File name:

c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16

Full analysis: https://app.any.run/tasks/af8fd7c5-68f1-46eb-9841-ce84bc4e9aff
Verdict: Malicious activity
Analysis date: May 10, 2025, 01:06:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

52A5DE628A72B697E3EFC2F88DBB250B

SHA1:

9EA002AD3C226A5C87EE952F8E91EED6D8BE1C8E

SHA256:

C36C45A80DF11177270A9906B711737E3C9329195E0A9E8B1FD7F10879C28C16

SSDEEP:

49152:6L79YZKYWfJBq9MTYA0ZjNF8dYllSsl1E5pQd7bqPGRe4L+e/vaaJyoaJjmDx585:4YkYWfJBqOTYA0ZX8ylFyQd7bqPyTj/O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 456)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 7084)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 7084)

    • The process creates files with name similar to system file names

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 7084)

    • There is functionality for taking screenshot (YARA)

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 7084)
      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 456)

    • Application launched itself

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 7084)

    • Reads security settings of Internet Explorer

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 456)

  • INFO

    • The sample compiled with english language support

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 7084)

    • Reads the computer name

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 7084)
      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 456)

    • Creates files or folders in the user directory

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 7084)
      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 456)

    • Checks supported languages

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 7084)
      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 456)

    • Create files in a temporary directory

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 7084)

    • Checks proxy server information

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 456)

    • Reads the machine GUID from the registry

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 456)

    • Reads the software policy settings

      • c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe (PID: 456)
      • slui.exe (PID: 4776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:03 20:18:50+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24576
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x326a
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.2.0.0
ProductVersionNumber: 2.2.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: isokeraunophonic
LegalTrademarks: skrivekommandoens
OriginalFileName: ublides varmeslangebekendtgrelsernes.exe
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe sppextcomobj.exe no specs slui.exe c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456"C:\Users\admin\AppData\Local\Temp\c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe" C:\Users\admin\AppData\Local\Temp\c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe
c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe
User:
admin
Company:
isokeraunophonic
Integrity Level:
MEDIUM
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4776"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6004C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7020C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7084"C:\Users\admin\AppData\Local\Temp\c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe" C:\Users\admin\AppData\Local\Temp\c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe
explorer.exe
User:
admin
Company:
isokeraunophonic
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
1 652
Read events
1 377
Write events
275
Delete events
0

Modification events

(PID) Process:(7084) c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeKey:HKEY_CURRENT_USER\damagement\Paraboloid
Operation:writeName:droh
Value:
%Udtrringsarbejdet%\Klippevaeggen.exe
(PID) Process:(456) c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(456) c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(456) c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
3
Suspicious files
18
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
7084c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeC:\Users\admin\AppData\Local\isoenzymic\atomkernes.torbinary
MD5:FCA5035E2376A1DB378967EF4E713145
SHA256:13A22716152DC35F156BDA2B0311D42F7CA079395BAAB1B7C1A9AB23C056C653
7084c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeC:\Users\admin\AppData\Local\isoenzymic\woolpack\presuffrage.txttext
MD5:DE2892DA52345BB9E8F2514AAE967B5B
SHA256:9B0CEF5D71463FC310DAD1FEDD3DB13B5833E433656F22B0BAC3C954399D1F7A
7084c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeC:\Users\admin\AppData\Local\isoenzymic\indtegningers.txttext
MD5:97DE9CE2188B1DEE75CA68E809DBE1EF
SHA256:B444D0C5D4551DD20BB29F4185719920A85D5744439B55232B1E979060050158
7084c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeC:\Users\admin\AppData\Local\isoenzymic\Uegnethed.jpgimage
MD5:AE273AA8FFF9B76BF5928627AB9400CD
SHA256:884A4A1926BC87C6AA2879C150365DFD7362AA8F6CA6C9FA5ECF07CB8EDEAC85
7084c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeC:\Users\admin\AppData\Local\isoenzymic\Panuelos.Banbinary
MD5:7F35CBA9623AFF92F75BAB7A7FE87E02
SHA256:ECFB5B7FE211235B7FA06F8B164107D6DB2AAB4143C558482F536E130A23AF0E
7084c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeC:\Users\admin\AppData\Local\isoenzymic\aminobenzamide.jpgimage
MD5:CD4C58D7E720DEB25E24436453759A21
SHA256:7DC64120344BCF401CEDC38D4EF371010A66DEC51D939BAA3E3FB1684D72E837
7084c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeC:\Users\admin\AppData\Local\isoenzymic\woolpack\phytohemagglutinin.trabinary
MD5:322A8ABDC859FBF6339672708518C346
SHA256:CF0395BD9B0A1A723C8ECDBA4D40A3053B719F0DF3A67B54BD07751252A3F658
7084c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeC:\Users\admin\AppData\Local\isoenzymic\woolpack\Ssterselskabers\truster.txtini
MD5:CF804BBAFDA3AB9FB3157432C91A85CE
SHA256:A7815FC34FC8CD578716AAE30843F680FCA6AA932752711A021E90E81A420636
7084c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeC:\Users\admin\AppData\Local\isoenzymic\lovliggrende.txttext
MD5:20E538AB9E589AC06C2C0FD6340C1355
SHA256:3D776700D7C51B77961F8CD2E44B31E431DA4346F922CC696749086A49285035
7084c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exeC:\Users\admin\AppData\Local\isoenzymic\Brill.epobinary
MD5:D383E1E4395258F136AE2B4B0B319C4E
SHA256:8C59E9475E2D5EEA70C4F8F384CF6F2B54BF1C1F97308ABB213272D75FC68B17
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
26
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
456
c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe
GET
200
142.250.186.131:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
456
c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe
GET
200
216.58.206.35:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEA85wFTvuwmlCdtY0UxEIqg%3D
unknown
—
—
whitelisted
456
c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe
GET
200
216.58.206.35:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEH0th7t%2BrhK7Cmbia6iF80g%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4408
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
456
c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16.exe
GET
200
142.250.186.131:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.72
  • 20.190.160.132
  • 40.126.32.68
  • 20.190.160.65
  • 20.190.160.130
  • 40.126.32.133
  • 20.190.160.22
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
drive.google.com
  • 142.250.186.142
whitelisted
c.pki.goog
  • 142.250.186.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
c36c45a80df11177270a9906b711737e3c9329195e0a9e8b1fd7f10879c28c16