| File name: | dcbd17ddcb4eccb24d9b995793a14e59fd3d79b089d562fd480e228b969a2279 |
| Full analysis: | https://app.any.run/tasks/0959c763-9072-4e78-b7f5-71782bfd8d2d |
| Verdict: | Malicious activity |
| Analysis date: | June 29, 2025, 05:12:51 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 5 sections |
| MD5: | 6DF8231168A666FEF0A7D35DF9E50C25 |
| SHA1: | 42EF4C4FF073C5F90D41D086069F1F403AB860BA |
| SHA256: | DCBD17DDCB4ECCB24D9B995793A14E59FD3D79B089D562FD480E228B969A2279 |
| SSDEEP: | 24576:MUKstWIP3Ymyne8H4wSeWgTTxZsasAY5S8zoPBNoEFZ9bp8vey6CwpFZ9bp8veyB:MUKstWIP3Ymyne8HJSeWgTTLsDAY48zJ |
| .exe | | | Win32 Executable MS Visual C++ (generic) (27.3) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (24.2) |
| .exe | | | UPX compressed Win32 Executable (23.7) |
| .scr | | | Windows screen saver (11.4) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 0000:00:00 00:00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 450560 |
| InitializedDataSize: | 150016 |
| UninitializedDataSize: | 802816 |
| EntryPoint: | 0x132be0 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 188 | "C:\Users\admin\Desktop\2N08Q.exe" | C:\Users\admin\Desktop\2N08Q.exe | 548K8.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 236 | "C:\Users\admin\Desktop\LRI93.exe" | C:\Users\admin\Desktop\LRI93.exe | E86R7.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 236 | "C:\Users\admin\Desktop\IG613.exe" | C:\Users\admin\Desktop\IG613.exe | 2WF3Q.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 316 | "C:\Users\admin\Desktop\M70F6.exe" | C:\Users\admin\Desktop\M70F6.exe | 0E69A.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 316 | "C:\Users\admin\Desktop\85L3P.exe" | C:\Users\admin\Desktop\85L3P.exe | — | 585H9.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 316 | "C:\Users\admin\Desktop\MO9S2.exe" | C:\Users\admin\Desktop\MO9S2.exe | — | G7JK6.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 | |||||||||||||||
| 320 | "C:\Users\admin\Desktop\F9WRK.exe" | C:\Users\admin\Desktop\F9WRK.exe | — | QI8R5.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 424 | "C:\Users\admin\Desktop\YA2A2.exe" | C:\Users\admin\Desktop\YA2A2.exe | 8T0L7.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 424 | "C:\Users\admin\Desktop\1IOT7.exe" | C:\Users\admin\Desktop\1IOT7.exe | — | 62WU7.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 440 | "C:\Users\admin\Desktop\4H219.exe" | C:\Users\admin\Desktop\4H219.exe | — | 623J9.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2512 | Q3X00.exe | C:\Users\admin\Desktop\932A5.exe | executable | |
MD5:0F9A8A0063BCCAF028C62379FBE2C1C4 | SHA256:BC31DE53E24D1BADC70AA4ABEA08FFD507961835CFE7E0C9E4367A11775F0613 | |||
| 4060 | M81O1.exe | C:\Users\admin\Desktop\Q3X00.exe | executable | |
MD5:1AF827C5E47ACE21C00E7BF783351763 | SHA256:0ADB95E37DE52401404725D63BFF5922D58A41F7CF29FC72843A62403246ED15 | |||
| 4880 | 932A5.exe | C:\Users\admin\Desktop\QU6H2.exe | executable | |
MD5:0E5203DD1706C8D6C3CDA65F47AD23DD | SHA256:43DF422EBC512DF9DDF377E34F2B3137298B5FA5761BF1342864E1E55323101A | |||
| 1132 | AM9J7.exe | C:\Users\admin\Desktop\9NJQE.exe | executable | |
MD5:FBD20D2DA981207A7B636B019D230470 | SHA256:4C079E2168FCF11E9B83CDBB9FF54E18B150DD0BA97CCD25AA02C81E8DA77987 | |||
| 2716 | dcbd17ddcb4eccb24d9b995793a14e59fd3d79b089d562fd480e228b969a2279.exe | C:\Users\admin\Desktop\M81O1.exe | executable | |
MD5:7CAD641FB85116BE74BD5BAE34E30718 | SHA256:72F62E261C5A8B7567F902BA2FF514C3AD03B2BB67460E4AA6779E706A0E5174 | |||
| 3196 | QU6H2.exe | C:\Users\admin\Desktop\AM9J7.exe | executable | |
MD5:9A56955B971EAB661A9271A42B5A7681 | SHA256:28B16AA8B75EFD3D0906289B912A6C1D57C888ED12F029CCDAA35CF7A6D095E5 | |||
| 2996 | 5JRYM.exe | C:\Users\admin\Desktop\QPU9F.exe | executable | |
MD5:207182C3580C4A7B2EE12C32473CAEBE | SHA256:8928B516C709CA44DEED9CC51F78B86CCF75791A1F5EAE89233056FF6080B90B | |||
| 1480 | 9NJQE.exe | C:\Users\admin\Desktop\5JRYM.exe | executable | |
MD5:F2CCDCC066DCCB5AFBFE0D45C03541E0 | SHA256:54685FAC654C770162DFA3748583A40986F0D01818372BCAE6FABE8A5E734E5D | |||
| 728 | QS4B1.exe | C:\Users\admin\Desktop\Y75J5.exe | executable | |
MD5:91EFC4794F1E3167E08E1B276846FFE0 | SHA256:E4D421EF6122D6ED7A3FE36B2B7899D2CC2B760E0ECD2F181B96305123DA9205 | |||
| 768 | 0IDLV.exe | C:\Users\admin\Desktop\QS4B1.exe | executable | |
MD5:425B3B7CC49C58C4147A0D9B7B076C34 | SHA256:13A87E835F0970EBDFD9A9A892E8AB596CAAC85B39D02F8F3A3538B68DBFB4D1 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | GET | 200 | 2.20.245.137:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 2.20.245.137:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | POST | 500 | 40.91.76.224:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | unknown | xml | 512 b | whitelisted |
— | — | POST | 500 | 40.91.76.224:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | unknown | xml | 512 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1268 | svchost.exe | 2.20.245.137:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
5944 | MoUsoCoreWorker.exe | 2.20.245.137:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
1268 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
5944 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
— | — | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |