File name:

NewPurchaseOrder.exe

Full analysis: https://app.any.run/tasks/fd22bd58-e9f6-44d8-86a0-4d51fb853e82
Verdict: Malicious activity
Analysis date: March 25, 2025, 07:21:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

D6E27EBA7CE52A97269531309B3CE30C

SHA1:

8BFA189B8958527DF12E76A20FE787C5F4C93B7F

SHA256:

905CA82E14094EAF2E1D9F2349C53368F3CD2186A381E1B59280DFB7B1F12A39

SSDEEP:

49152:bHlGAXWQkC2R/QORBt7QjFtmcaTH/vU4do9Pcjq1GvXB1sgPR8N32+Rr181vWDZr:gAGQX21RBt7QjTmcaTH/vU4do9Pcjq1u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • neophobia.exe (PID: 7584)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • NewPurchaseOrder.exe (PID: 7544)

    • Starts itself from another location

      • NewPurchaseOrder.exe (PID: 7544)

    • Executes application which crashes

      • neophobia.exe (PID: 7584)
      • neophobia.exe (PID: 8020)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7968)

  • INFO

    • Reads the machine GUID from the registry

      • NewPurchaseOrder.exe (PID: 7544)

    • Create files in a temporary directory

      • NewPurchaseOrder.exe (PID: 7544)
      • neophobia.exe (PID: 7584)
      • neophobia.exe (PID: 8020)

    • Reads mouse settings

      • NewPurchaseOrder.exe (PID: 7544)
      • neophobia.exe (PID: 7584)
      • neophobia.exe (PID: 8020)

    • The sample compiled with english language support

      • NewPurchaseOrder.exe (PID: 7544)

    • Checks supported languages

      • NewPurchaseOrder.exe (PID: 7544)
      • neophobia.exe (PID: 7584)
      • neophobia.exe (PID: 8020)

    • Creates files or folders in the user directory

      • NewPurchaseOrder.exe (PID: 7544)
      • neophobia.exe (PID: 7584)
      • WerFault.exe (PID: 7740)
      • WerFault.exe (PID: 8080)

    • Autorun file from Startup directory

      • neophobia.exe (PID: 7584)

    • Manual execution by a user

      • wscript.exe (PID: 7968)

    • Checks proxy server information

      • slui.exe (PID: 6620)

    • Reads the software policy settings

      • slui.exe (PID: 6620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:25 01:36:44+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581120
InitializedDataSize: 418816
UninitializedDataSize: -
EntryPoint: 0x27dcd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
9
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start newpurchaseorder.exe neophobia.exe regsvcs.exe no specs werfault.exe no specs wscript.exe no specs neophobia.exe regsvcs.exe no specs werfault.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
6620C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7544"C:\Users\admin\Desktop\NewPurchaseOrder.exe" C:\Users\admin\Desktop\NewPurchaseOrder.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\newpurchaseorder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
7584"C:\Users\admin\Desktop\NewPurchaseOrder.exe" C:\Users\admin\AppData\Local\porcelainization\neophobia.exe
NewPurchaseOrder.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\porcelainization\neophobia.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
7608"C:\Users\admin\Desktop\NewPurchaseOrder.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—neophobia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
7740C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7584 -s 736C:\Windows\SysWOW64\WerFault.exe—neophobia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7968"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neophobia.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8020"C:\Users\admin\AppData\Local\porcelainization\neophobia.exe" C:\Users\admin\AppData\Local\porcelainization\neophobia.exe
wscript.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\porcelainization\neophobia.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
8044"C:\Users\admin\AppData\Local\porcelainization\neophobia.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—neophobia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
8080C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8020 -s 748C:\Windows\SysWOW64\WerFault.exe—neophobia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
7 215
Read events
7 215
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
11
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_neophobia.exe_5f2a27e5d0231b7e88e7d353bdf137575dc8f22_068f149e_582e8661-e68a-485d-8cd2-35cb72781bc0\Report.wer —
MD5:—
SHA256:—
8080WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_neophobia.exe_5f2a27e5d0231b7e88e7d353bdf137575dc8f22_068f149e_c5245621-dfd0-4e22-b0f3-b9ea96ac9f02\Report.wer —
MD5:—
SHA256:—
7544NewPurchaseOrder.exeC:\Users\admin\AppData\Local\porcelainization\neophobia.exeexecutable
MD5:D6E27EBA7CE52A97269531309B3CE30C
SHA256:905CA82E14094EAF2E1D9F2349C53368F3CD2186A381E1B59280DFB7B1F12A39
7584neophobia.exeC:\Users\admin\AppData\Local\Temp\autD4A7.tmpbinary
MD5:DD4004987233C232346C752707756438
SHA256:6C669756BE49FE20FE61F6E47DFF19BEC274D7CE2F77894A98479C1456A0D096
7544NewPurchaseOrder.exeC:\Users\admin\AppData\Local\Temp\cacostomiabinary
MD5:9237AF4AB527FF7AD4D91E76844FBF75
SHA256:859C706D3F35E9B67FD8DA6BB4DB748625DDBB4BA85B630F7B829B835A22D93E
7740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERDB11.tmp.WERInternalMetadata.xmlbinary
MD5:B231EC6D533B53FB9F6E648A605380E4
SHA256:3DEF1FB879884EA259BF151C1183E646D5301A70276CC52517EB6448BCC7E892
7740WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\neophobia.exe.7584.dmpbinary
MD5:434D30CBFB24FABDD7467DF4C8D2F74D
SHA256:149BB99932B0036139CA1C3E474081B59FA245B913492458F5BE41E2E81AB16E
7584neophobia.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neophobia.vbsbinary
MD5:4D13CDEAC65154A7C96CB558351991FA
SHA256:439DF17A5BC50C37B638A2322F90090FD3632C03A776CE5FB844C21E87C38D47
7740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERDB50.tmp.xmlxml
MD5:88D790B0617C8996E36493F3F8FE2A2B
SHA256:8EBBE9CBB67FD2BA67BB1D4FC44A94DD8A6192457A9D8D7CB5057449E03760EB
7740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD9B8.tmp.dmpbinary
MD5:FB9A46A699F34A855C55FD9368DA64C4
SHA256:583C7DA20BAC4FBDA687FEBA7E6877FFE1E6721B359D1F0C14E49BAA51D1D159
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
54
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
5164
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
5164
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
5164
SIHClient.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
5164
SIHClient.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
5164
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5164
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
200
20.223.36.55:443
https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20250325T072210Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=189856670973453996aca7880ea112e0&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1280&dispsize=15.3&dispvertres=720&fosver=16299&isu=0&lo=3968601&metered=false&nettype=ethernet&npid=sc-310091&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&rver=2&smBiosDm=DELL&stabedgever=122.0.2365.59&tl=2&tsu=1359131&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2
unknown
binary
1.38 Kb
whitelisted
—
—
GET
200
20.223.36.55:443
https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20250325T072210Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=57eba4a5876a4cbfa3f363027a3cb8f2&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&currsel=137271744000000000&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1280&dispsize=15.3&dispvertres=720&fosver=16299&isu=0&lo=3968601&metered=false&nettype=ethernet&npid=sc-88000045&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&smBiosDm=DELL&stabedgever=122.0.2365.59&tl=2&tsu=1359131&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2
unknown
binary
2.95 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6544
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7320
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5164
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
login.live.com
  • 20.190.159.128
  • 20.190.159.23
  • 40.126.31.67
  • 40.126.31.128
  • 40.126.31.73
  • 40.126.31.131
  • 20.190.159.129
  • 40.126.31.130
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NewPurchaseOrder.exe