File name:

xpaj.exe

Full analysis: https://app.any.run/tasks/52cbe7c8-0895-4650-a64a-4a25ab43e748
Verdict: Malicious activity
Analysis date: January 13, 2026, 18:02:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed, 3 sections
MD5:

D5C12FCFEEBBE63F74026601CD7F39B2

SHA1:

50281DE9ABB1BEC1B6A1F13CCD3CE3493DEE8850

SHA256:

9DB7EF2D1495DBA921F3084B05D95E418A16F4C5E8DE93738ABEF2479AD5B0DA

SSDEEP:

6144:Gqmg/v4y/MqGs38KHF1SubUriPOKAJnP8:jmgXxXGNKHCm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs injected code in another process

      • xpaj.exe (PID: 7468)

    • Application was injected by another process

      • explorer.exe (PID: 4972)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • xpaj.exe (PID: 7468)

    • The process creates files with name similar to system file names

      • WerFault.exe (PID: 7656)

    • Reads security settings of Internet Explorer

      • StartMenuExperienceHost.exe (PID: 8096)

    • Executes application which crashes

      • explorer.exe (PID: 4972)

    • Reads the date of Windows installation

      • StartMenuExperienceHost.exe (PID: 8096)
      • SearchApp.exe (PID: 7192)

    • There is functionality for taking screenshot (YARA)

      • xpaj.exe (PID: 7468)

  • INFO

    • Create files in a temporary directory

      • xpaj.exe (PID: 7468)

    • Checks supported languages

      • xpaj.exe (PID: 7468)
      • TextInputHost.exe (PID: 8128)
      • StartMenuExperienceHost.exe (PID: 8096)
      • SearchApp.exe (PID: 7192)

    • Manual execution by a user

      • WerFault.exe (PID: 7656)

    • Reads the computer name

      • xpaj.exe (PID: 7468)
      • TextInputHost.exe (PID: 8128)
      • StartMenuExperienceHost.exe (PID: 8096)
      • SearchApp.exe (PID: 7192)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4972)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7656)

    • Process checks computer location settings

      • StartMenuExperienceHost.exe (PID: 8096)
      • SearchApp.exe (PID: 7192)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 7192)

    • Checks proxy server information

      • SearchApp.exe (PID: 7192)

    • Reads Environment values

      • SearchApp.exe (PID: 7192)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 73728
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
8
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start xpaj.exe werfault.exe no specs startmenuexperiencehost.exe no specs textinputhost.exe no specs tiworker.exe no specs searchapp.exe mobsync.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1948C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
4972C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1467
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\aepic.dll
c:\windows\system32\oleaut32.dll
6000C:\WINDOWS\System32\mobsync.exe -EmbeddingC:\Windows\System32\mobsync.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Sync Center
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mobsync.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7192"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wincorlib.dll
7468"C:\Users\admin\AppData\Local\Temp\xpaj.exe" C:\Users\admin\AppData\Local\Temp\xpaj.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\xpaj.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7656C:\WINDOWS\system32\WerFault.exe -u -p 4972 -s 8652C:\Windows\System32\WerFault.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
8096"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
8128"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
16 070
Read events
15 844
Write events
223
Delete events
3

Modification events

(PID) Process:(4972) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F00620000000000000000000000010000004400000044000000
(PID) Process:(8096) StartMenuExperienceHost.exeKey:\REGISTRY\A\{414776db-b8f3-c5f0-1744-3f7529614190}\LocalState\DataCorruptionRecovery
Operation:writeName:InitializationAttemptCount
Value:
0100000006FBDDDCB684DC01
(PID) Process:(8096) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties
Operation:writeName:Completed
Value:
1
(PID) Process:(8096) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties_AppUsageData
Operation:writeName:Completed
Value:
1
(PID) Process:(8096) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties_TargetedContentTiles
Operation:writeName:Completed
Value:
1
(PID) Process:(7192) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
(PID) Process:(7192) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search
Operation:writeName:CortanaStateLastRun
Value:
D888666900000000
(PID) Process:(7192) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:writeName:CachedFeatureString
Value:
(PID) Process:(7192) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7192) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
4
Suspicious files
6
Text files
45
Unknown types
1

Dropped files

PID
Process
Filename
Type
7656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_6b2f479e7b52cac91f9e556e35e19ef59932ab_a6883b46_72927fa9-8382-46b9-b8dd-f57864954214\Report.wer —
MD5:—
SHA256:—
7656WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\explorer.exe.4972.dmp —
MD5:—
SHA256:—
1948TiWorker.exeC:\Windows\Logs\CBS\CBS.log —
MD5:—
SHA256:—
7468xpaj.exeC:\Users\admin\AppData\Local\Temp\D7D8.tmpexecutable
MD5:D5C12FCFEEBBE63F74026601CD7F39B2
SHA256:9DB7EF2D1495DBA921F3084B05D95E418A16F4C5E8DE93738ABEF2479AD5B0DA
7468xpaj.exeC:\Users\admin\AppData\Local\Temp\D7FA.tmpexecutable
MD5:D5C12FCFEEBBE63F74026601CD7F39B2
SHA256:9DB7EF2D1495DBA921F3084B05D95E418A16F4C5E8DE93738ABEF2479AD5B0DA
7192SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:E567ABEAB49ABF761DBEC0259CD186C7
SHA256:CF67A90C17B54B9295357F76364728C38644AB9ECCC91F29BEE2733AB1F485DC
7192SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\Q84V0JUH\ANzUnPnVY0oL0XWxs0RLJxjJLUo.br[1].jstext
MD5:9E527B91C2D8B31B0017B76049B5E4E3
SHA256:38EDF0F961C1CCB287880B88F12F370775FC65B2E28227EEE215E849CDBE9BBC
7192SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\88\_cqOeJKtsnBu9LrnbJX1CjU2yBg[1].jstext
MD5:1938D24823A70193AAE12D6F5CA837D0
SHA256:DFBEC009777C2508FE3BDDF75DE3C472239DD02737C3533FAD7CBE7E69089080
7192SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\88\FgBbpIj0thGWZOh_xFnM9i4O7ek[1].csstext
MD5:A889E641E8C039E7DECE507C66252CFB
SHA256:2B7361D1E68D55F6B798BDB253C816F52F948407A57C693E0790208682B8F542
7656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE102.tmp.xmlxml
MD5:1F1F0E7A3080B4FC3EC810387E348FC1
SHA256:6A5B85696899F163751A4BE5C51A306324E503A8FFDF086684124B4F418AFE18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
65
TCP/UDP connections
27
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
3176
svchost.exe
POST
200
40.126.32.133:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
whitelisted
7192
SearchApp.exe
GET
200
2.16.241.212:443
https://www.bing.com/rp/ANzUnPnVY0oL0XWxs0RLJxjJLUo.br.js
NL
text
20.3 Kb
whitelisted
7192
SearchApp.exe
POST
204
2.16.241.212:443
https://www.bing.com/threshold/xls.aspx
NL
—
—
whitelisted
7192
SearchApp.exe
POST
204
2.16.241.212:443
https://www.bing.com/threshold/xls.aspx
NL
—
—
whitelisted
3176
svchost.exe
POST
200
40.126.32.133:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
whitelisted
7192
SearchApp.exe
GET
304
2.16.241.212:443
https://www.bing.com/rp/h2m6AVCpDtS8Ff3ZxuDGx1A2-O8.br.js
NL
—
—
whitelisted
3176
svchost.exe
POST
200
40.126.32.133:443
https://login.live.com/RST2.srf
US
xml
5.53 Kb
whitelisted
7192
SearchApp.exe
GET
304
2.16.241.212:443
https://www.bing.com/rp/ikpPfkLjP14eKCzM16ksiFVp92Y.br.js
NL
—
—
whitelisted
7192
SearchApp.exe
GET
200
2.16.241.212:443
https://www.bing.com/manifest/threshold.appcache
NL
text
2.55 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2308
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
6768
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6236
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3412
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3176
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3176
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7192
SearchApp.exe
2.16.241.212:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
7192
SearchApp.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 216.58.212.142
whitelisted
nortiniolosto.com
  • —
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.134
  • 20.190.160.2
  • 20.190.160.65
  • 20.190.160.130
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
www.bing.com
  • 2.16.241.212
  • 2.16.241.206
  • 2.16.241.219
  • 2.16.241.224
  • 2.16.241.207
  • 2.16.241.222
  • 2.16.241.218
  • 2.16.241.205
whitelisted
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.25
  • 23.216.77.36
  • 2.19.198.194
  • 23.32.238.43
whitelisted
www.microsoft.com
  • 72.246.29.11
  • 23.59.18.102
whitelisted
slscr.update.microsoft.com
  • 135.233.95.144
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
xpaj.exe