5.1.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start fliqlo.scr.exe

Process information

PID
CMD
Path
Indicators
Parent process
1304"C:\Users\admin\AppData\Local\Temp\Fliqlo.scr.exe" C:\Users\admin\AppData\Local\Temp\Fliqlo.scr.exe
explorer.exe
User:
admin
Company:
9031
Integrity Level:
MEDIUM
Description:
Fliqlo
Version:
1.5.1.0
Modules
Images
c:\users\admin\appdata\local\temp\fliqlo.scr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
2 695
Read events
2 678
Write events
17
Delete events
0

Modification events

(PID) Process:(1304) Fliqlo.scr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
Operation:writeName:Fliqlo.scr.exe
Value:
11001
(PID) Process:(1304) Fliqlo.scr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1304) Fliqlo.scr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1304) Fliqlo.scr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1304) Fliqlo.scr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1304) Fliqlo.scr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1304) Fliqlo.scr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1304) Fliqlo.scr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1304) Fliqlo.scr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\fliqlo.app
Operation:writeName:NumberOfSubdomains
Value:
1
(PID) Process:(1304) Fliqlo.scr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\fliqlo.app
Operation:writeName:Total
Value:
3
Executable files
0
Suspicious files
11
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1304Fliqlo.scr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:3DFCA46E00FFA4795C72A41375F159D3
SHA256:DCBA1A505396539BAC40A7253C9F5DCCF06CBB79957E21D56305E1FC3AF5F40E
1304Fliqlo.scr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_925B71A3CCECE24AA0EFF09CD733A93Cder
MD5:5D4889607E40BFFE97651C7BDCDC3EBE
SHA256:1172705333232A5AD7CDEFCE6D84968CA030A76BA74152A03C817F95F24031CB
1304Fliqlo.scr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_925B71A3CCECE24AA0EFF09CD733A93Cbinary
MD5:D5469562FE447D8DC3404CCA712299A4
SHA256:1F37F589F1ED838D57D8FA8CD1ED4BB9B1611BCBF73E183BE505EEBC1E694906
1304Fliqlo.scr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68CD1D04BD2325A4035E3AC71283D3DFbinary
MD5:998D605A2962B6D365BF82624200A515
SHA256:1064C6252625E2A88F7E67158AA373CF8323AB689020D52999CE7E9A32771B45
1304Fliqlo.scr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\js[1].jstext
MD5:A3EFFAEF3C743AE924BCE97C7DC50FB7
SHA256:6B9116238C4C79649A56EE1C1DEA9AAB67F6F394C2CDD371378BC7DFCA7776A6
1304Fliqlo.scr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\jquery.min[1].jss
MD5:767A77430D12BD654D8F0C92CC21298C
SHA256:C46DC051CE81C4AF2B2096ABBF885AE4BA7467FF5DB0F0106CEEE928CF3658A3
1304Fliqlo.scr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\fliqlo.min[1].jstext
MD5:B5DDF9B829E34E088F91BF6795689CDB
SHA256:8500DC6C13E4DB2F2A1D791445BAA6663CC332C9A616BE7F00080C0751D09662
1304Fliqlo.scr.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\19R0DZKY\fliqlo[1].xmltext
MD5:C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA256:B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
1304Fliqlo.scr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\fontfaceonload[1].jsbinary
MD5:011DF2C35319B034BF8841E6DEEB59D1
SHA256:590BE13FF34CBFF30ABF5F84A7340A92CA087B69196247575117656B8C63BEDA
1304Fliqlo.scr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:8A9056C5EB112BCFF15633EFD0D90181
SHA256:A1D41EA6700428E30F389A9DAFAF9F7CB1C48AFCD2EBC97C4CBC9F1EABF1A599
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
64
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
2860
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
1304
Fliqlo.scr.exe
GET
200
172.217.18.3:80
http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQD6XznazuPu%2BxDsBhjsCTDO
unknown
—
—
unknown
1304
Fliqlo.scr.exe
GET
200
172.217.18.3:80
http://c.pki.goog/r/r1.crl
unknown
—
—
unknown
1304
Fliqlo.scr.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
1304
Fliqlo.scr.exe
GET
200
184.24.77.51:80
http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQDSteaLxdAOXt9doRPTN4rnA%3D%3D
unknown
—
—
unknown
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
4688
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
4688
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2860
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6072
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4020
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1304
Fliqlo.scr.exe
157.7.44.174:443
fliqlo.app
GMO Internet,Inc
JP
unknown
1544
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1304
Fliqlo.scr.exe
184.24.77.51:80
r10.o.lencr.org
Akamai International B.V.
DE
unknown
1544
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
fliqlo.app
  • 157.7.44.174
unknown
login.live.com
  • 20.190.159.68
  • 20.190.159.71
  • 40.126.31.67
  • 20.190.159.4
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.75
  • 40.126.31.71
whitelisted
r10.o.lencr.org
  • 184.24.77.51
  • 184.24.77.61
  • 184.24.77.54
  • 184.24.77.76
unknown
www.googletagmanager.com
  • 142.250.184.200
whitelisted
ocsp.pki.goog
  • 172.217.18.3
whitelisted
c.pki.goog
  • 172.217.18.3
unknown
o.pki.goog
  • 172.217.18.3
unknown
region1.google-analytics.com
  • 216.239.32.36
  • 216.239.34.36
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fliqlo.scr