| File name: | bad22e49523ddba90e98aa4f8bd58fa60744e93accacc8397e530c6a9045db0d.exe |
| Full analysis: | https://app.any.run/tasks/45ae7ed1-186e-462d-acf4-1df79a2a7346 |
| Verdict: | Malicious activity |
| Analysis date: | October 03, 2025, 16:21:25 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections |
| MD5: | B7EBF3F9711936DD4C8AAC4DC653B540 |
| SHA1: | 5C9DD138971598DE0D215607186DF61E74D71DFD |
| SHA256: | BAD22E49523DDBA90E98AA4F8BD58FA60744E93ACCACC8397E530C6A9045DB0D |
| SSDEEP: | 98304:AU00mvjm2UO1S2Ss5uh5CWzQgx3RttmaP:d |
| .exe | | | Win32 EXE PECompact compressed (generic) (32.3) |
|---|---|---|
| .exe | | | Win32 Executable MS Visual C++ (generic) (24.2) |
| .exe | | | Win64 Executable (generic) (21.4) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.1) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2018:04:10 17:28:39+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 761856 |
| InitializedDataSize: | 479232 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x9add5 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 144 | "C:\Users\admin\Desktop\760D2.exe" | C:\Users\admin\Desktop\760D2.exe | 098VM.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 332 | "C:\Users\admin\Desktop\RX82S.exe" | C:\Users\admin\Desktop\RX82S.exe | 46H0C.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 332 | "C:\Users\admin\Desktop\5L5ZD.exe" | C:\Users\admin\Desktop\5L5ZD.exe | E937C.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 332 | "C:\Users\admin\Desktop\XE935.exe" | C:\Users\admin\Desktop\XE935.exe | 8156F.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 332 | "C:\Users\admin\Desktop\26MMS.exe" | C:\Users\admin\Desktop\26MMS.exe | O6BFQ.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 332 | "C:\Users\admin\Desktop\A92I4.exe" | C:\Users\admin\Desktop\A92I4.exe | 23NLI.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 592 | "C:\Users\admin\Desktop\A6RKB.exe" | C:\Users\admin\Desktop\A6RKB.exe | 86GV1.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 600 | "C:\Users\admin\Desktop\89I01.exe" | C:\Users\admin\Desktop\89I01.exe | 3I94D.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 704 | "C:\Users\admin\Desktop\08CR5.exe" | C:\Users\admin\Desktop\08CR5.exe | 6GR16.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 756 | "C:\Users\admin\Desktop\2VO84.exe" | C:\Users\admin\Desktop\2VO84.exe | 694X5.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| (PID) Process: | (7200) AH4E0.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (7200) AH4E0.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (7200) AH4E0.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (7200) AH4E0.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (7136) X3V5Z.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (7136) X3V5Z.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (7136) X3V5Z.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (7136) X3V5Z.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (4500) bad22e49523ddba90e98aa4f8bd58fa60744e93accacc8397e530c6a9045db0d.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (4500) bad22e49523ddba90e98aa4f8bd58fa60744e93accacc8397e530c6a9045db0d.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7200 | AH4E0.exe | C:\Users\admin\Desktop\05NP7.exe | executable | |
MD5:F02EA2C8F0A09AD760D49BBB6FFC770B | SHA256:51EB91A36A83F24238CFAFD215ECC88ED648CBDE7E78CA75A63C9696538F7230 | |||
| 6168 | YDYW6.exe | C:\Users\admin\Desktop\X3V5Z.exe | executable | |
MD5:BFC3CFE941D0602804367C7BCF28B51D | SHA256:B01EC027961865777FF7BF9272D9E06A4805BC6352952C99AF45159619CC95CB | |||
| 7440 | B7M3P.exe | C:\Users\admin\Desktop\5HXYR.exe | executable | |
MD5:5754B35AB4A4A0C097AB878046DE83D6 | SHA256:51EADE4DD50300C86D22947B5DF23C0C6018241996E21898DB758E3F289978C6 | |||
| 7136 | X3V5Z.exe | C:\Users\admin\Desktop\B7M3P.exe | executable | |
MD5:A83F39DB2FDADD968593EA0505D0D3A0 | SHA256:7D2B751623DF6DB49FB879A75DE3BE9FDC705FC648A5D95946F10908D88B88E8 | |||
| 1740 | 5HXYR.exe | C:\Users\admin\Desktop\MBL1N.exe | executable | |
MD5:E928D06A6738E045C4C084AFAE4C7633 | SHA256:E398DB488BC2EA66F200288827F15A1BB220F6299A4CE5E462F56B54C138DA14 | |||
| 2328 | 0RW8O.exe | C:\Users\admin\Desktop\182H7.exe | executable | |
MD5:958F94ABDBEE1B4910372B53795ED57D | SHA256:C9DBC1BDE64FB3A95BF32AAD55B282B813574029070C6710A42BE60748DEDE70 | |||
| 6340 | MBL1N.exe | C:\Users\admin\Desktop\0RW8O.exe | executable | |
MD5:9ED61FA5BFF385104D2D7E7D01FEBBC0 | SHA256:8F115F5F5926106A04A64CA3ABE8F9E7FD5428C128524D7062DAA4C52F7EB279 | |||
| 7116 | 182H7.exe | C:\Users\admin\Desktop\RO2Z5.exe | executable | |
MD5:5BEF031BEACD640966544A094422EAD4 | SHA256:E41B30F8F8A053D342CAE29E5A05DC0EF8A76CC30F8D1DAB7785C52D30F24AC9 | |||
| 4988 | RO2Z5.exe | C:\Users\admin\Desktop\7SR1R.exe | executable | |
MD5:A0910C9643E0F12A904F4A192BA4864B | SHA256:F43E03B31CD2E909714105A548328D5BCD5519A5C9FE27334B6E6B6767C0D22A | |||
| 6184 | 7SR1R.exe | C:\Users\admin\Desktop\LG11H.exe | executable | |
MD5:373A56CBC73CD1C02E036F74D025055A | SHA256:9BBC45083F19A370A60FFD34BD3C9C9669464EDD45EDCCA9C88968AB9D55675B | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | POST | 200 | 40.126.31.131:443 | https://login.live.com/RST2.srf | US | — | — | unknown |
— | — | POST | 200 | 40.126.31.131:443 | https://login.live.com/RST2.srf | US | xml | 11.1 Kb | unknown |
— | — | POST | 200 | 40.126.31.131:443 | https://login.live.com/RST2.srf | US | xml | 11.0 Kb | unknown |
— | — | GET | 200 | 2.18.29.145:443 | https://www.bing.com/th?id=ODSWG.31bcf3d1-4df8-4c6a-9b3a-447ced8d6c39&pid=dsb | unknown | — | 4.64 Kb | unknown |
— | — | GET | 200 | 2.18.29.176:443 | https://www.bing.com/th?id=ODSWG.8229b0e5-fa8c-4e4a-af74-69717698b903&pid=dsb | unknown | image | 4.62 Kb | unknown |
— | — | POST | 200 | 40.126.31.131:443 | https://login.live.com/RST2.srf | US | xml | 11.2 Kb | unknown |
— | — | POST | 200 | 40.126.31.2:443 | https://login.live.com/RST2.srf | US | xml | 11.3 Kb | unknown |
— | — | GET | 200 | 2.18.29.184:443 | https://www.bing.com/client/config?cc=US&setlang=en-US | unknown | — | 2.15 Kb | unknown |
— | — | GET | 200 | 20.103.156.88:443 | https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20251003T162146Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=abf3cf713672493c9fe6079d61de456c&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&currsel=137271744000000000&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1360&dispsize=16.3&dispvertres=768&fosver=16299&isu=0&lo=4245621&metered=false&nettype=ethernet&npid=sc-88000045&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&smBiosDm=DELL&stabedgever=133.0.3065.92&tl=2&tsu=1636150&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2 | US | binary | 3.21 Kb | unknown |
— | — | GET | 200 | 20.103.156.88:443 | https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20251003T162146Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=9433de59b9024a798f4d5e679c258290&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&currsel=137271744000000000&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1360&dispsize=16.3&dispvertres=768&fosver=16299&isu=0&lo=4245621&metered=false&nettype=ethernet&npid=sc-280815&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&smBiosDm=DELL&stabedgever=133.0.3065.92&tl=2&tsu=1636150&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2 | US | binary | 3.20 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2128 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6016 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6016 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5948 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5224 | SearchApp.exe | 2.18.29.234:443 | www.bing.com | Akamai International B.V. | PL | whitelisted |
1048 | svchost.exe | 20.190.160.130:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6864 | backgroundTaskHost.exe | 2.18.29.234:443 | www.bing.com | Akamai International B.V. | PL | whitelisted |
3464 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |