File name:

7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe

Full analysis: https://app.any.run/tasks/cc74defb-079b-4a9f-b500-8b77302418e5
Verdict: Malicious activity
Analysis date: August 01, 2025, 05:56:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
MD5:

A9FA7CCD342EDE1C6F6171B1F7EAD327

SHA1:

68E9E7A111B5C6C9E9F07A236B00B86781D69E34

SHA256:

7C050FFA0E1E785CDB1AACA06F5FAE96577EDA48D11F9BACE195A009A381C2B8

SSDEEP:

1536:UjVABc9F8xi59F8xiG+3+U3aWf5jsdeWjEy:Uaof5jsdeWjEy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • 7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe (PID: 512)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • 7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe (PID: 512)

    • Executable content was dropped or overwritten

      • 7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe (PID: 512)

    • The process creates files with name similar to system file names

      • 7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe (PID: 512)

  • INFO

    • Checks supported languages

      • 7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe (PID: 512)

    • Creates files or folders in the user directory

      • 7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe (PID: 512)

    • Checks proxy server information

      • slui.exe (PID: 5236)

    • Reads the software policy settings

      • slui.exe (PID: 5236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.4)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x6000
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE 7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
512"C:\Users\admin\Desktop\7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe" C:\Users\admin\Desktop\7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5236C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 493
Read events
3 493
Write events
0
Delete events
0

Modification events

No data
Executable files
1 857
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5127c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe —
MD5:—
SHA256:—
5127c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exeexecutable
MD5:2A8F415AC4FC77FD63890098057ACACB
SHA256:911C2B5C9A04CAB55794BEC4025B5B91E7D739E0DF090C2DCF88924E9469F8E3
5127c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll.tmpexecutable
MD5:7B9103F51066AFAA73F1AB63C573A89F
SHA256:FC828219CFF50071E2DF6B0C3EB6A6C2B9E3F6B5318722D041311B622CD32A44
5127c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmpexecutable
MD5:1B0FD2EF3CA1FFA943DAE53E2F5287D2
SHA256:ACCF51234A7ACB7E2B0C703F9F6B51765331DC45B923D8DAE4B5CCC8D096D4CB
5127c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmpexecutable
MD5:10117D6E23C3C0697B996B32BFA37527
SHA256:BEA62ABA2BD16568722B41A448A52BDED8827A6ABA9225E49EC4A109F1CE7832
5127c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.tmpexecutable
MD5:C0672CA85DE1C2918963EB64FC225C97
SHA256:DD11D7056FA9B7FF76016AA2506EDE7E7FFA44A0799F22A9C1A87A204CDDEC75
5127c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.tmpexecutable
MD5:E935FF972A1CBC00378F26FEAAD8BB03
SHA256:223BA144893DD04CAE890310320F166E68A4A1A17B49CD5C274DA66882269EBC
5127c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:3DE0C33B7CB99A6D3CEDB14390C29C27
SHA256:B764A23AFA6F2314D931E46DD240D007DA259AEE7533AF81905FA5053A847827
5127c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe.tmpexecutable
MD5:CDBF72E56D2DE0C66311C895C7F47BBF
SHA256:3C5AD2005A35EB2EB449103AF95FB6833AAF95D742A655B0285A748302AD2983
5127c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe.tmpexecutable
MD5:EA9E05825E9F5F32AA870A51AF5CF0BA
SHA256:0E3253329FA56B058F52036BB9ABCACDAC3E770710828964692A97F023AEFE9C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
19
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
5876
RUXIMICS.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
1268
svchost.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
5876
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5876
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5876
RUXIMICS.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5876
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.74.206
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.20
  • 23.216.77.28
  • 23.216.77.6
  • 23.216.77.25
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
self.events.data.microsoft.com
  • 20.42.65.90
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7c050ffa0e1e785cdb1aaca06f5fae96577eda48d11f9bace195a009a381c2b8.exe