File name:

systeminformer-3.2.25011-release-setup.exe

Full analysis: https://app.any.run/tasks/0b986bbd-a116-4af1-be1a-e8d1a92cd278
Verdict: Malicious activity
Analysis date: February 11, 2025, 14:11:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
systeminformer
tool
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

979B20755DDF86EDDB3E2892003A2CA6

SHA1:

3A0B6F9EE4EE12872E733948465BE5ECE5B25629

SHA256:

7612D5E44A5A392AB9F0D1B5B8A79BDA3CDBE19848E8EE9EC23909AAF3DAAD45

SSDEEP:

196608:llq2QRccbSWeAo0UtjM4/JP8XrSNffsZJ0d1KAMqRT4t:/YicbmARs/JEmH0JX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Application launched itself

      • systeminformer-3.2.25011-release-setup.exe (PID: 3816)

    • Reads security settings of Internet Explorer

      • systeminformer-3.2.25011-release-setup.exe (PID: 3816)
      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)

    • Drops a system driver (possible attempt to evade defenses)

      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)

    • Process drops legitimate windows executable

      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)

    • Executable content was dropped or overwritten

      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)

    • The process creates files with name similar to system file names

      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)

    • Creates a software uninstall entry

      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)

  • INFO

    • The sample compiled with english language support

      • systeminformer-3.2.25011-release-setup.exe (PID: 3816)
      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)

    • Checks supported languages

      • systeminformer-3.2.25011-release-setup.exe (PID: 3816)
      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)
      • SystemInformer.exe (PID: 5464)

    • Process checks computer location settings

      • systeminformer-3.2.25011-release-setup.exe (PID: 3816)
      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)

    • SYSTEMINFORMER mutex has been found

      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)
      • systeminformer-3.2.25011-release-setup.exe (PID: 3816)

    • Reads the computer name

      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)
      • systeminformer-3.2.25011-release-setup.exe (PID: 3816)
      • SystemInformer.exe (PID: 5464)

    • Creates files in the program directory

      • systeminformer-3.2.25011-release-setup.exe (PID: 4668)

    • Reads CPU info

      • SystemInformer.exe (PID: 5464)

    • Reads the software policy settings

      • SystemInformer.exe (PID: 5464)

    • Checks proxy server information

      • SystemInformer.exe (PID: 5464)

    • Reads the time zone

      • SystemInformer.exe (PID: 5464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2102:11:20 21:32:35+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.42
CodeSize: 266240
InitializedDataSize: 23269376
UninitializedDataSize: -
EntryPoint: 0x20a40
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 3.2.25011.2103
ProductVersionNumber: 3.2.25011.2103
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: System Informer
FileDescription: System Informer - Setup
FileVersion: 3.2.25011.2103
InternalName: systeminformer-setup.exe
LegalCopyright: Copyright (c) Winsider Seminars & Solutions, Inc. All rights reserved.
OriginalFileName: systeminformer-setup.exe
ProductName: System Informer
ProductVersion: 3.2.25011.2103
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start systeminformer-3.2.25011-release-setup.exe no specs systeminformer-3.2.25011-release-setup.exe systeminformer.exe

Process information

PID
CMD
Path
Indicators
Parent process
3816"C:\Users\admin\AppData\Local\Temp\systeminformer-3.2.25011-release-setup.exe" C:\Users\admin\AppData\Local\Temp\systeminformer-3.2.25011-release-setup.exe—explorer.exe
User:
admin
Company:
System Informer
Integrity Level:
MEDIUM
Description:
System Informer - Setup
Exit code:
0
Version:
3.2.25011.2103
Modules
Images
c:\users\admin\appdata\local\temp\systeminformer-3.2.25011-release-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
4668"C:\Users\admin\AppData\Local\Temp\systeminformer-3.2.25011-release-setup.exe" "C:\Users\admin\AppData\Local\Temp\systeminformer-3.2.25011-release-setup.exe" C:\Users\admin\AppData\Local\Temp\systeminformer-3.2.25011-release-setup.exe
systeminformer-3.2.25011-release-setup.exe
User:
admin
Company:
System Informer
Integrity Level:
HIGH
Description:
System Informer - Setup
Exit code:
0
Version:
3.2.25011.2103
Modules
Images
c:\users\admin\appdata\local\temp\systeminformer-3.2.25011-release-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
5464"C:\Program Files\SystemInformer\SystemInformer.exe" -channel releaseC:\Program Files\SystemInformer\SystemInformer.exe
systeminformer-3.2.25011-release-setup.exe
User:
admin
Company:
Winsider Seminars & Solutions, Inc.
Integrity Level:
HIGH
Description:
System Informer
Version:
3.2.25011.2103
Modules
Images
c:\program files\systeminformer\systeminformer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
1 965
Read events
1 956
Write events
9
Delete events
0

Modification events

(PID) Process:(4668) systeminformer-3.2.25011-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:DisplayIcon
Value:
C:\Program Files\SystemInformer\systeminformer.exe,0
(PID) Process:(4668) systeminformer-3.2.25011-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:DisplayName
Value:
System Informer
(PID) Process:(4668) systeminformer-3.2.25011-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:DisplayVersion
Value:
3.2.25011.2103
(PID) Process:(4668) systeminformer-3.2.25011-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:HelpLink
Value:
https://system-informer.com/
(PID) Process:(4668) systeminformer-3.2.25011-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:InstallLocation
Value:
C:\Program Files\SystemInformer\
(PID) Process:(4668) systeminformer-3.2.25011-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:Publisher
Value:
Winsider Seminars & Solutions, Inc.
(PID) Process:(4668) systeminformer-3.2.25011-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:UninstallString
Value:
"C:\Program Files\SystemInformer\systeminformer-setup.exe" -uninstall
(PID) Process:(4668) systeminformer-3.2.25011-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:NoModify
Value:
1
(PID) Process:(4668) systeminformer-3.2.25011-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:NoRepair
Value:
1
Executable files
23
Suspicious files
22
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
4668systeminformer-3.2.25011-release-setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\PE Viewer.lnkbinary
MD5:B75ACE2E9E96CA66DC62C5B39C3FEEDD
SHA256:A69A368F43987E528B91C289FF036ABEC71AE131A5AEB2137D8892D1DF213299
4668systeminformer-3.2.25011-release-setup.exeC:\Program Files\SystemInformer\COPYRIGHT.txttext
MD5:CA24EB3F2DEEB2DC58277A165712A4AC
SHA256:A48B54A4494300FF3D8F41F34AAFC74314ECCEADDE71BEB899C1231C3977BF1D
4668systeminformer-3.2.25011-release-setup.exeC:\Program Files\SystemInformer\LICENSE.txttext
MD5:00B5F3DE97978ECBFCAA88C3D9D87CE5
SHA256:E0CD000380F49907CB856B00AC44C436DF10E2B0AD24EA77576F8EF77F508BDD
4668systeminformer-3.2.25011-release-setup.exeC:\Program Files\SystemInformer\README.txttext
MD5:0CCC7E76DA4E38CD2F73BD197DEA80C3
SHA256:29C068275F2B99405DFED86B2C6C6E0722944B743565796B76FBF74F42DA8039
4668systeminformer-3.2.25011-release-setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Informer.lnkbinary
MD5:2E2893D76C1802E3838C343D0ACC0044
SHA256:13562C787CEA59D09EBDE8FFC94A1A6D83AE01EA05465DEBFD1E717B27114633
4668systeminformer-3.2.25011-release-setup.exeC:\Users\Public\Desktop\System Informer.lnkbinary
MD5:33ACAF16A48F662D62ACB2E0406DE152
SHA256:623E792ACD760E0B5E88BCA0A83EAFA9E88387BEC920F427D0B7E3F246FE34B1
4668systeminformer-3.2.25011-release-setup.exeC:\Program Files\SystemInformer\systeminformer-setup.exeexecutable
MD5:979B20755DDF86EDDB3E2892003A2CA6
SHA256:7612D5E44A5A392AB9F0D1B5B8A79BDA3CDBE19848E8EE9EC23909AAF3DAAD45
4668systeminformer-3.2.25011-release-setup.exeC:\Program Files\SystemInformer\symsrv.dllexecutable
MD5:AC540C9135582AB683F5015E44DE1660
SHA256:5FCEBEBE39FB70368AB3F91AE48234A887F284C0A80D018D0DCF7EE0E992B444
4668systeminformer-3.2.25011-release-setup.exeC:\Program Files\SystemInformer\plugins\DotNetTools.sigbinary
MD5:F74F8A9B970282BCDD32C753C6A6621C
SHA256:E595E7E3D5F7C366C6D9B98DF1CAB3A60AE35B7579726D3799A420B88927E83C
4668systeminformer-3.2.25011-release-setup.exeC:\Program Files\SystemInformer\SystemInformer.sigbinary
MD5:AE6A4E8D95EC07E3CDAC3848846FEDA1
SHA256:2ACCE1F4BF2C56EB52486069CD60338702174F69B19734CAA038A141430F6ACF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
68
svchost.exe
GET
200
23.48.23.162:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
68
svchost.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5992
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5992
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3172
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
68
svchost.exe
23.48.23.162:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
68
svchost.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.16.204.151:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.48.23.162
  • 23.48.23.178
  • 23.48.23.177
  • 23.48.23.170
  • 23.48.23.167
  • 23.48.23.175
  • 23.48.23.168
  • 23.48.23.179
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 2.16.253.202
  • 23.219.150.101
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.16.204.151
  • 2.16.204.152
  • 2.16.204.136
  • 2.16.204.160
  • 2.16.204.161
  • 2.16.204.156
  • 2.16.204.135
  • 2.16.204.158
  • 2.16.204.157
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.67
  • 20.190.160.3
  • 20.190.160.128
  • 40.126.32.138
  • 20.190.160.130
  • 20.190.160.131
  • 20.190.160.20
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
systeminformer-3.2.25011-release-setup.exe