File name:

2025-05-09_598f908f020334e754128988f91e67e4_elex

Full analysis: https://app.any.run/tasks/a82c5915-124b-432e-8373-f1bc8af5f5c6
Verdict: Malicious activity
Analysis date: May 09, 2025, 02:18:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 16 sections
MD5:

598F908F020334E754128988F91E67E4

SHA1:

1FDF75CE839FDAECE62AAA528C6C8A3951A297DE

SHA256:

1BE9DDEE9EBAFE29E1292E903A9A2949C365437751D134B10194F54A8751E5F5

SSDEEP:

98304:zYF7MXdrJguAX7NEnsobmXCk/kPkR7V7L/kiGr6Ba9pWQCz9GQuWzPABZHADNO96:E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Working with threads in the GNU C Compiler (GCC) libraries related mutex has been found

      • 2025-05-09_598f908f020334e754128988f91e67e4_elex.exe (PID: 7148)

    • Executes application which crashes

      • svchost.exe (PID: 4008)

    • Connects to unusual port

      • explorer.exe (PID: 5544)

  • INFO

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6184)

    • Checks supported languages

      • 2025-05-09_598f908f020334e754128988f91e67e4_elex.exe (PID: 7148)

    • Checks proxy server information

      • slui.exe (PID: 4200)

    • Reads the software policy settings

      • slui.exe (PID: 4200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.3)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:07 09:43:54+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 2.33
CodeSize: 866304
InitializedDataSize: 928768
UninitializedDataSize: 4096
EntryPoint: 0x14c0
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows command line
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
6
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-05-09_598f908f020334e754128988f91e67e4_elex.exe no specs conhost.exe no specs svchost.exe explorer.exe werfault.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
4008"C:\Windows\System32\svchost.exe"C:\Windows\SysWOW64\svchost.exe
2025-05-09_598f908f020334e754128988f91e67e4_elex.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
3221225477
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
4200C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5544"C:\Windows\System32\explorer.exe"C:\Windows\SysWOW64\explorer.exe
2025-05-09_598f908f020334e754128988f91e67e4_elex.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcp_win.dll
6184C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4008 -s 268C:\Windows\SysWOW64\WerFault.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6652\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—2025-05-09_598f908f020334e754128988f91e67e4_elex.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7148"C:\Users\admin\Desktop\2025-05-09_598f908f020334e754128988f91e67e4_elex.exe" C:\Users\admin\Desktop\2025-05-09_598f908f020334e754128988f91e67e4_elex.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\2025-05-09_598f908f020334e754128988f91e67e4_elex.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
5 307
Read events
5 307
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6184WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_1ad2c53f913ebd27ced77d86dd54fa83ea2cad8d_f941bfa1_735d1489-71aa-47a5-9cd2-1c777029919d\Report.wer —
MD5:—
SHA256:—
6184WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC6DE.tmp.xmlxml
MD5:FCD1F5EBDA35999091E8FD29FF515AB4
SHA256:C293646D7A7B329DF70705FA21154C694C1F9CF34C7536F272B70DB7100D5FFC
6184WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC630.tmp.dmpbinary
MD5:BBFBFD760240209AD254805D19D11755
SHA256:D8B2757B2396D4F90A7E566A061B5715BAFA9569B0EEA881B5F8F8E865B06B9F
6184WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\svchost.exe.4008.dmpbinary
MD5:4A700CB9B19605371458BE6453CEF68D
SHA256:7C833DFB98B22806FA3E6478F972E82CCFA14D3C6CD52E0E5C1E20D2B3122AD9
6184WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC6AE.tmp.WERInternalMetadata.xmlbinary
MD5:0AA8A007202DA915007C34B02262BEF6
SHA256:33F920FB0CF4AB2C9B29C160254D7D5996444C714EE897D45A17F0C81A509491
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
48
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
744
SIHClient.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
744
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
744
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
744
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
744
SIHClient.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5544
explorer.exe
192.168.85.130:4444
—
—
—
unknown
2104
svchost.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
744
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.20
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.31.130
  • 40.126.31.69
  • 40.126.31.1
  • 20.190.159.0
  • 40.126.31.131
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.159.131
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-09_598f908f020334e754128988f91e67e4_elex