| File name: | dcbd17ddcb4eccb24d9b995793a14e59fd3d79b089d562fd480e228b969a2279 |
| Full analysis: | https://app.any.run/tasks/0959c763-9072-4e78-b7f5-71782bfd8d2d |
| Verdict: | Malicious activity |
| Analysis date: | June 29, 2025, 05:12:51 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 5 sections |
| MD5: | 6DF8231168A666FEF0A7D35DF9E50C25 |
| SHA1: | 42EF4C4FF073C5F90D41D086069F1F403AB860BA |
| SHA256: | DCBD17DDCB4ECCB24D9B995793A14E59FD3D79B089D562FD480E228B969A2279 |
| SSDEEP: | 24576:MUKstWIP3Ymyne8H4wSeWgTTxZsasAY5S8zoPBNoEFZ9bp8vey6CwpFZ9bp8veyB:MUKstWIP3Ymyne8HJSeWgTTLsDAY48zJ |
| .exe | | | Win32 Executable MS Visual C++ (generic) (27.3) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (24.2) |
| .exe | | | UPX compressed Win32 Executable (23.7) |
| .scr | | | Windows screen saver (11.4) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 0000:00:00 00:00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 450560 |
| InitializedDataSize: | 150016 |
| UninitializedDataSize: | 802816 |
| EntryPoint: | 0x132be0 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 188 | "C:\Users\admin\Desktop\2N08Q.exe" | C:\Users\admin\Desktop\2N08Q.exe | 548K8.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 236 | "C:\Users\admin\Desktop\LRI93.exe" | C:\Users\admin\Desktop\LRI93.exe | E86R7.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 236 | "C:\Users\admin\Desktop\IG613.exe" | C:\Users\admin\Desktop\IG613.exe | 2WF3Q.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 316 | "C:\Users\admin\Desktop\M70F6.exe" | C:\Users\admin\Desktop\M70F6.exe | 0E69A.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 316 | "C:\Users\admin\Desktop\85L3P.exe" | C:\Users\admin\Desktop\85L3P.exe | — | 585H9.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 316 | "C:\Users\admin\Desktop\MO9S2.exe" | C:\Users\admin\Desktop\MO9S2.exe | — | G7JK6.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 | |||||||||||||||
| 320 | "C:\Users\admin\Desktop\F9WRK.exe" | C:\Users\admin\Desktop\F9WRK.exe | — | QI8R5.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 424 | "C:\Users\admin\Desktop\YA2A2.exe" | C:\Users\admin\Desktop\YA2A2.exe | 8T0L7.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 424 | "C:\Users\admin\Desktop\1IOT7.exe" | C:\Users\admin\Desktop\1IOT7.exe | — | 62WU7.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 440 | "C:\Users\admin\Desktop\4H219.exe" | C:\Users\admin\Desktop\4H219.exe | — | 623J9.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2716 | dcbd17ddcb4eccb24d9b995793a14e59fd3d79b089d562fd480e228b969a2279.exe | C:\Users\admin\Desktop\M81O1.exe | executable | |
MD5:7CAD641FB85116BE74BD5BAE34E30718 | SHA256:72F62E261C5A8B7567F902BA2FF514C3AD03B2BB67460E4AA6779E706A0E5174 | |||
| 1480 | 9NJQE.exe | C:\Users\admin\Desktop\5JRYM.exe | executable | |
MD5:F2CCDCC066DCCB5AFBFE0D45C03541E0 | SHA256:54685FAC654C770162DFA3748583A40986F0D01818372BCAE6FABE8A5E734E5D | |||
| 768 | 0IDLV.exe | C:\Users\admin\Desktop\QS4B1.exe | executable | |
MD5:425B3B7CC49C58C4147A0D9B7B076C34 | SHA256:13A87E835F0970EBDFD9A9A892E8AB596CAAC85B39D02F8F3A3538B68DBFB4D1 | |||
| 5960 | XG4JD.exe | C:\Users\admin\Desktop\Y87A5.exe | executable | |
MD5:4DF761690F01D57EA220F20F42031867 | SHA256:E317A206D860CAE13AA57EE8F79E50DD8BA928EC73EF2C313D1E75F2E0109744 | |||
| 5432 | X7Y62.exe | C:\Users\admin\Desktop\3CBUL.exe | executable | |
MD5:60D5732A96438A2B1C6A06D315F5C306 | SHA256:3344D52A17A965F1DDCB4C3D3B75312E16261109CF5F6AFB0F221DC075D6154E | |||
| 2996 | 5JRYM.exe | C:\Users\admin\Desktop\QPU9F.exe | executable | |
MD5:207182C3580C4A7B2EE12C32473CAEBE | SHA256:8928B516C709CA44DEED9CC51F78B86CCF75791A1F5EAE89233056FF6080B90B | |||
| 3580 | 3CBUL.exe | C:\Users\admin\Desktop\0IDLV.exe | executable | |
MD5:82A4B4356AD802EC5733BC363EA84255 | SHA256:B6573E4C39EEB963B8E78A9BCD50423C600FB41FB0C6A8EDCE9E171D9CB10907 | |||
| 728 | QS4B1.exe | C:\Users\admin\Desktop\Y75J5.exe | executable | |
MD5:91EFC4794F1E3167E08E1B276846FFE0 | SHA256:E4D421EF6122D6ED7A3FE36B2B7899D2CC2B760E0ECD2F181B96305123DA9205 | |||
| 1468 | Y87A5.exe | C:\Users\admin\Desktop\XZH43.exe | executable | |
MD5:43C94ED9C2D5FBC6CC105210CA65DF91 | SHA256:49C0F8853C2D5829833A89D2B04459AC4DC2B27AF5F746447959EC168F4960CE | |||
| 1984 | Y75J5.exe | C:\Users\admin\Desktop\XG4JD.exe | executable | |
MD5:1AA4D3A318491140846ABD09B225F7D0 | SHA256:E4DD3F4ABB2B794C48EF93E9CF8A10AB4DFDEE58BF40EBCC5C2E8BC4FA94CDA3 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1268 | svchost.exe | GET | 200 | 2.20.245.137:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 2.20.245.137:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | POST | 500 | 40.91.76.224:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | unknown | xml | 512 b | whitelisted |
— | — | POST | 500 | 40.91.76.224:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | unknown | xml | 512 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1268 | svchost.exe | 2.20.245.137:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
5944 | MoUsoCoreWorker.exe | 2.20.245.137:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
1268 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
5944 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
— | — | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |