File name:

Prince-Built.exe

Full analysis: https://app.any.run/tasks/19b4a65c-0880-4d36-9185-e999d987bc40
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 25, 2025, 22:50:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
prince
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 8 sections
MD5:

A5A76656CBAE51C282966DF2AF279D44

SHA1:

7825EC99785D4F57E257523056D395F26A81D6CB

SHA256:

57C3D963CE2C0362E689E21847A95DF73D30B8BF5C9E2CB247B681CEEBD90700

SSDEEP:

49152:6Ffos7O/o/ey/fovW+lAW7uvYfsGQIPooFlaFLBy7Puppp9yMeZsplkehd23YNa9:6xawGyIBltq6o2qFy7PQx8QGZSC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PRINCE has been detected

      • Prince-Built.exe (PID: 4452)

    • RANSOMWARE has been detected

      • Prince-Built.exe (PID: 4452)

    • Renames files like ransomware

      • Prince-Built.exe (PID: 4452)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 3100)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • Prince-Built.exe (PID: 4452)

    • Starts POWERSHELL.EXE for commands execution

      • Prince-Built.exe (PID: 4452)

    • Probably download files using WebClient

      • Prince-Built.exe (PID: 4452)

    • Changes wallpaper

      • Prince-Built.exe (PID: 4452)

    • Imports DLL using pinvoke

      • powershell.exe (PID: 3956)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 5376)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 5376)

  • INFO

    • Checks supported languages

      • Prince-Built.exe (PID: 4452)
      • csc.exe (PID: 5376)
      • cvtres.exe (PID: 6708)

    • Creates files in the program directory

      • Prince-Built.exe (PID: 4452)

    • Creates files or folders in the user directory

      • Prince-Built.exe (PID: 4452)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • Prince-Built.exe (PID: 4452)

    • Disables trace logs

      • powershell.exe (PID: 3100)

    • Checks proxy server information

      • powershell.exe (PID: 3100)
      • slui.exe (PID: 4164)

    • Manual execution by a user

      • OpenWith.exe (PID: 4228)
      • rundll32.exe (PID: 1040)
      • notepad.exe (PID: 4976)
      • rundll32.exe (PID: 5360)
      • OpenWith.exe (PID: 4272)
      • rundll32.exe (PID: 736)
      • rundll32.exe (PID: 5956)
      • OpenWith.exe (PID: 7020)
      • rundll32.exe (PID: 3900)
      • OpenWith.exe (PID: 1812)
      • OpenWith.exe (PID: 1188)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 4976)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 5376)

    • Create files in a temporary directory

      • csc.exe (PID: 5376)
      • cvtres.exe (PID: 6708)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 1188)
      • OpenWith.exe (PID: 7020)
      • OpenWith.exe (PID: 4228)
      • OpenWith.exe (PID: 4272)
      • OpenWith.exe (PID: 1812)

    • Reads the software policy settings

      • slui.exe (PID: 4164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 1174528
InitializedDataSize: 163840
UninitializedDataSize: -
EntryPoint: 0x73960
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
19
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #PRINCE prince-built.exe no specs powershell.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs notepad.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs openwith.exe no specs openwith.exe no specs rundll32.exe no specs rundll32.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
736"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\academicif.jpgC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1040"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\copyrightcritical.jpgC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1188"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\academicif.jpg.princeC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1812"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\cheapca.jpg.princeC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3100powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://i.imgur.com/RfsCOES.png', 'C:\Users\admin\AppData\Local\Temp\Wallpaper.png')"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Prince-Built.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3900"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\cheapca.jpgC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3956powershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); public static void Set(string path) { SystemParametersInfo(20, 0, path, 3); } }'; [Wallpaper]::Set('C:\Users\admin\AppData\Local\Temp\Wallpaper.png')"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Prince-Built.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4164C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4228"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\copyrightcritical.jpg.princeC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4272"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\outanimal.jpg.princeC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
17 809
Read events
17 809
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
76
Text files
60
Unknown types
0

Dropped files

PID
Process
Filename
Type
4452Prince-Built.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
4452Prince-Built.exeC:\ProgramData\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
4452Prince-Built.exeC:\Users\Default\Pictures\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
4452Prince-Built.exeC:\Users\Default\Downloads\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
4452Prince-Built.exeC:\Users\Public\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
4452Prince-Built.exeC:\Users\Default\Desktop\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
4452Prince-Built.exeC:\Users\admin\Desktop\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
4452Prince-Built.exeC:\Users\admin\Contacts\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
4452Prince-Built.exeC:\Users\admin\AppData\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
4452Prince-Built.exeC:\Users\Default\Favorites\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
50
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
5084
SIHClient.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
200
40.69.42.241:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
—
—
GET
200
4.175.87.197:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3100
powershell.exe
199.232.192.193:443
i.imgur.com
FASTLY
US
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5084
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.3
  • 20.190.159.2
  • 20.190.159.73
  • 20.190.159.0
  • 40.126.31.73
  • 20.190.159.68
  • 20.190.159.23
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
  • 172.211.123.248
whitelisted
google.com
  • 142.250.185.78
whitelisted
i.imgur.com
  • 199.232.192.193
  • 199.232.196.193
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
  • 172.202.163.200
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image Sharing Service (imgur.com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Prince-Built.exe