File name:

2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop

Full analysis: https://app.any.run/tasks/a2ec2fa2-1b4b-42b0-850b-4b6abc7dad99
Verdict: Malicious activity
Analysis date: June 21, 2025, 03:19:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
worm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

92918FAB935F144CB814D4605D69C4A5

SHA1:

79557373C1C42EBB84355B70C96DE017DFC4B59F

SHA256:

36853390CE4A79B5C4290DE14BB09C8FC44860AC93BB7F267505194D09F190F5

SSDEEP:

49152:QfqLhW1kVeZY/Q5b3mcjwGtDL3bj9ZUmJRv0gA+LRv0gA+LRv0gA+ntzEhfbbAF0:kqLhckVIV3bj9ZUoRcgpLRcgpLRcgptK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

    • Starts CMD.EXE for commands execution

      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

    • Reads security settings of Internet Explorer

      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

    • There is functionality for taking screenshot (YARA)

      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

  • INFO

    • Failed to create an executable file in Windows directory

      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

    • Create files in a temporary directory

      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

    • Checks supported languages

      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

    • The sample compiled with english language support

      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

    • Reads the computer name

      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

    • Launching a file from a Registry key

      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

    • Checks proxy server information

      • slui.exe (PID: 2220)
      • 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe (PID: 2952)

    • Reads the software policy settings

      • slui.exe (PID: 2220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (56.1)
.scr | Windows screen saver (26.6)
.exe | Win32 Executable (generic) (9.1)
.exe | Generic Win/DOS Executable (4)
.exe | DOS Executable Generic (4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:11:25 09:21:46+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 497664
InitializedDataSize: 141824
UninitializedDataSize: -
EntryPoint: 0x53e3d
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows 32-bit
ObjectFileType: Dynamic link library
FileSubtype: 3
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe cmd.exe no specs conhost.exe no specs at.exe no specs cmd.exe no specs conhost.exe no specs at.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1044C:\WINDOWS\system32\cmd.exe /C AT /delete /yesC:\Windows\SysWOW64\cmd.exe—2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2220C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2804C:\WINDOWS\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\WINDOWS\system32\winhelp.exeC:\Windows\SysWOW64\cmd.exe—2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2952"C:\Users\admin\Desktop\2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe" C:\Users\admin\Desktop\2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3820\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4748AT /delete /yesC:\Windows\SysWOW64\at.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Schedule service command line interface
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\at.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6756AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\WINDOWS\system32\winhelp.exeC:\Windows\SysWOW64\at.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Schedule service command line interface
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\at.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
4 043
Read events
4 041
Write events
2
Delete events
0

Modification events

(PID) Process:(2952) 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Yahoo Messengger
Value:
C:\WINDOWS\system32\regsvr.exe
(PID) Process:(2952) 2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares
Operation:writeName:shared
Value:
\New Folder.exe
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
29522025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exeC:\Users\admin\AppData\Local\Temp\aut6D70.tmpexecutable
MD5:2D970F73F59924E890F7D4D7110CE622
SHA256:1F801DC4BB3DD3FA81F4D0541631DF522A27BE800C7BBD24125C03CF923D85C5
29522025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exeC:\Users\admin\AppData\Local\Temp\aut6D6F.tmpbinary
MD5:95A563C56954CB237B0A2C754AE3CDC4
SHA256:D3BDCF4FA517D471457F1679256BB4DE73E5A86857C64D2BFDA93FDE11D7C318
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
25
DNS requests
10
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4808
RUXIMICS.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2952
2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
GET
—
45.63.71.7:80
http://www.crackspider.net/setting.doc
unknown
—
—
malicious
4808
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2952
2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
GET
—
45.63.71.7:80
http://www.crackspider.net/setting.xls
unknown
—
—
malicious
2952
2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
GET
—
45.63.71.7:80
http://www.crackspider.net/setting.doc
unknown
—
—
malicious
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4808
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
4808
RUXIMICS.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5944
MoUsoCoreWorker.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
2952
2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
45.63.71.7:80
www.crackspider.net
AS-CHOOPA
US
malicious
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
whitelisted
www.crackspider.net
  • 45.63.71.7
malicious
www.microsoft.com
  • 95.101.149.131
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
self.events.data.microsoft.com
  • 20.189.173.3
whitelisted

Threats

PID
Process
Class
Message
2952
2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
A Network Trojan was detected
ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc
2952
2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
A Network Trojan was detected
ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.xls
2952
2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
A Network Trojan was detected
ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc
2952
2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
A Network Trojan was detected
ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.xls
2952
2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
A Network Trojan was detected
ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc
2952
2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop.exe
A Network Trojan was detected
ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.xls
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-21_92918fab935f144cb814d4605d69c4a5_elex_stop