File name:

Prince-Built.exe

Full analysis: https://app.any.run/tasks/2d8ca636-0ed5-452a-9c61-6dfb8880fea1
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 22, 2025, 09:18:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
prince
ransomware
golang
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 8 sections
MD5:

A8780881BF294B363840E1E51EF8BF42

SHA1:

903687BE04659FA2ACF2B29309AE65A06944B1F8

SHA256:

B7A6EB4DC4C644FE3611B0F4E69202455D61CF426726343B2FFB182C3DEB6CB8

SSDEEP:

49152:WFfos7O/o/ey/fovW+lAW7uvYfsGQIPooFlaFLBy7Puppp9yMeZsplGehd23YNa0:WxawGyIBltq6o2qFy7PQxuQxZSC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RANSOMWARE has been detected

      • Prince-Built.exe (PID: 6004)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 900)

    • PRINCE has been detected (YARA)

      • Prince-Built.exe (PID: 6004)

  • SUSPICIOUS

    • Probably download files using WebClient

      • Prince-Built.exe (PID: 6004)

    • Starts POWERSHELL.EXE for commands execution

      • Prince-Built.exe (PID: 6004)

    • Changes wallpaper

      • Prince-Built.exe (PID: 6004)

    • Imports DLL using pinvoke

      • powershell.exe (PID: 5344)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 728)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 728)

  • INFO

    • Checks supported languages

      • Prince-Built.exe (PID: 6004)
      • csc.exe (PID: 728)
      • cvtres.exe (PID: 2096)

    • Creates files in the program directory

      • Prince-Built.exe (PID: 6004)

    • Disables trace logs

      • powershell.exe (PID: 900)

    • Checks proxy server information

      • powershell.exe (PID: 900)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • Prince-Built.exe (PID: 6004)

    • Application based on Golang

      • Prince-Built.exe (PID: 6004)

    • Detects GO elliptic curve encryption (YARA)

      • Prince-Built.exe (PID: 6004)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 728)

    • Create files in a temporary directory

      • csc.exe (PID: 728)
      • cvtres.exe (PID: 2096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 1174528
InitializedDataSize: 163840
UninitializedDataSize: -
EntryPoint: 0x73960
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
9
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #PRINCE prince-built.exe no specs powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs powershell.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\td5dsgtf.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
900powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://i.imgur.com/RfsCOES.png', 'C:\Users\admin\AppData\Local\Temp\Wallpaper.png')"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Prince-Built.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2096C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESE10B.tmp" "c:\Users\admin\AppData\Local\Temp\CSC6392D2215F214115BE26115647FBA8.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
2384C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4944\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5344powershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); public static void Set(string path) { SystemParametersInfo(20, 0, path, 3); } }'; [Wallpaper]::Set('C:\Users\admin\AppData\Local\Temp\Wallpaper.png')"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Prince-Built.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6004"C:\Users\admin\AppData\Local\Temp\Prince-Built.exe" C:\Users\admin\AppData\Local\Temp\Prince-Built.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\prince-built.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
6944"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
11 271
Read events
11 271
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
74
Text files
60
Unknown types
0

Dropped files

PID
Process
Filename
Type
6004Prince-Built.exeC:\Users\Default\Desktop\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
6004Prince-Built.exeC:\Users\Default\Links\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
6004Prince-Built.exeC:\Users\admin\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
6004Prince-Built.exeC:\ProgramData\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
6004Prince-Built.exeC:\Users\Default\Downloads\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
6004Prince-Built.exeC:\Users\Default\Pictures\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
6004Prince-Built.exeC:\Users\Default\Favorites\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
6004Prince-Built.exeC:\Users\Public\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
6004Prince-Built.exeC:\Users\Default\Videos\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
6004Prince-Built.exeC:\Users\admin\3D Objects\Decryption Instructions.txttext
MD5:8F9B39A7C685671D9E80F843C1161F1D
SHA256:B99C47952A0E9036ED39C99A85A1731FFD18A46C67E350DF91C8DEB747ECB19E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
22
DNS requests
14
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7084
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7084
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
900
powershell.exe
199.232.192.193:443
i.imgur.com
FASTLY
US
whitelisted
6544
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.110
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
i.imgur.com
  • 199.232.192.193
  • 199.232.196.193
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.68
  • 40.126.31.130
  • 20.190.159.71
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image Sharing Service (imgur.com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Prince-Built.exe