| File name: | 41a95b2ea5f1469a0b71cdf6cf7d3a4f922a50d0afe78479b4470c9b5ac1dd71.exe |
| Full analysis: | https://app.any.run/tasks/5ebe1406-6f45-44ec-bfab-b343b529ba93 |
| Verdict: | Malicious activity |
| Analysis date: | November 24, 2025, 09:24:39 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 5 sections |
| MD5: | D3ACCF7C9605A7E2111A59A4DA92B4EF |
| SHA1: | C4750D05E83432029FFDBF640B3B0F4605ADE661 |
| SHA256: | 41A95B2EA5F1469A0B71CDF6CF7D3A4F922A50D0AFE78479B4470C9B5AC1DD71 |
| SSDEEP: | 24576:MUKstWIP3Ymyne8H4wSeWgTTxZsasAY5S8zoPBNoEFZ9bpv:MUKstWIP3Ymyne8HJSeWgTTLsDAY48z6 |
| .exe | | | Win64 Executable (generic) (39.5) |
|---|---|---|
| .exe | | | UPX compressed Win32 Executable (38.7) |
| .dll | | | Win32 Dynamic Link Library (generic) (9.4) |
| .exe | | | Win32 Executable (generic) (6.4) |
| .exe | | | Generic Win/DOS Executable (2.8) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 0000:00:00 00:00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 450560 |
| InitializedDataSize: | 150016 |
| UninitializedDataSize: | 802816 |
| EntryPoint: | 0x132be0 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 272 | "C:\Users\admin\Desktop\9FF6V.exe" | C:\Users\admin\Desktop\9FF6V.exe | X5X86.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 272 | "C:\Users\admin\Desktop\I3FL1.exe" | C:\Users\admin\Desktop\I3FL1.exe | LN85T.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 404 | "C:\Users\admin\Desktop\FA0M9.exe" | C:\Users\admin\Desktop\FA0M9.exe | 8K631.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 476 | "C:\Users\admin\Desktop\936IC.exe" | C:\Users\admin\Desktop\936IC.exe | CJ2BA.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 476 | "C:\Users\admin\Desktop\SMWI4.exe" | C:\Users\admin\Desktop\SMWI4.exe | RVL17.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 476 | "C:\Users\admin\Desktop\JQ7P7.exe" | C:\Users\admin\Desktop\JQ7P7.exe | Z346S.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 564 | "C:\Users\admin\Desktop\T5YK7.exe" | C:\Users\admin\Desktop\T5YK7.exe | C9R03.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 564 | "C:\Users\admin\Desktop\3Z6S8.exe" | C:\Users\admin\Desktop\3Z6S8.exe | 7D55V.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 564 | "C:\Users\admin\Desktop\MRA03.exe" | C:\Users\admin\Desktop\MRA03.exe | — | UPE07.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 660 | "C:\Users\admin\Desktop\YCU1Y.exe" | C:\Users\admin\Desktop\YCU1Y.exe | 7609I.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| (PID) Process: | (7460) 05YZJ.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (7460) 05YZJ.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (7460) 05YZJ.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (7460) 05YZJ.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (7412) 41a95b2ea5f1469a0b71cdf6cf7d3a4f922a50d0afe78479b4470c9b5ac1dd71.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (7412) 41a95b2ea5f1469a0b71cdf6cf7d3a4f922a50d0afe78479b4470c9b5ac1dd71.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (7412) 41a95b2ea5f1469a0b71cdf6cf7d3a4f922a50d0afe78479b4470c9b5ac1dd71.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (7412) 41a95b2ea5f1469a0b71cdf6cf7d3a4f922a50d0afe78479b4470c9b5ac1dd71.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (7512) PIJ5L.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (7512) PIJ5L.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7688 | T7IA7.exe | C:\Users\admin\Desktop\X45B2.exe | executable | |
MD5:7A09D74B6677D5A6C4853B027C1A07C6 | SHA256:AB058D4E876F72CE011ECC8113A0612C51DB597745FAF13DF310AE3D9DBAF812 | |||
| 7412 | 41a95b2ea5f1469a0b71cdf6cf7d3a4f922a50d0afe78479b4470c9b5ac1dd71.exe | C:\Users\admin\Desktop\05YZJ.exe | executable | |
MD5:304510B40A186DCDB19CE67C0F05C91C | SHA256:72D3B082783D3F38067A5C0145E1D42EC2EC5AC1048880145BFDE0F4BCFD1EBE | |||
| 7436 | 3B451.exe | C:\Users\admin\Desktop\713X7.exe | executable | |
MD5:F649DC0878B17CB35D0BC5EED2B13FEF | SHA256:70E01CDF6737AE5D85A7DBE8A071855D4087E44741E8BB1A29E89339068F0006 | |||
| 7632 | Y25VX.exe | C:\Users\admin\Desktop\M5XB6.exe | executable | |
MD5:887E0021A2A7CCCA5ACC1A51673BFB62 | SHA256:DAF61ECC64B98250A1DFAE0E7C6D22E7A4B335241866C630528FDEF328317F7F | |||
| 4104 | ACCNF.exe | C:\Users\admin\Desktop\674L6.exe | executable | |
MD5:BA82FF511E4DB143B61A9BF60305CCBC | SHA256:F7039B52F44803AF4866A33B51557C486BC397D50EE7801E2EFB299D70CCDE2C | |||
| 8160 | S861Y.exe | C:\Users\admin\Desktop\ACCNF.exe | executable | |
MD5:048CCDEF767FD655429075F3F667F0BB | SHA256:81577D1D296BD2F64AEBBF495EA3E14BD349059A4C13F73A4CA60A3E1568EBD4 | |||
| 7528 | 713X7.exe | C:\Users\admin\Desktop\152D8.exe | executable | |
MD5:DCE978A74CF5DFC216EF4A85327A09DB | SHA256:08F5512778FED50319FF07E5B858061806377BE5C2709A2B766417408A2CFF45 | |||
| 7788 | M5XB6.exe | C:\Users\admin\Desktop\Z06ZC.exe | executable | |
MD5:45B2B04C61363A81962E8DB506D625CA | SHA256:4EC8F3B12B212979578F26067C29B93D5A2AB2699B1D2E483F0E4822AD18C576 | |||
| 7872 | Z06ZC.exe | C:\Users\admin\Desktop\910G6.exe | executable | |
MD5:4ABFC4025E01DA4DF30343DC0DA6599D | SHA256:A6228402F6DB4A6A21AF3550A29A66DB2E008F8607F8D80CB2D57E8F397DB970 | |||
| 7512 | PIJ5L.exe | C:\Users\admin\Desktop\AE0TB.exe | executable | |
MD5:1BD0E0E029675686D22F94042568485B | SHA256:4E92A09016663996FE4A7746C21633993871FCF4319141569D8ADE36E5AA8541 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2564 | svchost.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4592 | RUXIMICS.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5596 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | POST | 200 | 40.126.32.136:443 | https://login.live.com/RST2.srf | unknown | xml | 11.1 Kb | unknown |
— | — | POST | 200 | 20.190.160.128:443 | https://login.live.com/RST2.srf | unknown | xml | 10.3 Kb | unknown |
— | — | POST | 200 | 20.190.160.67:443 | https://login.live.com/RST2.srf | unknown | xml | 10.3 Kb | unknown |
— | — | POST | 200 | 20.190.160.128:443 | https://login.live.com/RST2.srf | unknown | xml | 10.3 Kb | unknown |
— | — | POST | 200 | 40.126.32.136:443 | https://login.live.com/RST2.srf | unknown | xml | 11.0 Kb | unknown |
— | — | GET | 200 | 20.3.187.198:443 | https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping | unknown | — | — | unknown |
— | — | GET | 200 | 74.179.77.204:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | unknown | compressed | 29.1 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2564 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5596 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4592 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 92.123.104.31:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2564 | svchost.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5596 | MoUsoCoreWorker.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4592 | RUXIMICS.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5596 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |