File name:

75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d

Full analysis: https://app.any.run/tasks/52cdaf99-374b-468f-b7d3-ee3461843864
Verdict: Malicious activity
Analysis date: June 08, 2025, 13:35:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

25BA729A1538D68AD33FE36CA0548181

SHA1:

1F87157D8D29B9D40B0E1AD6EB4617BA684C8F1A

SHA256:

75EF5C2C26D3CCC5719073B3A6F2E1A3124843EF91BF5B65F7AFDAB4A90F9D8D

SSDEEP:

12288:kB7/pI/mUzKJJJjdxUiT7P8sWMs2yEr/yDY18rIYj:kB7/pIeUOZjdxUifPoMs2nr/yDY18sm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe (PID: 4428)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe (PID: 4428)

    • The process creates files with name similar to system file names

      • 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe (PID: 4428)

    • There is functionality for taking screenshot (YARA)

      • 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe (PID: 4428)

    • Executable content was dropped or overwritten

      • 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe (PID: 4428)

  • INFO

    • The sample compiled with english language support

      • 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe (PID: 4428)

    • Reads the computer name

      • 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe (PID: 4428)

    • Checks supported languages

      • 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe (PID: 4428)

    • Create files in a temporary directory

      • 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe (PID: 4428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:10:07 04:40:26+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x322e
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: stormandsslgterne apollinarissens glattestes
FileDescription: conidioid
LegalCopyright: skaberen situationerne sacrifice
LegalTrademarks: osmic
ProductName: uomgngeligheden
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe sppextcomobj.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
3208C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4428"C:\Users\admin\AppData\Local\Temp\75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe" C:\Users\admin\AppData\Local\Temp\75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
conidioid
Modules
Images
c:\users\admin\appdata\local\temp\75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7256"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
564
Read events
560
Write events
4
Delete events
0

Modification events

(PID) Process:(4428) 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\muezzin\Uninstall\Middellevetid\conveyorized
Operation:writeName:provostorial
Value:
1
Executable files
1
Suspicious files
6
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
442875ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exeC:\Users\admin\yawlsman\knowhow\Aktiveringens\Dmtes.Slkbinary
MD5:47892CA7D11AE43E15E895BA1E61BA17
SHA256:EC8E421820C2D1C945D51E28BACDC59405D206E0638D48BB79A5AC76FD5B6FB6
442875ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exeC:\Users\admin\yawlsman\knowhow\Prototheca\Andelsbevgelsen\Actualizes\kioskejeres.txttext
MD5:FE46EAF7DE4D24A521D3A34E4D88BB24
SHA256:E0A91D7B03827843F9EC5818BAFED20E2E38E2FDB4F9CB5DBA159AC4542E8FB6
442875ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exeC:\Users\admin\yawlsman\knowhow\Antibiotikas\Shadowist\freoner.crabinary
MD5:EFA05F4531246A40F2175422AEDA08F8
SHA256:65941AE4131C3CB5A66BEF865F60A1E866C4272927E304BF82934C1FA333BD25
442875ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exeC:\Users\admin\yawlsman\knowhow\Luxuries\Primitivestes86\Didaktikernes\maskindokumentation.anhbinary
MD5:9F8ABF10B5EED7728DFF4D369AF58B20
SHA256:CFD815C224E41387846A25E85C776B5384C938BEB829BF9065664ED142F941B3
442875ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exeC:\Users\admin\yawlsman\knowhow\Antibiotikas\Shadowist\hierofalco.scabinary
MD5:90A386868C014CB7B370EEF53D053730
SHA256:5FC7FA8D4C4906FA9279E732B074ECB8F6B3F4B254F3697E626F1B48BA4E4272
442875ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exeC:\Users\admin\yawlsman\knowhow\Luxuries\Primitivestes86\Didaktikernes\omfangsbedmmelsernes.brobinary
MD5:4F9F812ADEFF83CD8A0AB71A499DDA98
SHA256:63D6AA2C2228B53E5CBD913661AD99089A67B8DE6CBF1F724CEABC935F6D014E
442875ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exeC:\Users\admin\yawlsman\knowhow\Aktiveringens\Chippers.antbinary
MD5:C4ADCA97967F23C48DA4D7B19C6B5520
SHA256:BA6648565D5874B3A6696FC224C9B905750CAF78F6AA83FAAF765FFF376270CD
442875ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d.exeC:\Users\admin\AppData\Local\Temp\nsfF55A.tmp\System.dllexecutable
MD5:3E6BF00B3AC976122F982AE2AADB1C51
SHA256:4FF9B2678D698677C5D9732678F9CF53F17290E09D053691AAC4CC6E6F595CBE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4988
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4988
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7548
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4608
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7548
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.142
whitelisted
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.25
  • 23.216.77.31
  • 23.216.77.26
  • 23.216.77.35
  • 23.216.77.20
  • 23.216.77.29
  • 23.216.77.37
  • 23.216.77.27
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
login.live.com
  • 20.190.160.130
  • 20.190.160.20
  • 20.190.160.65
  • 40.126.32.133
  • 20.190.160.2
  • 20.190.160.3
  • 20.190.160.67
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d