File name:

290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe

Full analysis: https://app.any.run/tasks/2b65a5be-935c-4ae5-9a7d-9a0c675d6832
Verdict: Malicious activity
Analysis date: July 08, 2025, 05:59:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 2 sections
MD5:

07A9EFEC6B567DC446E583301ED19916

SHA1:

C92A06C98D98069A60CCAB3FD2FA0F5D07E01079

SHA256:

290791F4391996E9AA24D0C96A6EB02EF08B09B753E5E36176DDE9D6CFA05288

SSDEEP:

1536:566aYSZKAW0vaKzaomlRsVE6LeWOxL2b3ciLVwee7uos1bolVORdMjj4Edd:5laYSNv+Rsq6fOBG3cdYCSbMjkE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe (PID: 6124)
      • net.exe (PID: 6648)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe (PID: 6124)
      • cmd.exe (PID: 2324)

    • Executing commands from a ".bat" file

      • 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe (PID: 6124)

    • Starts CMD.EXE for commands execution

      • 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe (PID: 6124)

  • INFO

    • Checks supported languages

      • 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe (PID: 6124)
      • 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe (PID: 3656)

    • The sample compiled with chinese language support

      • 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe (PID: 6124)

    • Failed to create an executable file in Windows directory

      • 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe (PID: 6124)

    • Create files in a temporary directory

      • 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe (PID: 6124)

    • Reads the computer name

      • 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe (PID: 3656)

    • Checks proxy server information

      • slui.exe (PID: 7080)

    • Reads the software policy settings

      • slui.exe (PID: 7080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | DOS Executable Generic (100)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 0.37
CodeSize: 73728
InitializedDataSize: 28160
UninitializedDataSize: -
EntryPoint: 0x359ed
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Windows, Chinese (Simplified)
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
ProductName: -
ProductVersion: 1.0.0.0
Comments: -
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe net.exe no specs conhost.exe no specs net1.exe no specs cmd.exe conhost.exe no specs 290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2040C:\WINDOWS\system32\net1 stop "Kingsoft AntiVirus Service"C:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
2324C:\WINDOWS\system32\cmd.exe /c C:\Users\admin\AppData\Local\Temp\$a6A62.batC:\Windows\SysWOW64\cmd.exe
290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3656"C:\Users\admin\Desktop\290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe"C:\Users\admin\Desktop\290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6124"C:\Users\admin\Desktop\290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe" C:\Users\admin\Desktop\290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6648net stop "Kingsoft AntiVirus Service"C:\Windows\SysWOW64\net.exe—290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7052\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7080C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 536
Read events
3 536
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6124290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exeC:\Users\admin\Desktop\290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe.exeexecutable
MD5:7B112B1FB864C90EC5B65EAB21CB40B8
SHA256:751941B4E09898C31791EFEB5F90FC7367C89831D4A98637ED505E40763E287B
6124290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exeC:\Users\admin\AppData\Local\Temp\$a6A62.battext
MD5:B8CAA7555F87A9442F41D67E5AD35092
SHA256:EF9841DFFD8B7A1F2C1CCC3B04FB3336083EFA085106F6BA3E9A3AEBFCFFE153
2324cmd.exeC:\Users\admin\Desktop\290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exeexecutable
MD5:7B112B1FB864C90EC5B65EAB21CB40B8
SHA256:751941B4E09898C31791EFEB5F90FC7367C89831D4A98637ED505E40763E287B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
52
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
40.126.31.1:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
400
40.126.31.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
40.126.31.73:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
40.126.31.131:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1976
RUXIMICS.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
400
20.190.159.2:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1976
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1976
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5240
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1976
RUXIMICS.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.46
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.131
  • 20.190.159.23
  • 40.126.31.71
  • 40.126.31.1
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.129
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.22
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
  • 172.211.123.248
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
290791f4391996e9aa24d0c96a6eb02ef08b09b753e5e36176dde9d6cfa05288.exe