File name:

HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.7z

Full analysis: https://app.any.run/tasks/87f95adc-6461-4be4-a820-0d022d57e245
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: March 30, 2025, 11:51:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
python
noblis
ransomware
pyinstaller
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

6E3CACC99AF19AF212F78EDE1776D508

SHA1:

0EE65B84ACEFC16D88552A175FFD4B568E76598B

SHA256:

C60C15EB1878DA7B47494AC228D6FD6E098AE35BD4940D4B173BAAE6AB5B4D00

SSDEEP:

196608:KvnK078kI6VpbNxUfNw4dg+mlgpEk8kUD:KvK0IkICbUfC46+miikUD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NOBLIS mutex has been found

      • Flonwd.exe (PID: 2236)

    • Actions looks like stealing of personal data

      • Flonwd.exe (PID: 2236)

    • Modifies files in the Chrome extension folder

      • Flonwd.exe (PID: 2236)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)

    • Process drops python dynamic module

      • Flonwd.exe (PID: 5548)

    • Executable content was dropped or overwritten

      • Flonwd.exe (PID: 5548)
      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)

    • Reads the date of Windows installation

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)

    • Application launched itself

      • Flonwd.exe (PID: 5548)

    • Process drops legitimate windows executable

      • Flonwd.exe (PID: 5548)

    • The process drops C-runtime libraries

      • Flonwd.exe (PID: 5548)

    • Loads Python modules

      • Flonwd.exe (PID: 2236)

    • The process creates files with name similar to system file names

      • Flonwd.exe (PID: 2236)

  • INFO

    • Checks supported languages

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)
      • Flonwd.exe (PID: 5548)
      • Flonwd.exe (PID: 2236)

    • Reads the machine GUID from the registry

      • Flonwd.exe (PID: 2236)
      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)

    • The sample compiled with english language support

      • Flonwd.exe (PID: 5548)

    • Create files in a temporary directory

      • Flonwd.exe (PID: 5548)
      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)

    • Reads the computer name

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)
      • Flonwd.exe (PID: 5548)
      • Flonwd.exe (PID: 2236)

    • Manual execution by a user

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)
      • notepad.exe (PID: 6228)
      • notepad.exe (PID: 6676)

    • Process checks computer location settings

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4040)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6228)

    • Creates files or folders in the user directory

      • Flonwd.exe (PID: 2236)

    • PyInstaller has been detected (YARA)

      • Flonwd.exe (PID: 5548)
      • Flonwd.exe (PID: 2236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2020:07:02 20:18:24+00:00
ArchivedFileName: HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs heur-trojan-ransom.msil.encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe flonwd.exe #NOBLIS flonwd.exe notepad.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2088"C:\Users\admin\Desktop\HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\heur-trojan-ransom.msil.encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2236"C:\Users\admin\AppData\Local\Temp\Flonwd.exe" C:\Users\admin\AppData\Local\Temp\Flonwd.exe
Flonwd.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\flonwd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4040"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\87f95adc-6461-4be4-a820-0d022d57e245.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5548"C:\Users\admin\AppData\Local\Temp\Flonwd.exe" C:\Users\admin\AppData\Local\Temp\Flonwd.exe
HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\flonwd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5720"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6228"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\key.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6676"C:\WINDOWS\system32\notepad.exe" C:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6872C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
5 808
Read events
5 712
Write events
93
Delete events
3

Modification events

(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\87f95adc-6461-4be4-a820-0d022d57e245.7z
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
112
Suspicious files
875
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_ARC4.cp37-win32.pydexecutable
MD5:9FAC084BEBBE6D0E4B17A4D83866238A
SHA256:D4340CA52D209BF24C09A1E675DB9D97613115057F477595DC91C732F1E6B611
4040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4040.29736\HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exeexecutable
MD5:FD755CAE81D2B6D9B60C0EB0E5E42A56
SHA256:325953506271955C3DAA23C2DE161F5A4128DF3655609F48C77CC01CFF405C9F
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_des.cp37-win32.pydexecutable
MD5:A7551B248B62777E4FC5E07951341E97
SHA256:C39B57FAFA488BC8EC92E7B95C2247B92267E80C19BF74F71A582303AD005C96
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_blowfish.cp37-win32.pydexecutable
MD5:ED4ACC41B9016F7219972DF8DA7C3821
SHA256:A06B4FAC14C56F63E9FB6AADFB2B7F1ED18D4AF379B06543FA56A3598C01556E
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_ctr.cp37-win32.pydexecutable
MD5:1668F3391ABB2854202D0E4E7F435520
SHA256:AB293BAD8D9B6CAC6D0944F41C34BFE236DAE4CFDC259858489D4AF0A8E050E5
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_des3.cp37-win32.pydexecutable
MD5:02285D1C79F187E4436261E2D6F07896
SHA256:C5C20800F8F5773B4364FE208352D8C0305D5259BBBA8B20D0F94A01D3A2F401
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_Salsa20.cp37-win32.pydexecutable
MD5:9E16E7FABF05143024BBCE1E9548C28A
SHA256:58D89ECB81460861817DCBCA7664D0C92617BF38B8AB5F9E7B3AD3D0DDF7188E
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_arc2.cp37-win32.pydexecutable
MD5:C43087FE294299BC7B8098FCB1049014
SHA256:A87C21666B8C586B26135901D444C847FC8FF8C5636AF6E2F64A715F045D3B78
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_cbc.cp37-win32.pydexecutable
MD5:88B3FC546FBCA422BFC35472FF6CC02C
SHA256:23B513C7E303BEC76738DE739FC850EA43C551F609800D7A4C995277A5D4B5BA
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_ocb.cp37-win32.pydexecutable
MD5:FF10DF60DEAB97A4C81F7E43670A108D
SHA256:EB65DE227C35322DE3DFA6FC74F02559EAB5E68682B3A1CCA9D56697B4A13DD7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3768
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3768
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.172.255.218:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
40.126.31.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3768
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3768
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
client.wns.windows.com
  • 172.172.255.218
whitelisted
login.live.com
  • 40.126.31.128
  • 20.190.159.64
  • 40.126.31.67
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.3
  • 20.190.159.131
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.7z