File name:

Zenith.exe

Full analysis: https://app.any.run/tasks/4f229b4c-c664-4953-8589-06487016d51b
Verdict: Malicious activity
Analysis date: May 15, 2025, 17:42:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 12 sections
MD5:

9FE9BA35F2C40557E551C73F9A0FF521

SHA1:

E7AEE12EB0187723AA1CD9F0538A29EEE0DF6D38

SHA256:

0744993E327B4EFF7C04D29582BF9CEE71B483B7AB8F76D72B5CE857913DCC14

SSDEEP:

98304:ilkO6Ka6Odla0CDbp5++xHe9vYQylBRZ6Ay8vdL+R46YsnMj0eQxq4UCOQMVXIX/:pI5I49aofkPt6Nn0TpM9K4QbYmLXx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4008)
      • powershell.exe (PID: 1244)
      • powershell.exe (PID: 6972)

  • SUSPICIOUS

    • The process bypasses the loading of PowerShell profile settings

      • Zenith.exe (PID: 672)

    • Reads the BIOS version

      • Zenith.exe (PID: 672)

    • The process hide an interactive prompt from the user

      • Zenith.exe (PID: 672)

    • Starts POWERSHELL.EXE for commands execution

      • Zenith.exe (PID: 672)

    • Reads security settings of Internet Explorer

      • GameBar.exe (PID: 4920)

  • INFO

    • Checks supported languages

      • Zenith.exe (PID: 672)
      • GameBar.exe (PID: 4920)

    • Reads the computer name

      • Zenith.exe (PID: 672)
      • GameBar.exe (PID: 4920)

    • Process checks whether UAC notifications are on

      • Zenith.exe (PID: 672)

    • Reads product name

      • Zenith.exe (PID: 672)

    • Reads Environment values

      • Zenith.exe (PID: 672)

    • Checks proxy server information

      • slui.exe (PID: 5352)

    • Reads the software policy settings

      • slui.exe (PID: 5352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | DOS Executable Generic (100)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:03:17 00:49:48+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 12083200
InitializedDataSize: 6854144
UninitializedDataSize: -
EntryPoint: 0x227f058
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.1.0.0
ProductVersionNumber: 0.1.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
ProductName: Zenith
FileVersion: 1.1.0
ProductVersion: 1.1.0
FileDescription: Zenith
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
10
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start zenith.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs gamebar.exe no specs slui.exe zenith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672"C:\Users\admin\Desktop\Zenith.exe" C:\Users\admin\Desktop\Zenith.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Zenith
Version:
1.1.0
Modules
Images
c:\users\admin\desktop\zenith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1244"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\admin\Desktop\Scripts.lnk'); $Shortcut.TargetPath = 'C:\Users\admin\AppData\Roaming\Zenith\Scripts'; $Shortcut.Save()"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Zenith.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4008"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\admin\Desktop\AutoExec.lnk'); $Shortcut.TargetPath = 'C:\Users\admin\AppData\Roaming\Zenith\AutoExec'; $Shortcut.Save()"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Zenith.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4120"C:\Users\admin\Desktop\Zenith.exe" C:\Users\admin\Desktop\Zenith.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Zenith
Exit code:
3221226540
Version:
1.1.0
Modules
Images
c:\users\admin\desktop\zenith.exe
c:\windows\system32\ntdll.dll
4920"C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe" -ServerName:App.AppXbdkk0yrkwpcgeaem8zk81k8py1eaahny.mcaC:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files\windowsapps\microsoft.xboxgamingoverlay_2.34.28001.0_x64__8wekyb3d8bbwe\gamebar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
5352C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6560\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6972"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\admin\Desktop\Workspace.lnk'); $Shortcut.TargetPath = 'C:\Users\admin\AppData\Roaming\Zenith\Workspace'; $Shortcut.Save()"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Zenith.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
7012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
17 499
Read events
17 492
Write events
7
Delete events
0

Modification events

(PID) Process:(4920) GameBar.exeKey:\REGISTRY\A\{bc4bae66-a18a-92d5-b527-caba654bfc2e}\LocalState
Operation:writeName:InstalledVersionMajor
Value:
02001F1CF1BFC0C5DB01
(PID) Process:(4920) GameBar.exeKey:\REGISTRY\A\{bc4bae66-a18a-92d5-b527-caba654bfc2e}\LocalState
Operation:writeName:InstalledVersionMinor
Value:
22000D80F3BFC0C5DB01
(PID) Process:(4920) GameBar.exeKey:\REGISTRY\A\{bc4bae66-a18a-92d5-b527-caba654bfc2e}\LocalState
Operation:writeName:InstalledVersionBuild
Value:
616D0D80F3BFC0C5DB01
(PID) Process:(4920) GameBar.exeKey:\REGISTRY\A\{bc4bae66-a18a-92d5-b527-caba654bfc2e}\LocalState
Operation:writeName:InstalledVersionRevision
Value:
00000D80F3BFC0C5DB01
(PID) Process:(4920) GameBar.exeKey:\REGISTRY\A\{bc4bae66-a18a-92d5-b527-caba654bfc2e}\LocalState
Operation:writeName:PreviousAppTerminationFromSuspended
Value:
000D80F3BFC0C5DB01
(PID) Process:(4920) GameBar.exeKey:\REGISTRY\A\{bc4bae66-a18a-92d5-b527-caba654bfc2e}\LocalState
Operation:writeName:CurrentDisplayMonitor
Value:
670061006D00650000005EE3F5BFC0C5DB01
(PID) Process:(4920) GameBar.exeKey:\REGISTRY\A\{bc4bae66-a18a-92d5-b527-caba654bfc2e}\LocalState
Operation:writeName:StartupTipIndex
Value:
0100000000000000D672FFBFC0C5DB01
Executable files
0
Suspicious files
4
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1244powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_e3lf3gv2.ia2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1244powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_btpdnw13.tdw.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6972powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mnxngl5k.kzc.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4008powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1lb2fpvv.yrr.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1244powershell.exeC:\Users\admin\Desktop\Scripts.lnkbinary
MD5:D5EC250BEB618D9DFD0F020B52FA87D8
SHA256:416F1E671654C804FE886394EEBD9ED94BD0FCDCED8A4496328854540C122281
6972powershell.exeC:\Users\admin\Desktop\Workspace.lnkbinary
MD5:F828F186A0ACCBF7EC743CC84E1ACFAD
SHA256:9EE34C25258BAD651DC4B1614D743D7E1D4EBE096798C7226AA574E4867E9D3F
6972powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zb2j3iqj.klr.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1244powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:1D5CA7B9DCB787A2E6A23228A0F5EAA6
SHA256:870C1C22E7323997F997F356A7275A93AC971F8F833E51B7814D3540187E8CA9
4008powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2tsznb1g.s4v.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4008powershell.exeC:\Users\admin\Desktop\AutoExec.lnkbinary
MD5:CEA44A2DCE1A38AFF7A0657FA789E34B
SHA256:B7B3DB45A7421E0C6A41A958E436F71FEB5755D4E77C641CBFF99D354C0F0D71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
39
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1012
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
1012
SIHClient.exe
GET
200
23.48.23.153:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1012
SIHClient.exe
GET
200
23.48.23.153:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
1012
SIHClient.exe
GET
200
23.48.23.153:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
1012
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1012
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
1012
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
1012
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
1012
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1012
SIHClient.exe
23.48.23.153:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1012
SIHClient.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1012
SIHClient.exe
13.95.31.18:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1532
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
20.190.160.5:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
crl.microsoft.com
  • 23.48.23.153
  • 23.48.23.148
  • 23.48.23.142
  • 23.48.23.156
  • 23.48.23.151
  • 23.48.23.147
  • 23.48.23.144
  • 23.48.23.139
  • 23.48.23.138
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
login.live.com
  • 20.190.160.5
  • 40.126.32.134
  • 40.126.32.136
  • 20.190.160.132
  • 20.190.160.14
  • 40.126.32.140
  • 20.190.160.65
  • 20.190.160.4
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Zenith.exe