File name:

HWiNFO64.exe

Full analysis: https://app.any.run/tasks/a5ff2c26-c60a-473e-8719-f34840a50508
Verdict: Malicious activity
Analysis date: July 18, 2024, 19:36:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
antivm
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

579577F08C54877DCEACD7AA5F4AE13C

SHA1:

0488BCA2BD187B991C7F6AA97CA07D1EE6B8D47B

SHA256:

9EC0D8BC09567101F13FF80EB7B80F161024F036D67F0C374339D8F7EA31BD2C

SSDEEP:

98304:B2WrkgbJy8ZRRq2a2P7d48bOdsaQy4otopqLe43uI74YP++txQpdrzv23a6LBIYE:BdJUNpDlSI1vwoRRfs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • HWiNFO64.exe (PID: 7676)

  • SUSPICIOUS

    • There is functionality for VM detection (antiVM strings)

      • HWiNFO64.exe (PID: 7676)

    • Executable content was dropped or overwritten

      • HWiNFO64.exe (PID: 7676)

    • Drops a system driver (possible attempt to evade defenses)

      • HWiNFO64.exe (PID: 7676)

    • The process checks if it is being run in the virtual environment

      • HWiNFO64.exe (PID: 7676)

    • Reads the BIOS version

      • HWiNFO64.exe (PID: 7676)

    • Reads security settings of Internet Explorer

      • HWiNFO64.exe (PID: 7676)

    • Checks Windows Trust Settings

      • HWiNFO64.exe (PID: 7676)

  • INFO

    • UPX packer has been detected

      • HWiNFO64.exe (PID: 7676)

    • Reads the computer name

      • HWiNFO64.exe (PID: 7676)

    • Checks supported languages

      • HWiNFO64.exe (PID: 7676)

    • Create files in a temporary directory

      • HWiNFO64.exe (PID: 7676)

    • Checks proxy server information

      • HWiNFO64.exe (PID: 7676)

    • Reads CPU info

      • HWiNFO64.exe (PID: 7676)

    • Reads the software policy settings

      • HWiNFO64.exe (PID: 7676)

    • Reads the machine GUID from the registry

      • HWiNFO64.exe (PID: 7676)

    • Reads the time zone

      • HWiNFO64.exe (PID: 7676)

    • Creates files or folders in the user directory

      • HWiNFO64.exe (PID: 7676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (47)
.exe | UPX compressed Win32 Executable (46.1)
.exe | Generic Win/DOS Executable (3.4)
.exe | DOS Executable Generic (3.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:06:12 09:02:35+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.29
CodeSize: 9093120
InitializedDataSize: 110592
UninitializedDataSize: 18771968
EntryPoint: 0x1a92a30
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 8.4.5470.0
ProductVersionNumber: 8.4.5470.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: REALiX s.r.o.
FileVersion: 8.04-5470
ProductVersion: 8.04-5470
LegalCopyright: Copyright (c)1999-2024 Martin Malik - REALiX
InternalName: HWiNFO64
FileDescription: HWiNFO64
OriginalFileName: HWiNFO64.EXE
ProductName: Hardware Info Program for x64 (HWiNFO64)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT hwinfo64.exe slui.exe no specs hwinfo64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7268"C:\Users\admin\AppData\Local\Temp\HWiNFO64.exe" C:\Users\admin\AppData\Local\Temp\HWiNFO64.exe—explorer.exe
User:
admin
Company:
REALiX s.r.o.
Integrity Level:
MEDIUM
Description:
HWiNFO64
Exit code:
3221226540
Version:
8.04-5470
Modules
Images
c:\users\admin\appdata\local\temp\hwinfo64.exe
c:\windows\system32\ntdll.dll
7676"C:\Users\admin\AppData\Local\Temp\HWiNFO64.exe" C:\Users\admin\AppData\Local\Temp\HWiNFO64.exe
explorer.exe
User:
admin
Company:
REALiX s.r.o.
Integrity Level:
HIGH
Description:
HWiNFO64
Version:
8.04-5470
Modules
Images
c:\users\admin\appdata\local\temp\hwinfo64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
8156C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 279
Read events
3 247
Write events
32
Delete events
0

Modification events

(PID) Process:(7676) HWiNFO64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(7676) HWiNFO64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(7676) HWiNFO64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(7676) HWiNFO64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7676) HWiNFO64.exeKey:HKEY_CURRENT_USER\SOFTWARE\HWiNFO64\Summary\Clocks
Operation:writeName:WndTopX
Value:
1217
(PID) Process:(7676) HWiNFO64.exeKey:HKEY_CURRENT_USER\SOFTWARE\HWiNFO64\Summary\Clocks
Operation:writeName:WndTopY
Value:
68
(PID) Process:(7676) HWiNFO64.exeKey:HKEY_CURRENT_USER\SOFTWARE\HWiNFO64\Summary\Clocks
Operation:writeName:WndBottomX
Value:
1480
(PID) Process:(7676) HWiNFO64.exeKey:HKEY_CURRENT_USER\SOFTWARE\HWiNFO64\Summary\Clocks
Operation:writeName:WndBottomY
Value:
182
(PID) Process:(7676) HWiNFO64.exeKey:HKEY_CURRENT_USER\SOFTWARE\HWiNFO64\Summary\Clocks
Operation:writeName:WndStyle
Value:
(PID) Process:(7676) HWiNFO64.exeKey:HKEY_CURRENT_USER\SOFTWARE\HWiNFO64\Summary\Clocks
Operation:writeName:Scaling
Value:
100
Executable files
1
Suspicious files
9
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7676HWiNFO64.exeC:\WINDOWS\INF\wvid.PNFbinary
MD5:A85CAE99E2E390408FDF78804B2226BA
SHA256:559886A25514F85ACE45BBC65C36CC9A880272EC81D7FBBE6244A31B234F55E8
7676HWiNFO64.exeC:\Users\admin\AppData\Local\Temp\HWiNFO_x64_201.sysexecutable
MD5:B7BE0D6A261F01F00B34CB265A29E866
SHA256:E4D7BD2AA979CF7B33DE591C8D3ABEABEB0E978B79237488159A3164F248529E
7676HWiNFO64.exeC:\WINDOWS\INF\machine.PNFbinary
MD5:4C103190BC521FF032845C1B5FDADC4F
SHA256:28C1DEE803488C32BF5229B05FB3F6DA8959A436BB17D331E68AFA61A3BE932F
7676HWiNFO64.exeC:\WINDOWS\INF\basicrender.PNFbinary
MD5:0913617D42CC49E76DEEC969906B7DFB
SHA256:4DAF622B5A0E6F4B1E1D5AD8A3EAD71CFC27A715F78506220C087BFFD0CBDF17
7676HWiNFO64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12der
MD5:7FB5FA1534DCF77F2125B2403B30A0EE
SHA256:33A39E9EC2133230533A686EC43760026E014A3828C703707ACBC150FE40FD6F
7676HWiNFO64.exeC:\WINDOWS\INF\basicdisplay.PNFbinary
MD5:914DCB989709A0CE3F4B24A4CD147F1A
SHA256:C2FEE0EAD23C7B3B509FDDE94DDD6A549F999F364C5CA9D09AC084F22BC0ECB4
7676HWiNFO64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:61887AF911332DD81D5C1C60E7B10395
SHA256:BD5BAB0B909125BEAD2E35C24060743CEDFA9A634AB02BF3BE6ECF04A7677BB8
7676HWiNFO64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8der
MD5:1BFE0A81DB078EA084FF82FE545176FE
SHA256:5BA8817F13EEE00E75158BAD93076AB474A068C6B52686579E0F728FDA68499F
7676HWiNFO64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:88F2E21822717D7C0B23AB2B04E13294
SHA256:9FA0E21181F1499B4AEEF9E11C15F4E08B6F1983627B37780F12539C491BF761
7676HWiNFO64.exeC:\WINDOWS\INF\display.PNFbinary
MD5:F6AC7215AC0006C3D6AF7E475400451A
SHA256:629D64B160798DCA2FA733C0E692ED4AB3EDF4FAFE05A2FC293E34E8BD340ED2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
16
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7676
HWiNFO64.exe
GET
200
142.250.185.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
7676
HWiNFO64.exe
GET
200
142.250.185.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4716
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
7856
svchost.exe
4.209.32.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1796
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2760
svchost.exe
40.113.110.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5948
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4716
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
arc.msn.com
  • 20.223.35.26
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.17
  • 40.126.32.74
  • 20.190.160.22
  • 40.126.32.133
  • 20.190.160.20
  • 40.126.32.76
  • 20.190.160.14
whitelisted
google.com
  • 142.250.185.238
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
www.bing.com
  • 92.123.104.4
  • 92.123.104.11
  • 92.123.104.6
  • 92.123.104.65
  • 92.123.104.10
  • 92.123.104.5
  • 92.123.104.66
  • 92.123.104.9
  • 92.123.104.64
whitelisted
www.hwinfo.com
  • 104.21.22.164
  • 172.67.205.235
whitelisted
c.pki.goog
  • 142.250.185.195
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HWiNFO64.exe