File name:

8e154e9c44270802.exe

Full analysis: https://app.any.run/tasks/b1031438-4da6-450a-8627-a94c418344bc
Verdict: Malicious activity
Analysis date: June 01, 2025, 10:55:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 13 sections
MD5:

F65E2B5E29102CAEE7E1616C6A98B630

SHA1:

D32B006DB524094AA98163B6C63F431A241E434D

SHA256:

A4985FF00E98B2230B867609F1753A1BC9F15EE4D53C79F216476D5581DB6297

SSDEEP:

98304:j3eLBG+DjSdlUlT0OI9hDOS55fjHtU/9P082gEuk875zCnDKbTSV2bDSM+3R/6+W:1r204+5XM6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the BIOS version

      • 8e154e9c44270802.exe (PID: 1568)
      • 8e154e9c44270802.exe (PID: 6700)

    • Reads the date of Windows installation

      • 8e154e9c44270802.exe (PID: 1568)

    • Starts CMD.EXE for commands execution

      • 8e154e9c44270802.exe (PID: 1568)
      • 8e154e9c44270802.exe (PID: 6700)
      • 8e154e9c44270802.exe (PID: 1244)

    • Reads security settings of Internet Explorer

      • 8e154e9c44270802.exe (PID: 1568)
      • ShellExperienceHost.exe (PID: 6476)

    • The executable file from the user directory is run by the CMD process

      • 8e154e9c44270802.exe (PID: 6700)

    • Executes application which crashes

      • 8e154e9c44270802.exe (PID: 1244)
      • 8e154e9c44270802.exe (PID: 6700)

  • INFO

    • Checks supported languages

      • 8e154e9c44270802.exe (PID: 1568)
      • 8e154e9c44270802.exe (PID: 6700)
      • ShellExperienceHost.exe (PID: 6476)

    • Process checks computer location settings

      • 8e154e9c44270802.exe (PID: 1568)

    • Reads the computer name

      • 8e154e9c44270802.exe (PID: 1568)
      • 8e154e9c44270802.exe (PID: 6700)
      • ShellExperienceHost.exe (PID: 6476)

    • Process checks whether UAC notifications are on

      • 8e154e9c44270802.exe (PID: 6700)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6368)

    • Manual execution by a user

      • 8e154e9c44270802.exe (PID: 1244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:06:01 10:50:17+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.3
CodeSize: 380416
InitializedDataSize: 355840
UninitializedDataSize: -
EntryPoint: 0xa81058
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
15
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 8e154e9c44270802.exe no specs conhost.exe no specs cmd.exe conhost.exe no specs 8e154e9c44270802.exe cmd.exe no specs werfault.exe no specs rundll32.exe no specs shellexperiencehost.exe no specs rundll32.exe no specs slui.exe 8e154e9c44270802.exe conhost.exe no specs cmd.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1244"C:\Users\admin\Desktop\8e154e9c44270802.exe" C:\Users\admin\Desktop\8e154e9c44270802.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\8e154e9c44270802.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\opengl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
1268"C:\Windows\System32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\8e154e9c44270802.exe"C:\Windows\System32\cmd.exe
8e154e9c44270802.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225477
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1452C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—8e154e9c44270802.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1568"C:\Users\admin\AppData\Local\Temp\8e154e9c44270802.exe" C:\Users\admin\AppData\Local\Temp\8e154e9c44270802.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\8e154e9c44270802.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6368C:\WINDOWS\system32\WerFault.exe -u -p 6700 -s 1224C:\Windows\System32\WerFault.exe—8e154e9c44270802.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
6476"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
6496C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—8e154e9c44270802.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6660C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6700C:\Users\admin\AppData\Local\Temp\8e154e9c44270802.exeC:\Users\admin\AppData\Local\Temp\8e154e9c44270802.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\8e154e9c44270802.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\opengl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
6700\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—8e154e9c44270802.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 840
Read events
5 817
Write events
17
Delete events
6

Modification events

(PID) Process:(6700) 8e154e9c44270802.exeKey:HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0627&PID_0001\Calibration\0
Operation:writeName:GUID
Value:
6031DFFAD63EF0118001444553540000
(PID) Process:(6700) 8e154e9c44270802.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\8E154E9C44270802.EXE683C3069006D3DB0
Operation:writeName:Name
Value:
8E154E9C44270802.EXE
(PID) Process:(6700) 8e154e9c44270802.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\8E154E9C44270802.EXE683C3069006D3DB0
Operation:writeName:UsesMapper
Value:
00000000
(PID) Process:(6700) 8e154e9c44270802.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication
Operation:writeName:Name
Value:
8E154E9C44270802.EXE
(PID) Process:(6700) 8e154e9c44270802.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication
Operation:writeName:Id
Value:
8E154E9C44270802.EXE683C3069006D3DB0
(PID) Process:(6700) 8e154e9c44270802.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication
Operation:writeName:Version
Value:
00080000
(PID) Process:(6700) 8e154e9c44270802.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication
Operation:writeName:MostRecentStart
Value:
107137BDE3D2DB01
(PID) Process:(6368) WerFault.exeKey:\REGISTRY\A\{0ed0892e-4721-78e7-a574-2a867b226b98}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(6368) WerFault.exeKey:\REGISTRY\A\{0ed0892e-4721-78e7-a574-2a867b226b98}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(1244) 8e154e9c44270802.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication
Operation:writeName:Name
Value:
8E154E9C44270802.EXE
Executable files
0
Suspicious files
2
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6368WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8e154e9c44270802_f4779ee4c57131e9820c929ec7e661cc4ad9311_cffd6acc_b8c69a9a-a4f1-4241-aa8a-dcb08b0cb69b\Report.wer —
MD5:—
SHA256:—
6368WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\8e154e9c44270802.exe.6700.dmp —
MD5:—
SHA256:—
7576WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8e154e9c44270802_f4779ee4c57131e9820c929ec7e661cc4ad9311_cffd6acc_70b2f6ec-25e1-4721-b3b8-4e3efc432b91\Report.wer —
MD5:—
SHA256:—
7576WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\8e154e9c44270802.exe.1244.dmp —
MD5:—
SHA256:—
7576WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER1F82.tmp.dmpbinary
MD5:928B995DF1DE066228EC8D810F0C273C
SHA256:464BFE0231FA551713D9B68609FB4EC2FF72A69D89F48211C10A3C68787805C0
7576WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER205E.tmp.xmlxml
MD5:8E6E878AEC75B0F19EDF71772509FA5F
SHA256:6E94D0340DADB220DACAE021AC280183EBCE663B3E2F0450D0C70FECFDF93DBB
7576WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER202E.tmp.WERInternalMetadata.xmlxml
MD5:536DA98BFA2B3AA86AD324D570A9BBD0
SHA256:C727030DBDA81CA404D6FB1C724992F930F3C55CF6837A473C6DEE0A430D635F
6368WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER142D.tmp.WERInternalMetadata.xmlxml
MD5:ADCB8ED152B7DE317A7BD5133254648B
SHA256:2DFA7BDEE3623EA96DB76B929D00301D610908BE0C3ED89F6CC0B356190B3974
6368WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER12C5.tmp.dmpbinary
MD5:7D73BAA50108FAD4264D59D9B648A7F3
SHA256:6CCA2D93C8627C585D08502F6C7ED44FFF0EFCE970348723C3C534189BABE7B1
6368WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER145D.tmp.xmlxml
MD5:B365C439956842094A9CE86EC8222DFE
SHA256:61CEF47E0C466D3A8CCCEDFF5F93B4686E545AF7FE0BB4C686BD0268912AC175
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
43
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7872
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7872
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2088
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2088
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.2
  • 40.126.32.134
  • 40.126.32.138
  • 20.190.160.4
  • 20.190.160.14
  • 40.126.32.76
  • 20.190.160.130
  • 40.126.32.74
  • 20.190.160.17
  • 20.190.160.5
  • 20.190.160.20
  • 20.190.160.65
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
www.bing.com
  • 2.16.241.218
  • 2.16.241.201
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8e154e9c44270802.exe