File name:

71DC9540EB03F2ED4D1B6496B13FE839.exe

Full analysis: https://app.any.run/tasks/9d4f1915-285a-446c-8312-442d9d4a0f8e
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 09, 2025, 04:56:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

71DC9540EB03F2ED4D1B6496B13FE839

SHA1:

7AA1DE73654F7D6605C81D93F89245A8969D5B9C

SHA256:

8478D5F5A33850457ABC89A99718FC871B80A8FB0F5B509AC1102F441189A311

SSDEEP:

192:gBFwtiDhGHQJS2JHWteYsKqjdqJGj9Bw5Y317OwyNCbN52/lj1URfuMeVde22pPy:gLlueYMjj9Bw+lBImyJFVMFpPU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RANSOMWARE has been detected

      • 71DC9540EB03F2ED4D1B6496B13FE839.exe (PID: 7336)

  • SUSPICIOUS

    • Write to the desktop.ini file (may be used to cloak folders)

      • 71DC9540EB03F2ED4D1B6496B13FE839.exe (PID: 7336)

    • Creates file in the systems drive root

      • 71DC9540EB03F2ED4D1B6496B13FE839.exe (PID: 7336)

  • INFO

    • Reads the computer name

      • 71DC9540EB03F2ED4D1B6496B13FE839.exe (PID: 7336)

    • Creates files or folders in the user directory

      • 71DC9540EB03F2ED4D1B6496B13FE839.exe (PID: 7336)

    • Reads the machine GUID from the registry

      • 71DC9540EB03F2ED4D1B6496B13FE839.exe (PID: 7336)

    • Checks supported languages

      • 71DC9540EB03F2ED4D1B6496B13FE839.exe (PID: 7336)

    • Creates files in the program directory

      • 71DC9540EB03F2ED4D1B6496B13FE839.exe (PID: 7336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2076:10:26 04:39:09+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 10752
InitializedDataSize: 1536
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: newcryptor
FileVersion: 1.0.0.0
InternalName: newcryptor.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: newcryptor.exe
ProductName: newcryptor
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT 71dc9540eb03f2ed4d1b6496b13fe839.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe slui.exe searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
7236C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7284"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7336"C:\Users\admin\Downloads\71DC9540EB03F2ED4D1B6496B13FE839.exe" C:\Users\admin\Downloads\71DC9540EB03F2ED4D1B6496B13FE839.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
newcryptor
Version:
1.0.0.0
Modules
Images
c:\users\admin\downloads\71dc9540eb03f2ed4d1b6496b13fe839.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7344\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—71DC9540EB03F2ED4D1B6496B13FE839.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7552C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7588"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
264 148
Read events
263 691
Write events
453
Delete events
4

Modification events

(PID) Process:(7284) SearchApp.exeKey:\REGISTRY\A\{cec15006-e1d7-0083-0b8e-8f032a6b441e}\LocalState
Operation:writeName:ShouldShowCombinedConsent
Value:
016D0347F19EC0DB01
(PID) Process:(7284) SearchApp.exeKey:\REGISTRY\A\{cec15006-e1d7-0083-0b8e-8f032a6b441e}\LocalState
Operation:writeName:ShouldUnregisterAllBackgroundTasks
Value:
010D5449F19EC0DB01
(PID) Process:(7284) SearchApp.exeKey:\REGISTRY\A\{cec15006-e1d7-0083-0b8e-8f032a6b441e}\LocalState
Operation:writeName:CortanaCapabilities
Value:
000000000D5449F19EC0DB01
(PID) Process:(7284) SearchApp.exeKey:\REGISTRY\A\{cec15006-e1d7-0083-0b8e-8f032a6b441e}\LocalState
Operation:writeName:RPSServerBing
Value:
63006F007200740061006E0061002E00620069006E0067002E0063006F006D0000000D5449F19EC0DB01
(PID) Process:(7284) SearchApp.exeKey:\REGISTRY\A\{cec15006-e1d7-0083-0b8e-8f032a6b441e}\LocalState
Operation:writeName:RPSServerLive
Value:
730073006C002E006C006900760065002E0063006F006D0000000D5449F19EC0DB01
(PID) Process:(7284) SearchApp.exeKey:\REGISTRY\A\{cec15006-e1d7-0083-0b8e-8f032a6b441e}\LocalState\OnlineServices
Operation:writeName:UseTestServer
Value:
000000000D5449F19EC0DB01
(PID) Process:(7284) SearchApp.exeKey:\REGISTRY\A\{cec15006-e1d7-0083-0b8e-8f032a6b441e}\LocalState\OnlineServices\Providers\RulesRequest
Operation:writeName:Id
Value:
1E0000000D5449F19EC0DB01
(PID) Process:(7284) SearchApp.exeKey:\REGISTRY\A\{cec15006-e1d7-0083-0b8e-8f032a6b441e}\LocalState\OnlineServices\Providers\RulesRequest\HttpRequestCmd
Operation:writeName:Id
Value:
000000000D5449F19EC0DB01
(PID) Process:(7284) SearchApp.exeKey:\REGISTRY\A\{cec15006-e1d7-0083-0b8e-8f032a6b441e}\LocalState\OnlineServices\Providers\RulesRequest\HttpRequestCmd
Operation:writeName:HeaderTemplate
Value:
58002D005300650061007200630068002D00490047003A002000250032000D000A0058002D005300650061007200630068002D00550049004C0061006E0067003A002000250033000D000A0058002D005300650061007200630068002D004D00610072006B00650074003A002000250034000D000A0058002D005300650061007200630068002D0043006C00690065006E007400490044003A002000250035000D000A0058002D004100670065006E0074002D00520075006C0065007300560065007200730069006F006E003A002000250036000D000A0058002D004100670065006E0074002D005200650073006F006C007500740069006F006E003A002000250037000D000A0058002D004100670065006E0074002D00440065007600690063006500490064003A002000250038000D000A0058002D0042004D002D004F0045004D003A002000250039000D000A0058002D0042004D002D004D004F003A0020002500310030000D000A0058002D004100670065006E0074002D00500068006F006E0065004F0053005600650072003A0020002500310031000D000A00540069006D0065007A006F006E0065003A00200025003100320000000D5449F19EC0DB01
(PID) Process:(7284) SearchApp.exeKey:\REGISTRY\A\{cec15006-e1d7-0083-0b8e-8f032a6b441e}\LocalState\OnlineServices\Providers\RulesRequest\HttpRequestCmd
Operation:writeName:ParamCount
Value:
0C0000000D5449F19EC0DB01
Executable files
50
Suspicious files
11 995
Text files
2 542
Unknown types
0

Dropped files

PID
Process
Filename
Type
733671DC9540EB03F2ED4D1B6496B13FE839.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.manbinary
MD5:E779B4ACB94F0F57F286F610BEECF60A
SHA256:A87907E56A1796206B1A717710DC705772303F10785BE3647E7FEB2180D44319
733671DC9540EB03F2ED4D1B6496B13FE839.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.encryptedbybertbinary
MD5:C86F62C27F5DCFB85E3E678AFEDB130A
SHA256:5214F7A035427AF521C891FDB01ABBA56CF5B92E539B3281E97FEF8452A5D486
733671DC9540EB03F2ED4D1B6496B13FE839.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\.note.txttext
MD5:32325E4445930C92AD6897514D2DD509
SHA256:85543C5AC6319DEBBF9EDA63CBF405CE750DC55EF76F505049F937D402D88C54
733671DC9540EB03F2ED4D1B6496B13FE839.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.jsonbinary
MD5:3225C760BB85FA1BAB70D25698C5EB8D
SHA256:047D4BB0A5196397EEDCE9F628627FB960A6E06F07CE5BA4B38CB260F3863DCF
733671DC9540EB03F2ED4D1B6496B13FE839.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.inibinary
MD5:C86F62C27F5DCFB85E3E678AFEDB130A
SHA256:5214F7A035427AF521C891FDB01ABBA56CF5B92E539B3281E97FEF8452A5D486
733671DC9540EB03F2ED4D1B6496B13FE839.exeC:\ProgramData\Adobe\.note.txttext
MD5:32325E4445930C92AD6897514D2DD509
SHA256:85543C5AC6319DEBBF9EDA63CBF405CE750DC55EF76F505049F937D402D88C54
733671DC9540EB03F2ED4D1B6496B13FE839.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hashbinary
MD5:7C5DE315AEB590B1ACC5A1929F9E191D
SHA256:264FA0F7EB59D4EA20853A1E2D4BA6F2CDC3E4A6583CE66FE53E64DD15F68684
733671DC9540EB03F2ED4D1B6496B13FE839.exeC:\bootTel.datbinary
MD5:BD85BE2DEFB8EE100C043E283994327C
SHA256:24FA1C7D9F5405A86E9332F19B003B6A285798F05AD426CC615C0B9552FAB748
733671DC9540EB03F2ED4D1B6496B13FE839.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.manbinary
MD5:1318A40B5C11FCCBAC7A3B121770517C
SHA256:1374659DC9E842FE738DED1E226D7BF06625F9FF4E8B12A18F69FF921F2D9E8C
733671DC9540EB03F2ED4D1B6496B13FE839.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.manbinary
MD5:5733F8B155654AC95000602FBA18DCCF
SHA256:2A805042C2A7ADB5577D6508418D0158BF0B612649556E1B4E31D17A3A03B6BD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
33
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8148
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8148
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7284
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.10:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.216.77.10:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
72.246.169.155:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
72.246.169.155:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.65:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.10
  • 23.216.77.30
  • 23.216.77.19
  • 23.216.77.14
  • 23.216.77.23
  • 23.216.77.21
whitelisted
www.microsoft.com
  • 72.246.169.155
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.65
  • 20.190.160.2
  • 40.126.32.133
  • 20.190.160.64
  • 40.126.32.76
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.5
  • 40.126.32.138
  • 20.190.160.67
  • 20.190.160.128
  • 20.190.160.131
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
71DC9540EB03F2ED4D1B6496B13FE839.exe