File scan report

Verdict Suspicious

Analyzed Sep 12, 20261 month ago

Is PrimeX-GUI.exe safe? Treat it as suspicious.

APEX and Bkav flagged the file, while all participating major antivirus engines remained silent, making a false positive plausible.

Read the whole reasonShow less

Why Suspicious? 2 antivirus engines flag it, but no major engine agrees; nothing else confirms it.

Limited evidence · One sign points to a problem; nothing else confirms it.

Don't run it until you know where it came from

If it came from a link, an attachment or a stranger, delete it.

What to do now4 steps

Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.

What to do

Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.

If you already ran it

Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.

Not sure what to do?

Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

2 of 59 flagged

Flagged 2
No detection 57
No result 16

FilePrimeX-GUI.exe37.0 MBSHA-256 cd14b36286a5…56c536

Code signing Unsigned
Test run Completed
First seen 2mo ago

2 of the 59 antivirus engines that checked it flag it, including APEX and Bkav.

Chapter 02

Why we think so

4 points against it and 5 in its favour, checked against the scan evidence.

Analyst conclusion

Only 2 of the 59 antivirus engines that checked it detected the sample, both from the less reliable tier, and there is no major family consensus. That detection pattern ordinarily favors a false positive. The executable is unsigned, so no verified publisher identity helps explain or contextualize that activity. It also contacted two IP addresses directly, but no complete host-reputation result is available. With no malicious child, external-intelligence match, or sandbox verdict corroborating malware, the evidence remains materially mixed rather than conclusive.

Where this verdict could be wrong4 caveats

The fact that only less reliable engines flagged it and the absence of major detections make the two generic detections likely false positives.
No sandbox returned a malicious verdict, so the completed sandbox did not independently assign a malicious result.
droppedChildren inspected 10 files and found hasMaliciousChild=false, although all ten child verdicts remained unknown.
YARAify returned zero rules and CIRCL returned no hit, but absence of external matches does not exclude previously uncatalogued threats.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

12sandbox rule tags
3spawned processes
1network contact
31filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Note: Read the user name of the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).

Sandbox labels we could not confirm (common in safe files too)

Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: Showed activity a sandbox rule links to file encryption; no ransomware behaviour was confirmed.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

Input file
The submitted object
1
1. Evidence 1 of 6: FileSeen in the test run
  PrimeX-GUI.exe
  cd14b36286a5e62ebe53809dbebebd86fddc806205efaf7e96c482526a56c536
  Uploaded file
Processes
What ran
2
1. Evidence 2 of 6: ProcessSeen in the test run
  PrimeX-GUI.exe
  "C:\Users\<USER>\Desktop\PrimeX-GUI.exe"
  Test run
2. Evidence 3 of 6: ProcessSeen in the test run
  cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  Test run
3. +1 more recorded observation
Files
Created or changed
2
1. Evidence 4 of 6: Written fileSeen in the test run
  _avif.cp314-win_amd64.pyd
  C:\Users\<USER>\AppData\Local\Temp\_MEI52682\PIL\_avif.cp314-win_amd64.pyd
  Test run
2. Evidence 5 of 6: Written fileSeen in the test run
  _imaging.cp314-win_amd64.pyd
  C:\Users\<USER>\AppData\Local\Temp\_MEI52682\PIL\_imaging.cp314-win_amd64.pyd
  Test run
3. +1 more recorded observation
Network
Hosts contacted
1
1. Evidence 6 of 6: Contacted hostSeen in the test run
  172.67.153.93
  Contacted during the test run.
  Test run

6 facts from the test run. See the full activity list.

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

12

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1027· Obfuscated code
T1027.002· Obfuscated code
T1033· Reads user info
T1055· Process injection
T1070.006· Covers its tracks
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1202
T1485
T1486· File encryption
T1574· Execution hijack

Observed activity

Processes started

3

Programs the file ran, with their command lines.

PrimeX-GUI.exe"C:\Users\<USER>\Desktop\PrimeX-GUI.exe"
cmd.exeC:\Windows\system32\cmd.exe /c "ver"
PrimeX-GUI.exe"C:\Users\user\Desktop\PrimeX-GUI.exe"

Network contacts

1

1 host, listed as 1 address. Links show the host and path only.

IP address172.67.153.93

Files

30

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\PIL\_avif.cp314-win_amd64.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\PIL\_imaging.cp314-win_amd64.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\PIL\_imagingcms.cp314-win_amd64.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\PIL\_imagingft.cp314-win_amd64.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\PIL\_imagingmath.cp314-win_amd64.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\PIL\_imagingtk.cp314-win_amd64.pyd

Show all 30 entries

WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\PIL\_webp.cp314-win_amd64.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\VCRUNTIME140.dll
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\VCRUNTIME140_1.dll
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\_asyncio.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\_bz2.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\_cffi_backend.cp314-win_amd64.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\_ctypes.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\_decimal.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI52682\_elementtree.pyd
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\base.py
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\os.py
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\ospath.py
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\tempfile\temptypes.py
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\tempfile\__init__.py
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\tempfile
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\threadpool\binary.py
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\threadpool\text.py
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\threadpool\utils.py
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\threadpool\__init__.py
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\threadpool
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles\__init__.py
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles
DeletedC:\Users\<USER>\AppData\Local\Temp\_MEI52682\aiofiles-25.1.0.dist-info\INSTALLER

Mutexes

1

Named locks a program uses so only one copy runs; malware families often reuse them.

Global\OneSettingQueryMutex+compat+encapsulation

Sandbox background — not the file

9

The analysis machine's own processes and connections, recorded in every run.

VM processservices.exeC:\Windows\system32\services.exe
VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
VM processsvchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
VM processlsass.exeC:\Windows\system32\lsass.exe

Show all 9 entries

VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
VM host162.159.36.2

Dropped payload

Files this sample writes at runtime

This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.

9 not checked

d8bd3032b72992a81661…1e912aNot checked
no saved verdict
d823c0e3b54035d08703…5f1105Not checked
no saved verdict
dff90929dbeb9d51eebf…5a96fdNot checked
no saved verdict
93c3ca5a3e7119897be9…c79bceNot checked
no saved verdict
a7b3d6e462d338744694…1d0d9eNot checked
no saved verdict
79208042672ff0b9e366…036593Not checked
no saved verdict
f4d851381d1bd937753b…d45198Not checked
no saved verdict
052ad6a20d375957e82a…5027f4Not checked
no saved verdict
dc6db118862ab3298e55…aa098aNot checked
no saved verdict

Chapter 04

Technical details

2 of the 59 antivirus engines that checked it flag it; no publisher signature.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete2 of 59 engines flagged it · 16 gave no result DetailsSep 6, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsSep 12, 2026

Contacted hostsMalwareTips URL scannerPartial1 host contacted in the test run had no completed reputation check DetailsSep 12, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsSep 12, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedSep 12, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchSep 12, 2026

Engines that flagged it 2

APEXMalicious
BkavW32.Malware.5CE28D74

File fingerprint

Last analyzed: Sep 12, 2026, 12:16 PM UTC

SHA-256: cd14b36286a5e62ebe53809dbebebd86fddc806205efaf7e96c482526a56c536
SHA-1: e4f5824a4ddd19d680546c8c4c9b152c0d1e35bf
MD5: 1d71db36460af6e0adebb554b5030b5b

About this file

PrimeX-GUI.exe is a Win32 EXE file of 37.0 MB.

Type and size: Win32 EXE · 37.0 MB
Signer: UnsignedNo code signature.
First seen: Jul 31, 2026On VirusTotal.
Submitted by: 22 distinct sources
Packer: None detected
Entropy: 8.00 of 8

First scanned Sep 12, 2026

Antivirus consensus

2 of 59 engines flagged this file

2 malicious0 suspicious57 not flagged16 no result

16 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-19 engines
0flagged
Tier-235 engines
0flagged
Low-trust15 engines
2flagged

View all 75 engine results

APEXMalicious: Malicious
BkavMalicious: W32.Malware.5CE28D74
AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
ArcabitClean
AvastNo result
Avast-MobileNo result
AVGNo result
AviraClean
BitDefenderNo result
BitDefenderFalxNo result
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetNo result
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32No result
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusNo result
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyNo result
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingNo result
SangforClean
SentinelOneClean
SkyhighNo result
SophosNo result
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroNo result
TrendMicro-HouseCallNo result
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 8.00Unpacked

Section entropy7 sections

.text

6.47

.rdata

5.75

.data

1.82

.pdata

5.47

.fptable

0.00

.rsrc

8.00

.reloc

5.25

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium

Unique uploaders

22

Moderate upload volume.

Total submissions

22

Includes repeat uploads by the same source.

First seen

3mo ago

Jul 31, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is PrimeX-GUI.exe safe, or is it malware?

PrimeX-GUI.exe is rated Suspicious: some signs point to a problem, but nothing confirms it is harmful. 2 of the 59 antivirus engines that checked it flag it. Don't run it unless you're sure where it came from. If you need the program, download it again from the publisher's own website.

What is PrimeX-GUI.exe?

PrimeX-GUI.exe is a Windows program, about 37.0 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Jul 31, 2026.

How many antivirus engines detected PrimeX-GUI.exe?

2 of the 59 antivirus engines that checked it flag PrimeX-GUI.exe, including APEX and Bkav. We weigh which engines flagged it and what else the scan found, not just the count.

I already downloaded and ran PrimeX-GUI.exe — what should I do?

No infection is confirmed: the rating is a caution, not a malware finding. 1) Check where it came from. If you can't confirm the source, delete it. 2) Run a full scan with your security software. 3) If the scan finds something, follow its removal steps and change passwords you typed on the device since then.

What is the SHA-256 hash of PrimeX-GUI.exe?

The SHA-256 fingerprint of PrimeX-GUI.exe is cd14b36286a5e62ebe53809dbebebd86fddc806205efaf7e96c482526a56c536, and its MD5 is 1d71db36460af6e0adebb554b5030b5b. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

How up to date is this analysis of PrimeX-GUI.exe?

This report reflects the scan on Sep 12, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Is PrimeX-GUI.exe safe? Treat it as suspicious.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What the test run showed

Confirmed in the test run

Sandbox labels we could not confirm (common in safe files too)

What happened in the test

Input file

Processes

Files

Network

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

Engines that flagged it 2

File fingerprint

About this file

2 of 59 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is PrimeX-GUI.exe safe? Treat it as suspicious.

What We Detected

Threat Behavior

What To Do Now

Test run summary

What the test run showed

Confirmed in the test run

Sandbox labels we could not confirm (common in safe files too)

What happened in the test

Input file

Processes

Files

Network

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

Engines that flagged it 2

File fingerprint

About this file

Related file reports