File name:

GenP-v3.6.7.exe

Full analysis: https://app.any.run/tasks/c7cd7260-6c7b-4e75-8f6a-c8291f2b4c82
Verdict: Malicious activity
Analysis date: June 21, 2025, 21:45:11
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 3 sections
MD5:

FBBB675ACD2DCCF8D84DBDA28FADB8E5

SHA1:

3A389CC4EC87D7152E1E3EB8FCA7B08C57502F5B

SHA256:

6A30E203386035F8FA6BAEACC8A527093331C0C6712103F974DC10DDF5EC9AF8

SSDEEP:

49152:1etKmupSfNHjl4ClQaig25jSHY7GvXiADpB/2mPAShIHF//KlNKYOJCTOB2U20w2:8tKDpSRjVKjg25j1Shps8hhEOKYYCTOf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • GenP-v3.6.7.exe (PID: 1700)

  • INFO

    • Reads the computer name

      • GenP-v3.6.7.exe (PID: 1700)

    • Reads mouse settings

      • GenP-v3.6.7.exe (PID: 1700)

    • The sample compiled with english language support

      • GenP-v3.6.7.exe (PID: 1700)

    • Checks supported languages

      • GenP-v3.6.7.exe (PID: 1700)

    • Create files in a temporary directory

      • GenP-v3.6.7.exe (PID: 1700)

    • UPX packer has been detected

      • GenP-v3.6.7.exe (PID: 1700)

    • The process uses AutoIt

      • GenP-v3.6.7.exe (PID: 1700)

    • Checks proxy server information

      • slui.exe (PID: 1128)

    • Reads the software policy settings

      • slui.exe (PID: 1128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (87.1)
.exe | Generic Win/DOS Executable (6.4)
.exe | DOS Executable Generic (6.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:06:17 20:16:01+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.16
CodeSize: 421888
InitializedDataSize: 1105920
UninitializedDataSize: 1740800
EntryPoint: 0x20fe70
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 3.6.7.0
ProductVersionNumber: 3.6.7.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
FileVersion: 3.6.7.0
Comments: GenP
FileDescription: GenP
ProductName: GenP
ProductVersion: 3.6.7
CompanyName: GenP
LegalCopyright: GenP 2025
LegalTradeMarks: GenP 2025
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start genp-v3.6.7.exe slui.exe genp-v3.6.7.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1128C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1700"C:\Users\admin\Desktop\GenP-v3.6.7.exe" C:\Users\admin\Desktop\GenP-v3.6.7.exe
explorer.exe
User:
admin
Company:
GenP
Integrity Level:
HIGH
Description:
GenP
Version:
3.6.7.0
Modules
Images
c:\users\admin\desktop\genp-v3.6.7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5712"C:\Users\admin\Desktop\GenP-v3.6.7.exe" C:\Users\admin\Desktop\GenP-v3.6.7.exe—explorer.exe
User:
admin
Company:
GenP
Integrity Level:
MEDIUM
Description:
GenP
Exit code:
3221226540
Version:
3.6.7.0
Modules
Images
c:\users\admin\desktop\genp-v3.6.7.exe
c:\windows\system32\ntdll.dll
Total events
3 511
Read events
3 511
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1700GenP-v3.6.7.exeC:\Users\admin\AppData\Local\Temp\aut6E79.tmpbinary
MD5:84391D99736B7FC581A7A2BDE4D704B5
SHA256:4003557952D9742FCB485051F41136B55E762FC2908057DCEE60808BE5BE5C40
1700GenP-v3.6.7.exeC:\Users\admin\Desktop\config.initext
MD5:5ABBD155C17F49D4528DEAC35D3E0304
SHA256:A2CFDE70D9E658CB2392EE9EE1F3F6012491F1C2B9794CDA9EBC549B2F7E6BAB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
19
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2028
RUXIMICS.exe
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2028
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2028
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
2028
RUXIMICS.exe
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2028
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 216.58.212.142
whitelisted
crl.microsoft.com
  • 23.55.104.190
  • 23.55.104.172
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
self.events.data.microsoft.com
  • 20.42.73.27
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GenP-v3.6.7.exe