File name:

8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942

Full analysis: https://app.any.run/tasks/d35fd01c-7282-4de9-b81c-b72fbeadef72
Verdict: Malicious activity
Analysis date: June 21, 2025, 16:20:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 2 sections
MD5:

3417DEBD4545E2DA6A6C025159E5C76E

SHA1:

E012A8E98FB64CD1BDBFAE59039F6B06015958F7

SHA256:

8C8536B8234A4E7C42B08EBBBA6E734DB54640B42654731A810CBF4809035942

SSDEEP:

12288:oYGHdzXIWYYu/Gd6BAfz7pta6gNoG/gL:o9t4WqC6Cfz7sNoG/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 5712)
      • net.exe (PID: 6360)

  • SUSPICIOUS

    • Modifies hosts file to alter network resolution

      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 5712)

    • Executable content was dropped or overwritten

      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 5712)
      • cmd.exe (PID: 728)

    • Starts CMD.EXE for commands execution

      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 5712)

    • Executing commands from a ".bat" file

      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 5712)

  • INFO

    • The sample compiled with chinese language support

      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 5712)

    • Failed to create an executable file in Windows directory

      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 5712)

    • Checks supported languages

      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 5712)
      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 6868)

    • Create files in a temporary directory

      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 5712)

    • The sample compiled with english language support

      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 5712)
      • cmd.exe (PID: 728)

    • Reads the computer name

      • 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe (PID: 6868)

    • Reads the software policy settings

      • slui.exe (PID: 1712)

    • Checks proxy server information

      • slui.exe (PID: 1712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | DOS Executable Generic (100)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 0.37
CodeSize: 66560
InitializedDataSize: 37888
UninitializedDataSize: -
EntryPoint: 0x361ec
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Windows, Chinese (Simplified)
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
ProductName: -
ProductVersion: 1.0.0.0
Comments: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe net.exe no specs conhost.exe no specs net1.exe no specs cmd.exe conhost.exe no specs 8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728C:\WINDOWS\system32\cmd.exe /c C:\Users\admin\AppData\Local\Temp\$a6B1E.batC:\Windows\SysWOW64\cmd.exe
8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1712C:\WINDOWS\system32\net1 stop "Kingsoft AntiVirus Service"C:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
1712C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5712"C:\Users\admin\Desktop\8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe" C:\Users\admin\Desktop\8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6360net stop "Kingsoft AntiVirus Service"C:\Windows\SysWOW64\net.exe—8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6868"C:\Users\admin\Desktop\8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe"C:\Users\admin\Desktop\8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe—cmd.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Update Core
Exit code:
2147942402
Version:
1.3.36.371
Modules
Images
c:\users\admin\desktop\8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
7072\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 965
Read events
3 965
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
57128c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exeC:\Users\admin\Desktop\8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exe.exeexecutable
MD5:021C57C74DE40F7C3B4FCF58A54D3649
SHA256:04ADF40BA58D0AB892091C188822191F2597BC47DAB8B92423E8FC546DC437EF
728cmd.exeC:\Users\admin\Desktop\8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exeexecutable
MD5:021C57C74DE40F7C3B4FCF58A54D3649
SHA256:04ADF40BA58D0AB892091C188822191F2597BC47DAB8B92423E8FC546DC437EF
57128c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942.exeC:\Users\admin\AppData\Local\Temp\$a6B1E.battext
MD5:D5001D562C8B3A13B66B62D65F620156
SHA256:05036332EF4E410697DC5F4E6EB9A4C483431A74A7B99FA68DF5B1461AAF637A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
39
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
20.190.159.71:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
200
40.126.31.130:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1564
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1564
RUXIMICS.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
200
40.126.31.131:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
GET
304
172.202.163.200:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
POST
200
40.126.31.73:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
GET
200
172.202.163.200:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1564
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1564
RUXIMICS.exe
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
1268
svchost.exe
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
1564
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 2.18.121.147
  • 2.18.121.139
  • 184.25.50.8
  • 184.25.50.10
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.130
  • 20.190.160.64
  • 20.190.160.5
  • 40.126.32.72
  • 40.126.32.140
  • 20.190.160.67
  • 20.190.160.65
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8c8536b8234a4e7c42b08ebbba6e734db54640b42654731a810cbf4809035942