File name:

sims-4-updater-v2.4.11.exe

Full analysis: https://app.any.run/tasks/330b653e-797a-4403-9b0b-27ff0119cc14
Verdict: Malicious activity
Analysis date: January 03, 2026, 02:43:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
pyinstaller
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

52B234520C47115173FA9FC33395B551

SHA1:

3C4C6E8701FF4CF723B64EDE89DFE867925D2183

SHA256:

A48EF2D0D7A9D5D5CA9DEA6E7017140E682B0EB6D15C33ACE93C7F8666E746D3

SSDEEP:

196608:Xc2UgjO+7yrv8YCZ3pIwpqbrJd87IeI4bi:tzOwyrkbIgmsJi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • sims-4-updater-v2.4.11.exe (PID: 7836)
      • sims-4-updater-v2.4.11.exe (PID: 7992)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • sims-4-updater-v2.4.11.exe (PID: 7836)

    • Process drops python dynamic module

      • sims-4-updater-v2.4.11.exe (PID: 7836)

    • Process drops legitimate windows executable

      • sims-4-updater-v2.4.11.exe (PID: 7836)

    • The process drops C-runtime libraries

      • sims-4-updater-v2.4.11.exe (PID: 7836)

    • There is functionality for taking screenshot (YARA)

      • sims-4-updater-v2.4.11.exe (PID: 7836)
      • sims-4-updater-v2.4.11.exe (PID: 7992)

    • Application launched itself

      • sims-4-updater-v2.4.11.exe (PID: 7836)

    • Loads Python modules

      • sims-4-updater-v2.4.11.exe (PID: 7992)

    • Starts CMD.EXE for commands execution

      • sims-4-updater-v2.4.11.exe (PID: 7992)

  • INFO

    • The sample compiled with english language support

      • sims-4-updater-v2.4.11.exe (PID: 7836)

    • Checks supported languages

      • sims-4-updater-v2.4.11.exe (PID: 7836)
      • sims-4-updater-v2.4.11.exe (PID: 7992)

    • Reads the computer name

      • sims-4-updater-v2.4.11.exe (PID: 7836)
      • sims-4-updater-v2.4.11.exe (PID: 7992)

    • Create files in a temporary directory

      • sims-4-updater-v2.4.11.exe (PID: 7836)
      • sims-4-updater-v2.4.11.exe (PID: 7992)

    • PyInstaller has been detected (YARA)

      • sims-4-updater-v2.4.11.exe (PID: 7836)
      • sims-4-updater-v2.4.11.exe (PID: 7992)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 8092)

    • Checks proxy server information

      • slui.exe (PID: 6236)
      • sims-4-updater-v2.4.11.exe (PID: 7992)

    • Reads the machine GUID from the registry

      • sims-4-updater-v2.4.11.exe (PID: 7992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (57.6)
.exe | Win64 Executable (generic) (36.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:12:29 02:27:50+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.36
CodeSize: 166400
InitializedDataSize: 95232
UninitializedDataSize: -
EntryPoint: 0xb340
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sims-4-updater-v2.4.11.exe sims-4-updater-v2.4.11.exe cmd.exe no specs conhost.exe no specs notepad.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
6236C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7836"C:\Users\admin\Desktop\sims-4-updater-v2.4.11.exe" C:\Users\admin\Desktop\sims-4-updater-v2.4.11.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\sims-4-updater-v2.4.11.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7992"C:\Users\admin\Desktop\sims-4-updater-v2.4.11.exe" C:\Users\admin\Desktop\sims-4-updater-v2.4.11.exe
sims-4-updater-v2.4.11.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\sims-4-updater-v2.4.11.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
8036C:\WINDOWS\system32\cmd.exe /c "notepad.exe updater_readme.txt"C:\Windows\System32\cmd.exe—sims-4-updater-v2.4.11.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
8044\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8092notepad.exe updater_readme.txtC:\Windows\System32\notepad.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
3 955
Read events
3 955
Write events
0
Delete events
0

Modification events

No data
Executable files
83
Suspicious files
4
Text files
932
Unknown types
0

Dropped files

PID
Process
Filename
Type
7836sims-4-updater-v2.4.11.exeC:\Users\admin\AppData\Local\Temp\_MEI78362\VCRUNTIME140.dllexecutable
MD5:F34EB034AA4A9735218686590CBA2E8B
SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
7836sims-4-updater-v2.4.11.exeC:\Users\admin\AppData\Local\Temp\_MEI78362\Pythonwin\win32ui.pydexecutable
MD5:BE5B11656C4AF66936D83A7246FBFDB5
SHA256:490A2446F61BE529F070F2DB2C6ECEDD765212F85ED4291EEF329128343726A6
7836sims-4-updater-v2.4.11.exeC:\Users\admin\AppData\Local\Temp\_MEI78362\_hashlib.pydexecutable
MD5:D4674750C732F0DB4C4DD6A83A9124FE
SHA256:CAA4D2F8795E9A55E128409CC016E2CC5C694CB026D7058FC561E4DD131ED1C9
7836sims-4-updater-v2.4.11.exeC:\Users\admin\AppData\Local\Temp\_MEI78362\_bz2.pydexecutable
MD5:86D1B2A9070CD7D52124126A357FF067
SHA256:62173A8FADD4BF4DD71AB89EA718754AA31620244372F0C5BBBAE102E641A60E
7836sims-4-updater-v2.4.11.exeC:\Users\admin\AppData\Local\Temp\_MEI78362\VCRUNTIME140_1.dllexecutable
MD5:135359D350F72AD4BF716B764D39E749
SHA256:34048ABAA070ECC13B318CEA31425F4CA3EDD133D350318AC65259E6058C8B32
7836sims-4-updater-v2.4.11.exeC:\Users\admin\AppData\Local\Temp\_MEI78362\Pythonwin\mfc140u.dllexecutable
MD5:2EB07F3BE1F3C40145829FBF64E8678E
SHA256:643CE7FE6A203C53A96A00F272A1A5B42D5B0C320C84364A6FE866307A19BB65
7836sims-4-updater-v2.4.11.exeC:\Users\admin\AppData\Local\Temp\_MEI78362\_ssl.pydexecutable
MD5:7910FB2AF40E81BEE211182CFFEC0A06
SHA256:D2A7999E234E33828888AD455BAA6AB101D90323579ABC1095B8C42F0F723B6F
7836sims-4-updater-v2.4.11.exeC:\Users\admin\AppData\Local\Temp\_MEI78362\_overlapped.pydexecutable
MD5:FDF8663B99959031780583CCE98E10F5
SHA256:2EBBB0583259528A5178DD37439A64AFFCB1AB28CF323C6DC36A8C30362AA992
7836sims-4-updater-v2.4.11.exeC:\Users\admin\AppData\Local\Temp\_MEI78362\_queue.pydexecutable
MD5:D8C1B81BBC125B6AD1F48A172181336E
SHA256:925F05255F4AAE0997DC4EC94D900FD15950FD840685D5B8AA755427C7422B14
7836sims-4-updater-v2.4.11.exeC:\Users\admin\AppData\Local\Temp\_MEI78362\_cffi_backend.cp310-win_amd64.pydexecutable
MD5:04FD1A452E91605545A267CB04CDD78F
SHA256:C379126647AF2CBFB592D6A921F6218DA59B886E2A56E9B82F8159ACED6F1100
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
23
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6768
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4292
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4292
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4744
slui.exe
POST
500
48.192.1.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
unknown
6236
slui.exe
POST
500
48.192.1.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
6768
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
4292
svchost.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
4292
svchost.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
—
—
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.251.141.110
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 23.59.18.102
whitelisted
self.events.data.microsoft.com
  • 13.89.179.13
whitelisted
files.itdev.cloud
  • 188.114.97.3
  • 188.114.96.3
unknown
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sims-4-updater-v2.4.11.exe