File name:

193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c

Full analysis: https://app.any.run/tasks/5bb0e35a-5c71-4693-93d9-4f53e4932e47
Verdict: Malicious activity
Analysis date: May 12, 2025, 08:07:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
MD5:

FAEFEA79920694834522CC2788A69B48

SHA1:

6268E91FB5CA854BDE9CA1421BAF6B499659E074

SHA256:

193609F8D52CF05081A604C7EE8ED602CB5FF9AE44BAF31C5CBCEDE962553C9C

SSDEEP:

384:rU1IqlRwRebut+bbu2EB9F8xiwEB9F8xi1:Q1Iqlwebhbur9F8xi59F8xi1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

    • Executable content was dropped or overwritten

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

    • The process creates files with name similar to system file names

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

  • INFO

    • Creates files or folders in the user directory

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

    • Checks supported languages

      • 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe (PID: 7412)

    • Checks proxy server information

      • slui.exe (PID: 8084)

    • Reads the software policy settings

      • slui.exe (PID: 8084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.4)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x2130
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE 193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7412"C:\Users\admin\Desktop\193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe" C:\Users\admin\Desktop\193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
8084C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 369
Read events
3 369
Write events
0
Delete events
0

Modification events

No data
Executable files
1 707
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exe —
MD5:—
SHA256:—
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmpexecutable
MD5:0B98D165C12894B668BA1E5560AB5EB0
SHA256:C255CAFD8304351BF5D0C8B96883175B3306FECD24ECA9B8CDF7C663B62A62AC
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll.tmpexecutable
MD5:20388BE796B77B2D95008FDEBC58BD33
SHA256:BE70C59D42C3A9B43BE70673E575B3D699F0A393B2218943A66DF7B1D28167E5
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.tmpexecutable
MD5:7A85F14D5130466565D9320C4064E464
SHA256:ECA5B84A260763579CEEB51FD8C202FC18C7D82102347EBC53FCB5E088E2D9B1
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\BOOTNXT.tmpexecutable
MD5:BED69E30EEA5F76476942F8800CE7EC1
SHA256:E8C6F239A2C9BE4A3E0BB035E654B39774998A90E78EB850CF16FE0FBEEEFF29
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmpexecutable
MD5:630737A290E121F5D6B5CC06F05AF9B9
SHA256:57A964683DEC0E0C13816A3549E7F85459562057EBBEC525887E23718D23BE5D
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatRes.dll.tmpexecutable
MD5:DA4F806A469E1456AAB7D94F3AD8F3A3
SHA256:6EED37522832FCA94AAFFBADBBB2D884976E0D6AD04E7E55AEF37AC5609A30B8
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:000A2CE4B6E835F5BDC84993C154D719
SHA256:66FFC98C0FE2F64E54D4B2407B25644A0A36CE2BCEC3A1CF0647628B7CA12429
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.tmpexecutable
MD5:42C3B8541C2B9C7C9C4338F84296BEEE
SHA256:02032F95E0AF7953CCF371B902563B6C76F84B6F1571D4240F37C4FD07D7C597
7412193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmpexecutable
MD5:B76BE45BB8138014B77A765BFA21A856
SHA256:785A652BB141D73F6F02BF0F5F52108FAAC43C6C16535EE1974823A07DD0C32E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
52
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.32.238.153:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4172
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4172
RUXIMICS.exe
GET
200
23.32.238.153:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7880
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7880
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
200
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7880
SIHClient.exe
GET
200
23.32.238.153:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7880
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4172
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.32.238.153:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4172
RUXIMICS.exe
23.32.238.153:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4172
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.32.238.153
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.3
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.134
  • 40.126.32.133
  • 40.126.32.136
  • 20.190.160.4
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.30
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
193609f8d52cf05081a604c7ee8ed602cb5ff9ae44baf31c5cbcede962553c9c