File name:

xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe

Full analysis: https://app.any.run/tasks/880acc44-5ce8-4009-a5c0-6ace73385ca6
Verdict: Malicious activity
Analysis date: February 07, 2026, 01:39:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

5229B225260D968F6ED464075E90A6E3

SHA1:

90309C080F767F0F6E416439FB59FE9051647769

SHA256:

D46B71F990A06B408792C882E63222768255EB46261F7457A293DC2526E2F902

SSDEEP:

1536:k3kEMOd02TngoNIibuQe8Y4VJ2qrPjvowp4TITf:k0EMAHnnA44TIb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe (PID: 2564)

  • SUSPICIOUS

    • Using short paths in the command line

      • xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe (PID: 2564)

    • Starts CMD.EXE for commands execution

      • xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe (PID: 2564)

    • Hides command output

      • cmd.exe (PID: 7664)

    • File deletion via cmd.exe

      • cmd.exe (PID: 7664)

  • INFO

    • Checks supported languages

      • xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe (PID: 2564)

    • Failed to create an executable file in Windows directory

      • xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe (PID: 2564)

    • Reads the computer name

      • xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe (PID: 2564)

    • Launching a file from a Registry key

      • xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe (PID: 2564)

    • Checks proxy server information

      • slui.exe (PID: 6400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:07:31 11:55:58+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 4096
InitializedDataSize: 49152
UninitializedDataSize: -
EntryPoint: 0x2674
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe cmd.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2564"C:\Users\admin\Desktop\xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe" C:\Users\admin\Desktop\xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6400C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7664C:\WINDOWS\system32\cmd.exe /c del C:\Users\admin\Desktop\XD46B7~1.EXE > nulC:\Windows\SysWOW64\cmd.exe—xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
3 521
Read events
3 520
Write events
1
Delete events
0

Modification events

(PID) Process:(2564) xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA128595-F594-4e6c-AC11-52775B42FCFC}
Operation:writeName:stubpath
Value:
C:\WINDOWS\{DA128595-F594-4e6c-AC11-52775B42FCFC}.exe
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
22
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6768
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
—
—
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
unknown
3292
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
US
binary
814 b
whitelisted
5404
slui.exe
POST
500
48.192.1.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
3292
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
US
binary
401 b
whitelisted
3292
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl
US
binary
400 b
whitelisted
3292
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
NL
binary
824 b
whitelisted
3292
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
US
binary
813 b
whitelisted
3292
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl
US
binary
813 b
whitelisted
8700
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2600
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
6768
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
2.16.204.161:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
8700
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
8700
svchost.exe
2.16.164.49:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
2600
RUXIMICS.exe
2.16.164.49:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 20.189.173.18
  • 20.189.173.24
whitelisted
www.bing.com
  • 2.16.204.161
  • 2.16.204.141
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
www.microsoft.com
  • 23.59.18.102
whitelisted

Threats

No threats detected
Process
Message
xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe
Invalid parameter passed to C runtime function.
xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe
Invalid parameter passed to C runtime function.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
xd46b71f990a06b408792c882e63222768255eb46261f7457a293dc2526e2f902.exe