File name:

a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99

Full analysis: https://app.any.run/tasks/1fff1b74-2a3d-4e17-8d02-8fb6fca984d3
Verdict: Malicious activity
Analysis date: June 21, 2025, 01:48:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
MD5:

440BCD31636E64F746A71F69FD23FF95

SHA1:

20B08E6F4BA6E938C70FCD68CB6885A4B92611F2

SHA256:

A1AE6D0D0664BB69D39DE1077FBEF84A37937B96A9CAB3756378AF95F4355F99

SSDEEP:

384:Ujmr2zerFvXxSnt+bbu+r7/xqjWyX+ISNqISo:UjVzMlXAqbu+r7/xqjW5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exe (PID: 5020)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exe (PID: 5020)

    • Executable content was dropped or overwritten

      • a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exe (PID: 5020)

    • The process creates files with name similar to system file names

      • a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exe (PID: 5020)

  • INFO

    • Creates files or folders in the user directory

      • a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exe (PID: 5020)

    • Checks supported languages

      • a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exe (PID: 5020)

    • Checks proxy server information

      • slui.exe (PID: 6236)

    • Reads the software policy settings

      • slui.exe (PID: 6236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.4)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x6000
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
5020"C:\Users\admin\Desktop\a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exe" C:\Users\admin\Desktop\a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6236C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 477
Read events
3 477
Write events
0
Delete events
0

Modification events

No data
Executable files
1 949
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5020a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exe —
MD5:—
SHA256:—
5020a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exeC:\Users\admin\AppData\Local\VirtualStore\BOOTNXT.tmpexecutable
MD5:EFF8E1D1E673E45AFC4F47945DC24DA8
SHA256:D7133FB60A8FE96E26CC7503DD4561C6EBB32F5CBD6EAC0991D36D084E91A309
5020a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:343BDAD67C5CD32F5C895E7FDBA1CA17
SHA256:3E420C8774823FBE216E97B9E5FD34360F79F3A7752D589F1D20C1F18C8F42A4
5020a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exeC:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmpexecutable
MD5:2A3A3CD90BD4E23F675F5915BDB7C1D9
SHA256:E1204EE0534614D976A165C61664616F24532DA91599EB4DCE48FB95C3BFD37D
5020a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll.tmpexecutable
MD5:A35CD1C602D59EC9A7BF562FE19A9588
SHA256:8B0CD46728656716FE24D2C416172374548902B2FE714068089E29F183FBF77A
5020a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exeexecutable
MD5:6F0DEA195767D4472D678E02D83F8887
SHA256:AD41E6BB9780FDB43A9161F09516CB29A3BC9696872D12A367783C8E1689FCA2
5020a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.tmpexecutable
MD5:C4C040CA4790CCD530B06CA3EFD7F913
SHA256:FC0BEA79E856F689028E7D2A290ECA317BA455B52A51F452129744C50EA83D40
5020a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_reader_appicon_16.png.tmpexecutable
MD5:079DF9B812D0FEC4FB7A179137B44C35
SHA256:6B381E06F9867DFEE4AFE23C7C6B053C772B10A5F64BA30AB51611F0991DAF1C
5020a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatRes.dll.tmpexecutable
MD5:5EFD302C7D9D7576EDDF1C4D020AD900
SHA256:52FA7A21133FBCD6F5163F07824E1091507290A1E0D97B37E2642683B3B4F36B
5020a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmpexecutable
MD5:FDC2BEDF32F31F3B8DA2CE05EE99FCB1
SHA256:BE5A17C3047520FF5A8F67955E44AB922DA64731CFE083A54F9B4DFAAE95C03B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
47
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
184.25.50.8:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1200
RUXIMICS.exe
GET
200
184.25.50.8:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.25.50.8:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1200
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
40.126.31.0:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
200
40.126.31.0:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
—
—
POST
200
40.126.31.69:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
POST
200
20.190.159.64:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1200
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
184.25.50.8:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
184.25.50.8:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1200
RUXIMICS.exe
184.25.50.8:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 184.25.50.8
  • 184.25.50.10
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.67
  • 40.126.31.1
  • 20.190.159.73
  • 20.190.159.64
  • 40.126.31.131
  • 20.190.159.23
  • 40.126.31.2
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
a1ae6d0d0664bb69d39de1077fbef84a37937b96a9cab3756378af95f4355f99