File name:

193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c

Full analysis: https://app.any.run/tasks/5bb0e35a-5c71-4693-93d9-4f53e4932e47
Verdict: Malicious activity
Analysis date: May 12, 2025, 08:07:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
MD5:

FAEFEA79920694834522CC2788A69B48

SHA1:

6268E91FB5CA854BDE9CA1421BAF6B499659E074

SHA256:

193609F8D52CF05081A604C7EE8ED602CB5FF9AE44BAF31C5CBCEDE962553C9C

SSDEEP:

384:rU1IqlRwRebut+bbu2EB9F8xiwEB9F8xi1:Q1Iqlwebhbur9F8xi59F8xi1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

    • Executable content was dropped or overwritten

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

    • The process creates files with name similar to system file names

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

  • INFO

    • Creates files or folders in the user directory

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

    • Checks supported languages

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

    • Reads the software policy settings

      • slui.exe (PID: 8084)

    • Checks proxy server information

      • slui.exe (PID: 8084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.4)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x2130
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7412"C:\Users\admin\Desktop\193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe" C:\Users\admin\Desktop\193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
8084C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 369
Read events
3 369
Write events
0
Delete events
0

Modification events

No data
Executable files
1 707
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe —
MD5:—
SHA256:—
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.tmpexecutable
MD5:42C3B8541C2B9C7C9C4338F84296BEEE
SHA256:02032F95E0AF7953CCF371B902563B6C76F84B6F1571D4240F37C4FD07D7C597
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.tmpexecutable
MD5:3C598D893487CCA086759A097873A7BA
SHA256:82EB9103AF2071440DF2F657C88D9F1B8033D7B481E3927DCDA56AE153F334F2
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmpexecutable
MD5:0B98D165C12894B668BA1E5560AB5EB0
SHA256:C255CAFD8304351BF5D0C8B96883175B3306FECD24ECA9B8CDF7C663B62A62AC
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmpexecutable
MD5:630737A290E121F5D6B5CC06F05AF9B9
SHA256:57A964683DEC0E0C13816A3549E7F85459562057EBBEC525887E23718D23BE5D
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll.tmpexecutable
MD5:20388BE796B77B2D95008FDEBC58BD33
SHA256:BE70C59D42C3A9B43BE70673E575B3D699F0A393B2218943A66DF7B1D28167E5
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exeexecutable
MD5:3C598D893487CCA086759A097873A7BA
SHA256:82EB9103AF2071440DF2F657C88D9F1B8033D7B481E3927DCDA56AE153F334F2
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.tmpexecutable
MD5:7A85F14D5130466565D9320C4064E464
SHA256:ECA5B84A260763579CEEB51FD8C202FC18C7D82102347EBC53FCB5E088E2D9B1
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:8F04F67019FD6C2356CA93DA305D93B7
SHA256:0158CB93263FC0422CD5FD943B292693B9E6A103F3A645520FAB45A1D8BF104B
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmpexecutable
MD5:B76BE45BB8138014B77A765BFA21A856
SHA256:785A652BB141D73F6F02BF0F5F52108FAAC43C6C16535EE1974823A07DD0C32E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
52
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.32.238.153:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4172
RUXIMICS.exe
GET
200
23.32.238.153:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4172
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
—
—
GET
304
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
7880
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7880
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7880
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7880
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4172
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.32.238.153:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4172
RUXIMICS.exe
23.32.238.153:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4172
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.32.238.153
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.3
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.134
  • 40.126.32.133
  • 40.126.32.136
  • 20.190.160.4
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.30
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c