File name:

FNPLicensingService.exe

Full analysis: https://app.any.run/tasks/536aeffa-2e6b-4823-86cb-5e59f3691389
Verdict: Malicious activity
Analysis date: June 20, 2025, 13:05:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 6 sections
MD5:

D18E307372C3CEB8A6AA26A08D84B182

SHA1:

1AD8A303E07F511C12A4CE8C8FE11D4A13115ADE

SHA256:

3075F49948105636FCF391C0489C9A7590E78C60473D7F5638826536FD473DD3

SSDEEP:

98304:gxVy/zrm7vqCyKJa9/K3kzEKtCYB3/7I4ery5c:E88

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • FNPLicensingService.exe (PID: 2612)
      • FNPLicensingService.exe (PID: 2564)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • FNPLicensingService.exe (PID: 2612)

    • Executable content was dropped or overwritten

      • FNPLicensingService.exe (PID: 2612)

  • INFO

    • The sample compiled with english language support

      • FNPLicensingService.exe (PID: 2612)

    • Creates files in the program directory

      • FNPLicensingService.exe (PID: 2612)

    • Checks supported languages

      • FNPLicensingService.exe (PID: 2612)

    • Reads the computer name

      • FNPLicensingService.exe (PID: 2612)

    • Application launched itself

      • iexplore.exe (PID: 2908)

    • Manual execution by a user

      • iexplore.exe (PID: 2908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:21 22:14:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 1742336
InitializedDataSize: 907264
UninitializedDataSize: -
EntryPoint: 0xfdaf1
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows command line
FileVersionNumber: 11.16.0.0
ProductVersionNumber: 11.16.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Flexera
FileDescription: Activation Licensing Service
FileVersion: 11.16.0.0 build 234449
InternalName: FNPLicensingService.exe
LegalCopyright: Copyright (c) 2006-2018, Flexera. All Rights Reserved.
OriginalFileName: FNPLicensingService.exe
ProductName: FlexNet Publisher (32 bit)
ProductVersion: 11.16.0.0 build 234449
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start fnplicensingservice.exe iexplore.exe iexplore.exe no specs fnplicensingservice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1276"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2908 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2564"C:\Users\admin\Desktop\FNPLicensingService.exe" C:\Users\admin\Desktop\FNPLicensingService.exe—explorer.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
Activation Licensing Service
Exit code:
3221226540
Version:
11.16.0.0 build 234449
Modules
Images
c:\users\admin\desktop\fnplicensingservice.exe
c:\windows\system32\ntdll.dll
2612"C:\Users\admin\Desktop\FNPLicensingService.exe" C:\Users\admin\Desktop\FNPLicensingService.exe
explorer.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
Activation Licensing Service
Exit code:
0
Version:
11.16.0.0 build 234449
Modules
Images
c:\users\admin\desktop\fnplicensingservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
2908"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
8 992
Read events
8 893
Write events
78
Delete events
21

Modification events

(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
540822812
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31187428
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{4BF8E7DB-4DD7-11F0-B32B-12A9866C77DE}
Value:
0
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
240665312
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31187428
Executable files
1
Suspicious files
3
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
2908iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:B28D590E3B71E7D38CAB7DD88D244D6E
SHA256:EE875057C3C2F7C5E61415C72E6AE6A7A0EC7E036D906F354BFF2514B86E530A
2908iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2908iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dder
MD5:983A1F294A9E70CA693BCF40D974B8A4
SHA256:C9EAAA106448AA810A5229186791D031F70A0777690B931F215EA91955FCFA07
2908iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2908iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2908iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
2908iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:5E8AB441B3C1B1173BBC6346C9D96B1C
SHA256:3B24B17E0FA5D21915CF9684BA1AC2471EF07423BF7C8F8AF50993DC53D4891A
2612FNPLicensingService.exeC:\Program Files\Common Files\System\symsrv.dllexecutable
MD5:7574CF2C64F35161AB1292E2F532AABF
SHA256:DE055A89DE246E629A8694BDE18AF2B1605E4B9B493C7E4AEF669DD67ACF5085
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
11
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2908
iexplore.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?66f412b8e87fc9fb
unknown
—
—
whitelisted
2908
iexplore.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?06e2e6c68884a544
unknown
—
—
whitelisted
2908
iexplore.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2908
iexplore.exe
92.123.104.57:443
www.bing.com
Akamai International B.V.
DE
whitelisted
2908
iexplore.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
2908
iexplore.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 92.123.104.57
  • 92.123.104.52
  • 92.123.104.61
  • 92.123.104.59
  • 92.123.104.47
  • 92.123.104.53
  • 92.123.104.58
  • 92.123.104.50
  • 92.123.104.49
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FNPLicensingService.exe