File name:

49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe

Full analysis: https://app.any.run/tasks/08ff1a14-665a-44eb-8e9c-df9dbc43c1fe
Verdict: Malicious activity
Analysis date: July 17, 2025, 05:15:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
MD5:

128A8E676D8B3A5141C54790252EC620

SHA1:

25063DDC536BFA5F4F07F2A0613EF37ED6FA7458

SHA256:

49A431909850E4C2DF227A7F6A43B10F857FC144FCC374DC50B7E9D1802E662A

SSDEEP:

1536:QPlbc9F8xi59F8xiG+3+U3aWf+0TRV0TRtjVABc9F8xi59F8xiG+3+U3aWf+0TR1:alOfSaofh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • 49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe (PID: 4748)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • 49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe (PID: 4748)

    • Executable content was dropped or overwritten

      • 49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe (PID: 4748)

    • The process creates files with name similar to system file names

      • 49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe (PID: 4748)

  • INFO

    • Creates files or folders in the user directory

      • 49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe (PID: 4748)

    • Checks supported languages

      • 49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe (PID: 4748)

    • Checks proxy server information

      • slui.exe (PID: 2292)

    • Reads the software policy settings

      • slui.exe (PID: 2292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.4)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x2130
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE 49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2292C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4748"C:\Users\admin\Desktop\49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe" C:\Users\admin\Desktop\49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
3 500
Read events
3 500
Write events
0
Delete events
0

Modification events

No data
Executable files
1 811
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
474849a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe —
MD5:—
SHA256:—
474849a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:C4351B11C10C39DCFEA0AB4E759726D8
SHA256:A902B82679A25D902ADD884C45A4CE010012409B1A7B0E2EC3000B52CC12FED1
474849a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exeexecutable
MD5:DBCA2BC629F88310EBFC3C216BC58C36
SHA256:CF1CAB7FF44D9EBD91B8D0297F0DD2BA9BCE7B24B00DF6D66E8BBF89C67BEB03
474849a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmpexecutable
MD5:78DCE6CCEA006BE90147EEA56F971DC7
SHA256:81BE3F23BDC72590D2A236BBE41C77717A2063BB719A94FC5BBBB8350FFD788F
474849a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exeC:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmpexecutable
MD5:844B98372DFC2E4E692774069CFE10C2
SHA256:E979FBDC3D52EC5E8CB0F85BD76883CE74EC4D7720208E444AA5C2E19A86B90D
474849a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll.tmpexecutable
MD5:3AB2BDD7FCDCCCCB4624219CDE6A7BDC
SHA256:85EC229A3049A72A4194A59BFB7B2478C80FC6C4418B16D0DAAD07150BD4BF6D
474849a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_reader_appicon_16.png.tmpexecutable
MD5:127E003D1D09EE645F9C48A4AA62BBD3
SHA256:C1E427AE46A3BE7043B3DA39B167BB7390C7512D287E511E82D633B96C700027
474849a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef.pak.tmpexecutable
MD5:AA3FC7BD740532B80E34582871A67BFB
SHA256:BCB7EB27A221D923858220CE5515C9E0A23D78997229492C5819E87441537238
474849a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef_200_percent.pak.tmpexecutable
MD5:7624A006886F37FECD35BC8565245CB6
SHA256:C6018E42E4CF331CA9495C57C8460CAA962FEE323CDDF826092A0EC5013F9CDE
474849a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exeC:\Users\admin\AppData\Local\VirtualStore\BOOTNXT.tmpexecutable
MD5:F67D6788D6AFD7D681912F8FB89E6397
SHA256:164C1ADD5A581C49DE71BDFB8AB0BF92C8706742CD838020E9FE027A6062B0C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
55
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
684
RUXIMICS.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
684
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4400
SIHClient.exe
GET
200
2.16.241.14:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
4400
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4400
SIHClient.exe
GET
200
2.16.241.14:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
—
—
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
4400
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
684
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
684
RUXIMICS.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
684
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.14
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.130
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.128
  • 20.190.159.64
  • 40.126.31.71
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
self.events.data.microsoft.com
  • 20.189.173.14
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
49a431909850e4c2df227a7f6a43b10f857fc144fcc374dc50b7e9d1802e662a.exe