File name:

winx.exe

Full analysis: https://app.any.run/tasks/799b555b-be05-4ecc-8573-1ebad1f95882
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: October 03, 2025, 17:34:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
pyinstaller
miner
github
winring0-sys
vuln-driver
xmrig
upx
xor-url
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

D64DCC284CA96F9C6F43626C8F1A2039

SHA1:

9ACD19753299973EB84AA105315AE0FAE723557A

SHA256:

008A1C1D80575E86E0DC42D1493CD3E7F28C15DF526E5FAF2DB25BB2E13AED3E

SSDEEP:

98304:K1T2Q6axHrjr1wog3UtACy38z6k7eNiMFbumVYVqqo6phxsKzrrJiltdcGq/kgzR:Tq6OpfQGGG1bV30gTaK7uEcO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • winx.exe (PID: 5836)
      • winx.exe (PID: 4596)
      • zxbbvxaqrces.exe (PID: 6924)

    • Vulnerable driver has been detected

      • zxbbvxaqrces.exe (PID: 6924)

    • XMRIG has been detected (YARA)

      • svchost.exe (PID: 2364)

    • XORed URL has been found (YARA)

      • svchost.exe (PID: 2364)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • winx.exe (PID: 5836)

    • Executable content was dropped or overwritten

      • winx.exe (PID: 5836)
      • winx.exe (PID: 7440)
      • temp_wrapper.py (PID: 2356)
      • zxbbvxaqrces.exe (PID: 6924)

    • The process drops C-runtime libraries

      • winx.exe (PID: 5836)

    • Loads Python modules

      • winx.exe (PID: 7440)

    • Process drops python dynamic module

      • winx.exe (PID: 5836)

    • There is functionality for taking screenshot (YARA)

      • winx.exe (PID: 5836)
      • winx.exe (PID: 7440)

    • Application launched itself

      • winx.exe (PID: 5836)

    • Starts CMD.EXE for commands execution

      • winx.exe (PID: 7440)

    • The executable file from the user directory is run by the CMD process

      • temp_wrapper.py (PID: 2356)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1912)

    • Creates a new Windows service

      • sc.exe (PID: 5320)

    • Windows service management via SC.EXE

      • sc.exe (PID: 2288)
      • sc.exe (PID: 6512)

    • Drops a system driver (possible attempt to evade defenses)

      • zxbbvxaqrces.exe (PID: 6924)

    • Stops a currently running service

      • sc.exe (PID: 2852)

    • Executes as Windows Service

      • zxbbvxaqrces.exe (PID: 6924)

    • Starts SC.EXE for service management

      • temp_wrapper.py (PID: 2356)

    • Crypto Currency Mining Activity Detected

      • svchost.exe (PID: 2428)

  • INFO

    • Create files in a temporary directory

      • winx.exe (PID: 5836)
      • winx.exe (PID: 7440)

    • Checks supported languages

      • winx.exe (PID: 7440)
      • winx.exe (PID: 5836)
      • temp_wrapper.py (PID: 2356)
      • zxbbvxaqrces.exe (PID: 6924)

    • Reads the computer name

      • winx.exe (PID: 5836)

    • Reads the machine GUID from the registry

      • winx.exe (PID: 7440)

    • The sample compiled with english language support

      • winx.exe (PID: 5836)

    • PyInstaller has been detected (YARA)

      • winx.exe (PID: 5836)
      • winx.exe (PID: 7440)

    • Checks operating system version

      • winx.exe (PID: 7440)

    • Creates files in the program directory

      • temp_wrapper.py (PID: 2356)

    • The sample compiled with japanese language support

      • zxbbvxaqrces.exe (PID: 6924)

    • Checks proxy server information

      • slui.exe (PID: 5792)

    • UPX packer has been detected

      • svchost.exe (PID: 2364)

    • Reads the software policy settings

      • slui.exe (PID: 5792)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:10:03 09:44:31+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.42
CodeSize: 173568
InitializedDataSize: 155648
UninitializedDataSize: -
EntryPoint: 0xce20
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
185
Monitored processes
23
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
1912C:\WINDOWS\system32\cmd.exe /c "C:\Users\admin\AppData\Local\Temp\_MEI58362\temp_wrapper.py"C:\Windows\System32\cmd.exe—winx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2284\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2288C:\WINDOWS\system32\sc.exe delete "MFRNCJUT"C:\Windows\System32\sc.exe—temp_wrapper.py
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2356C:\Users\admin\AppData\Local\Temp\_MEI58362\temp_wrapper.pyC:\Users\admin\AppData\Local\Temp\_MEI58362\temp_wrapper.py
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\_mei58362\temp_wrapper.py
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
2364svchost.exeC:\Windows\System32\svchost.exe
zxbbvxaqrces.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2428C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2852C:\WINDOWS\system32\sc.exe stop eventlogC:\Windows\System32\sc.exe—temp_wrapper.py
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1051
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
4596"C:\Users\admin\Desktop\winx.exe" C:\Users\admin\Desktop\winx.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\winx.exe
c:\windows\system32\ntdll.dll
5320C:\WINDOWS\system32\sc.exe create "MFRNCJUT" binpath= "C:\ProgramData\xpmrnpkbycsk\zxbbvxaqrces.exe" start= "auto"C:\Windows\System32\sc.exe—temp_wrapper.py
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
8 120
Read events
8 120
Write events
0
Delete events
0

Modification events

No data
Executable files
36
Suspicious files
1
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
5836winx.exeC:\Users\admin\AppData\Local\Temp\_MEI58362\api-ms-win-crt-convert-l1-1-0.dllexecutable
MD5:278857B86F667C47CBCCE94F5EC73CA8
SHA256:91C5966932287078D0E616D8E0369347991F39765749BBFFA1ED3A9DF49776D9
5836winx.exeC:\Users\admin\AppData\Local\Temp\_MEI58362\api-ms-win-core-synch-l1-2-0.dllexecutable
MD5:E4B64B2710725EC3332021BD8044D884
SHA256:9566B81B1C6DB1727A4BB3A7A3DE12247FF5297F34548593280EC31F2B2E2C65
5836winx.exeC:\Users\admin\AppData\Local\Temp\_MEI58362\api-ms-win-core-file-l1-2-0.dllexecutable
MD5:6A55A7E284B51B086B63CC6F2061CE8B
SHA256:D9973270A952B4CE615104520051E847B26E4B1CC330A5A95BA1AE128F0DFDEB
5836winx.exeC:\Users\admin\AppData\Local\Temp\_MEI58362\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:6E38A6BED88E1C27155E4DC428188EF0
SHA256:144D3A28E43E47FC1CCE956255CC80467D4A6FBBB8F612EC6D85F62DE030A924
5836winx.exeC:\Users\admin\AppData\Local\Temp\_MEI58362\_bz2.pydexecutable
MD5:183F1289E094220FBB2841918798598F
SHA256:164F1BF42630B589B50C8F0C6E55AAA8D817E439A00882BE036FFF3CBE8E6DED
5836winx.exeC:\Users\admin\AppData\Local\Temp\_MEI58362\_socket.pydexecutable
MD5:F73B9863071FB3088C08605F76B8E909
SHA256:8EFDBACF67C223F47B608E57222CF80DD12CEE163945847F6CFA9EA6C26ADA36
5836winx.exeC:\Users\admin\AppData\Local\Temp\_MEI58362\_decimal.pydexecutable
MD5:6B07F5C49AE2AF116E4D41CE7D552451
SHA256:04AFE789EAB63D204337E9EDABEF1E1CD003DB69D66DC2CF0FC9E9E7A47304A6
5836winx.exeC:\Users\admin\AppData\Local\Temp\_MEI58362\_lzma.pydexecutable
MD5:FD4C7582BEE16436BB3F790E1273EB22
SHA256:8AA5CD82D775EA718D3DDD270F0B28985D8711EF937447EE2168318200F0EB80
5836winx.exeC:\Users\admin\AppData\Local\Temp\_MEI58362\VCRUNTIME140.dllexecutable
MD5:F12681A472B9DD04A812E16096514974
SHA256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
5836winx.exeC:\Users\admin\AppData\Local\Temp\_MEI58362\_hashlib.pydexecutable
MD5:F883652E056FF4882E1BC900D382EDAB
SHA256:583F6D20998E45FF94400EFAEECC4E17204449A0CC7BA68A20D1E8D13617F27B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
50
DNS requests
17
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
20.190.160.66:443
https://login.live.com/RST2.srf
US
xml
11.3 Kb
unknown
—
—
POST
200
40.126.32.136:443
https://login.live.com/RST2.srf
US
—
—
unknown
—
—
GET
200
23.192.36.142:443
https://www.bing.com/th?id=ODSWG.31bcf3d1-4df8-4c6a-9b3a-447ced8d6c39&pid=dsb
US
—
—
unknown
—
—
GET
200
52.165.164.15:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
unknown
—
—
POST
200
20.190.160.65:443
https://login.live.com/RST2.srf
US
—
11.1 Kb
unknown
—
—
POST
200
40.126.32.134:443
https://login.live.com/RST2.srf
US
xml
11.3 Kb
unknown
—
—
POST
200
20.190.160.130:443
https://login.live.com/RST2.srf
US
xml
11.3 Kb
unknown
—
—
GET
200
23.192.36.137:443
https://www.bing.com/client/config?cc=US&setlang=en-US
US
binary
2.15 Kb
unknown
—
—
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
unknown
—
—
GET
200
23.192.36.137:443
https://www.bing.com/th?id=ODSWG.8229b0e5-fa8c-4e4a-af74-69717698b903&pid=dsb
US
image
4.62 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.241.207:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2364
svchost.exe
141.94.96.71:443
pool.supportxmr.com
OVH SAS
FR
suspicious
2364
svchost.exe
185.199.110.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted
2364
svchost.exe
141.94.96.195:443
pool.supportxmr.com
OVH SAS
FR
suspicious
2144
slui.exe
4.154.209.85:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5224
SearchApp.exe
2.16.241.207:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.16.241.207
  • 2.16.241.218
  • 2.16.241.201
  • 2.16.241.205
  • 2.16.241.222
whitelisted
google.com
  • 142.250.185.142
whitelisted
pool.supportxmr.com
  • 141.94.96.195
  • 141.94.96.71
  • 141.94.96.144
unknown
raw.githubusercontent.com
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.108.133
whitelisted
activation-v2.sls.microsoft.com
  • 4.154.209.85
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.129
  • 20.190.159.23
  • 40.126.31.130
  • 20.190.159.64
  • 40.126.31.0
  • 40.126.31.73
  • 40.126.31.69
whitelisted
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
2428
svchost.exe
Crypto Currency Mining Activity Detected
ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)
2428
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
winx.exe