File name:

e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe

Full analysis: https://app.any.run/tasks/d5b0d932-85df-4985-a65d-73f923e86a6b
Verdict: Malicious activity
Analysis date: July 16, 2025, 12:58:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

60AF1D8772BF5A2D903035B020A5571E

SHA1:

6D6D272284186BE9261409D9982A066B180B2B38

SHA256:

E458A48A44B3F9D7A90E5B44FB4138F87DBBAFDA3619B7110833EAA14DCC7D00

SSDEEP:

98304:TC9Vw29vx1jFUaxkEf8h/SuEcn0rLQxIWKOROg7gmsCQYEqZdOt+0zPD6Rc6d+lS:2cqCdt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • svchost.exe (PID: 2200)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4948)
      • 7066b8e0 (PID: 1352)
      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4832)

    • Application launched itself

      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4948)

    • Executes as Windows Service

      • 7066b8e0 (PID: 1352)

    • Executable content was dropped or overwritten

      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4832)

    • Connects to the server without a host name

      • 7066b8e0 (PID: 1352)
      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4832)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2200)

  • INFO

    • Checks supported languages

      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4948)
      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4832)
      • 7066b8e0 (PID: 1352)

    • Reads the computer name

      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4948)
      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4832)

    • The sample compiled with chinese language support

      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4948)
      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4832)

    • Process checks computer location settings

      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4948)

    • Reads the software policy settings

      • 7066b8e0 (PID: 1352)
      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4832)
      • slui.exe (PID: 6816)

    • Reads the machine GUID from the registry

      • 7066b8e0 (PID: 1352)
      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4832)

    • Checks proxy server information

      • e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe (PID: 4832)
      • slui.exe (PID: 6816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:18 13:31:37+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 145408
InitializedDataSize: 236544
UninitializedDataSize: -
EntryPoint: 0x1317f
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 23.9.20.1610
ProductVersionNumber: 23.9.20.1610
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 23, 9, 20, 1610
ProductVersion: 23, 9, 20, 1610
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
5
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe no specs e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe 7066b8e0 slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1352C:\Windows\Syswow64\7066b8e0C:\Windows\SysWOW64\7066b8e0
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Version:
23, 9, 20, 1610
Modules
Images
c:\windows\syswow64\iertutil.dll
c:\windows\syswow64\combase.dll
c:\windows\syswow64\shcore.dll
c:\windows\syswow64\sspicli.dll
c:\windows\syswow64\windows.storage.dll
c:\windows\syswow64\wldp.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\profapi.dll
c:\windows\syswow64\ondemandconnroutehelper.dll
c:\windows\syswow64\winhttp.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4832"C:\Users\admin\Desktop\e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe" C:\Users\admin\Desktop\e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe
e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe
User:
admin
Integrity Level:
HIGH
Version:
23, 9, 20, 1610
Modules
Images
c:\users\admin\desktop\e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4948"C:\Users\admin\Desktop\e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe" C:\Users\admin\Desktop\e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
23, 9, 20, 1610
Modules
Images
c:\users\admin\desktop\e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6816C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
11 408
Read events
11 405
Write events
3
Delete events
0

Modification events

(PID) Process:(4832) e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4832) e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4832) e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4832e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exeC:\Windows\SysWOW64\7066b8e0executable
MD5:75D1AEF8A1B45B53666620223E92FEFC
SHA256:8ABB685EE3C859B68FBB133F53C6FFFA1FDFC85A85C4A8BDA3CF84B57640750A
13527066b8e0C:\Windows\172590text
MD5:D51D26D39270951918C7AC5D94DBABA6
SHA256:B1C53587DB6EE018E9E0D7D314DFFD265A880DF71F90120CD66E720F7AD20F49
4832e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exeC:\Windows\52b9c0text
MD5:7A34664B02895A82E74AD6A2C229239B
SHA256:EADB1A04CD74A772DA7C91885DEDD4C99541E96468B3B7B255B4C18FB51092E8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
184
TCP/UDP connections
254
DNS requests
49
Threats
57

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5476
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1352
7066b8e0
GET
200
223.5.5.5:80
http://dns.alidns.com/resolve?name=down.nugong.asia&type=1
unknown
—
—
whitelisted
1352
7066b8e0
GET
200
223.5.5.5:80
http://223.5.5.5/resolve?name=down.nugong.asia&type=1
unknown
—
—
unknown
1352
7066b8e0
GET
200
223.5.5.5:80
http://dns.alidns.com/resolve?name=spi1.tyui54345.xyz&type=16
unknown
—
—
whitelisted
1352
7066b8e0
GET
200
223.5.5.5:80
http://223.5.5.5/resolve?name=spi1.tyui54345.xyz&type=16
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5476
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6024
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.238
whitelisted
down.nugong.asia
  • —
unknown
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
  • 23.55.110.182
  • 23.55.110.193
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
dns.alidns.com
  • 223.5.5.5
  • 223.6.6.6
whitelisted
down.xy58.top
  • 54.156.158.84
unknown
self.events.data.microsoft.com
  • 20.189.173.11
whitelisted
login.live.com
  • 40.126.31.3
  • 40.126.31.131
  • 40.126.31.130
  • 40.126.31.129
  • 40.126.31.128
  • 20.190.159.128
  • 20.190.159.23
  • 40.126.31.71
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
1352
7066b8e0
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
1352
7066b8e0
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
1352
7066b8e0
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
1352
7066b8e0
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
1352
7066b8e0
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
1352
7066b8e0
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
1352
7066b8e0
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
1352
7066b8e0
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
4832
e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
4832
e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
e458a48a44b3f9d7a90e5b44fb4138f87dbbafda3619b7110833eaa14dcc7d00.exe