File name:

probos.exe.bin

Full analysis: https://app.any.run/tasks/27f0ecac-afb8-498b-99ba-d3e7b748bae0
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 18:27:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
makop
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

6096DEC7644520BA1A4FDC04183BB62F

SHA1:

F0EAE70B15D663787858A5CC24D8FDF21B67F225

SHA256:

68DD91E49256EE61CA05A5309DB255E9FFE23E8DF680ACE95D48346E2A39C260

SSDEEP:

768:33Wdq9CUDGWY3zZlVV0ieMM7SxTtLyLyOsYYrW0G28um1vhJjHVuEY8p:nWWQzpVheMM7SxTeo8/vPTkEY8p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MAKOP mutex has been found

      • probos.exe.bin.exe (PID: 4300)

    • Renames files like ransomware

      • probos.exe.bin.exe (PID: 4300)

    • Deletes shadow copies

      • cmd.exe (PID: 4652)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • probos.exe.bin.exe (PID: 4300)

    • There is functionality for taking screenshot (YARA)

      • probos.exe.bin.exe (PID: 4300)

  • INFO

    • Checks supported languages

      • probos.exe.bin.exe (PID: 4300)
      • identity_helper.exe (PID: 4128)

    • Reads the machine GUID from the registry

      • probos.exe.bin.exe (PID: 4300)

    • Reads Windows Product ID

      • probos.exe.bin.exe (PID: 4300)

    • Reads the computer name

      • probos.exe.bin.exe (PID: 4300)
      • identity_helper.exe (PID: 4128)

    • Manual execution by a user

      • notepad.exe (PID: 7772)
      • WINWORD.EXE (PID: 6032)
      • msedge.exe (PID: 672)

    • Reads the software policy settings

      • slui.exe (PID: 7332)
      • slui.exe (PID: 8064)

    • Checks proxy server information

      • slui.exe (PID: 8064)

    • Application launched itself

      • msedge.exe (PID: 5136)
      • msedge.exe (PID: 672)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6808)
      • notepad.exe (PID: 7772)

    • Reads Environment values

      • identity_helper.exe (PID: 4128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:11:19 17:28:24+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 27648
InitializedDataSize: 89088
UninitializedDataSize: -
EntryPoint: 0x5380
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
180
Monitored processes
37
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #MAKOP probos.exe.bin.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs wbadmin.exe no specs wmic.exe no specs sppextcomobj.exe no specs slui.exe notepad.exe no specs slui.exe rundll32.exe no specs winword.exe ai.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=DefaultC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
780"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2560 --field-trial-handle=2420,i,10380617972594613404,8264128308803365056,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
1004"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=2432,i,16067609952918935861,11831565266450039998,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
2384"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3304 --field-trial-handle=2420,i,10380617972594613404,8264128308803365056,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
2644"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5072 --field-trial-handle=2420,i,10380617972594613404,8264128308803365056,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
3012"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3696 --field-trial-handle=2432,i,16067609952918935861,11831565266450039998,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
3796"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3516 --field-trial-handle=2432,i,16067609952918935861,11831565266450039998,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
4000"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2716 --field-trial-handle=2432,i,16067609952918935861,11831565266450039998,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
4128"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5056 --field-trial-handle=2420,i,10380617972594613404,8264128308803365056,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
4300"C:\Users\admin\Desktop\probos.exe.bin.exe" C:\Users\admin\Desktop\probos.exe.bin.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
37
Suspicious files
345
Text files
93
Unknown types
1

Dropped files

PID
Process
Filename
Type
6032WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:DCC7D4D5FA27AFEEA62241802099C310
SHA256:63B4AC83A7075EC6E9541F5C8938B86C9F77CC80A0B0916261177F0E0C1E55C1
4300probos.exe.bin.exeC:\Users\admin\Desktop\rootsuite.rtf.[C8E7DCE6].[datastore@cyberfear.com].mkpbinary
MD5:27E4CA1C956A36D2FC77A458EAA893EE
SHA256:DD85276E0B40CD299FC9B4F0B733CA9B33C39D915302E70590DE86E0C081F9D2
6032WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:5E0E5186FA67BCEA2D71A4C0ECE575F0
SHA256:EC572769DFE01D0B1760DFC00C8851648EB66D10E09FB8D252A8E05BAC3E231E
4300probos.exe.bin.exeC:\Users\admin\Desktop\thinkplans.rtf.[C8E7DCE6].[datastore@cyberfear.com].mkpbinary
MD5:9226AFB953A930A086B7944D95279BF8
SHA256:59E00BDBF3494DC3F4EA7E32284863467FE56CE9A64140524B243DB90DCBF62A
4300probos.exe.bin.exeC:\ProgramData\USOShared\Logs\User\NotificationUx.da2258fc-7865-4177-b688-8387f4a06d97.1.etlbinary
MD5:B66CE459636BAA0E4A745AF5BD1B2737
SHA256:8EAB375FD785688EF17BD77DEEDE6CFEE6FFB683A364FBE235BEEDA4D9BF3E1F
6032WINWORD.EXEC:\Users\admin\Documents\~$ternetfishing.rtfbinary
MD5:9D4995A79B0AD7B60D22E5326FC03237
SHA256:7E359F619319326B8F30341D4FB5D3AE3B87A7303165425D7BEDAE34DF91DE47
4300probos.exe.bin.exeC:\Users\admin\Desktop\percentteens.rtf.[C8E7DCE6].[datastore@cyberfear.com].mkpbinary
MD5:708E6FDB959506AC0A7435349482DD23
SHA256:B458C4E19A8B66E564B5CD40DD6B0FF5AB4547E31CD3229BEEE533594B31AE70
6032WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\7DBB07E1-7B7D-4C7C-A123-83A6BC9F72B2xml
MD5:EC0AB13DAE8721217ABAC1163BC83A1A
SHA256:97DD79B619A822AD0E155B8187CBA56DD7C3D4D0ADE684D84A7E1CBFCA59F60F
4300probos.exe.bin.exeC:\Users\admin\Desktop\canadianinstallation.png.[C8E7DCE6].[datastore@cyberfear.com].mkpbinary
MD5:AC8498A65E65FE92A8EAFF14D133A0DB
SHA256:1C792CB81E4D0128AE6BD79A7F3D88289F2C9EDE1ED740AB6E8D6C3BE75C7499
4300probos.exe.bin.exeC:\Users\admin\Desktop\wordsnever.jpg.[C8E7DCE6].[datastore@cyberfear.com].mkpbinary
MD5:3F847DCA1E3C50739F27F1A39CAE38DF
SHA256:75A33AA5D7913C221095D7A1A27CF2C0275613AAC07B17E52C1FC396AF18D279
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
88
DNS requests
90
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6032
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
7936
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6032
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7936
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.65:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7936
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7936
SIHClient.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.65
  • 20.190.160.2
  • 20.190.160.67
  • 40.126.32.138
  • 40.126.32.134
  • 20.190.160.14
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.66
  • 20.190.160.131
  • 40.126.32.136
  • 20.190.160.128
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
probos.exe.bin