File name:

157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe

Full analysis: https://app.any.run/tasks/5c0ed2bc-8e38-4cbd-8d80-4413d8ca4d01
Verdict: Malicious activity
Analysis date: August 01, 2025, 05:46:25
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
MD5:

A1412DA441C208C1A9894441BB0EA4A7

SHA1:

910BC414E73E6DA6AADC986948ACC1DECEAFDD03

SHA256:

157BC3DBD4628A0DC7A892D0BA5244E000407A565F7DE9518C3E8B855FE9A1C7

SSDEEP:

1536:UjVABc9F8xi59F8xiG+3+U3aWf5jsdeWjEs4I:Uaof5jsdeWjEm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • 157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe (PID: 5168)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe (PID: 5168)

    • The process creates files with name similar to system file names

      • 157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe (PID: 5168)

    • Creates file in the systems drive root

      • 157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe (PID: 5168)

  • INFO

    • Checks supported languages

      • 157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe (PID: 5168)

    • Creates files or folders in the user directory

      • 157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe (PID: 5168)

    • Checks proxy server information

      • slui.exe (PID: 5628)

    • Reads the software policy settings

      • slui.exe (PID: 5628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.4)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x6000
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE 157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
5168"C:\Users\admin\Desktop\157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe" C:\Users\admin\Desktop\157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5628C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 469
Read events
3 469
Write events
0
Delete events
0

Modification events

No data
Executable files
1 876
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5168157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe —
MD5:—
SHA256:—
5168157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe.tmpexecutable
MD5:BFDE94B42317A0A6618EE83300C61723
SHA256:571DDCE347E24E1F54B0020753BDBCABA312639B9CD2B37AD63BFCAAE5451731
5168157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_reader_appicon_16.png.tmpexecutable
MD5:5EA8771F1432224C65CD486BF39CB4D6
SHA256:8973509A4AD0687339BD022BA626E91EF1D8C1D3026657BE928BAFCEFC3922F4
5168157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmpexecutable
MD5:B39314C442C9B571F3C1F9AB164AC38E
SHA256:20186CD355DF1EA3283C987278823B3A2972CFAEE05A022C453AF88921C42D35
5168157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatRes.dll.tmpexecutable
MD5:31EA1D1A6D918DA39149D17C6EAD7343
SHA256:490906AEEDED61592447B9C19EB1C9225D32CF13BEBAEA71BCF2CE5ACC69FE58
5168157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.tmpexecutable
MD5:C3042675BC02E7B0F087B7FA78D092C9
SHA256:1F8DAE1DAEB10B45FCCF2533370519325F8341CED5F30AAB85BE3CE448BB084C
5168157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exeC:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmpexecutable
MD5:5FED667E912D02EB566F735B47FF9131
SHA256:33E52448894C95B1375BDD959722DAD9D9FFD9A0D82CFEBA7C186719FF485DE3
5168157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:B49CA69C51D5432018CFE83B7F7F01AC
SHA256:8C80185BD1B9989E0873144C58CB8DC7CA59DC544ACC0514F1AF01B8E3D53E5F
5168157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exeexecutable
MD5:C3042675BC02E7B0F087B7FA78D092C9
SHA256:1F8DAE1DAEB10B45FCCF2533370519325F8341CED5F30AAB85BE3CE448BB084C
5168157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe.tmpexecutable
MD5:48D7B905C327159B76BF1BC16326166D
SHA256:ECC7AC6EDD607EBCA0BC82DF39FAE41FAEB01C6C2C1B44287F79D9C1CACD5013
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
19
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
188
RUXIMICS.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
188
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
188
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
188
RUXIMICS.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
self.events.data.microsoft.com
  • 20.42.72.131
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
157bc3dbd4628a0dc7a892d0ba5244e000407a565f7de9518c3e8b855fe9a1c7.exe