File name:

c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6

Full analysis: https://app.any.run/tasks/69c0281c-c489-4aea-af93-75539abda140
Verdict: Malicious activity
Analysis date: May 16, 2025, 02:16:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
MD5:

F0770FBD20A065BDB58304405B189921

SHA1:

937742596FDA6495749D8CB1ECA813DFBF2BF4AD

SHA256:

C2C3CB3D4698965980CA8615FF9A5709F99B5E92398E0C79E20EF9AB45FA37F6

SSDEEP:

384:rU1IqlRwRebut+bbu2EB9F8xiwEB9F8xihP:Q1Iqlwebhbur9F8xi59F8xiJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exe (PID: 7396)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exe (PID: 7396)

    • The process creates files with name similar to system file names

      • c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exe (PID: 7396)

    • Creates file in the systems drive root

      • c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exe (PID: 7396)

  • INFO

    • Checks supported languages

      • c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exe (PID: 7396)

    • Creates files or folders in the user directory

      • c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exe (PID: 7396)

    • Checks proxy server information

      • slui.exe (PID: 7764)

    • Reads the software policy settings

      • slui.exe (PID: 7764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.4)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x2130
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7396"C:\Users\admin\Desktop\c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exe" C:\Users\admin\Desktop\c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7764C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 369
Read events
3 369
Write events
0
Delete events
0

Modification events

No data
Executable files
1 876
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7396c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exe —
MD5:—
SHA256:—
7396c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:EAF055B919EE3BC518C5CE88BF4C4CED
SHA256:CBB008476B4BA561E888EC7775D876AD4555798CE2631CB68A6BAFF9CC420182
7396c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe.tmpexecutable
MD5:07F3A51CE080A4956D4EE987E40AE730
SHA256:3285329A8088BA54EE3FE8EA0F1198D12B81D3672A7EBB8DBA78FF259A423138
7396c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exeexecutable
MD5:FD5F37497C40F818F4D5F2953DA81ACA
SHA256:C868580415C75ACB0D20B8968A9F7CC49B92B71555F1646DCEBBB3CAB8CFA60E
7396c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmpexecutable
MD5:3E6CBC82047DBA1D879324DA94DA740E
SHA256:FDE3D19A7B7ED57B16CFAF8741614686D4102C890E8C831919F1414939DCA559
7396c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.tmpexecutable
MD5:FD5F37497C40F818F4D5F2953DA81ACA
SHA256:C868580415C75ACB0D20B8968A9F7CC49B92B71555F1646DCEBBB3CAB8CFA60E
7396c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.tmpexecutable
MD5:8DDF461087F381A397A9EA8AE3F86D0E
SHA256:A2BE3DE30CA1D1DBBDBE21B2FEF32A87321C28E99183D97DD2BF1837C8239CA7
7396c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmpexecutable
MD5:3D35045C6B1F5CBB953BFD82FA5EFA5F
SHA256:4C119EB767AEF55185E1C975F01A449E2B030BC2EC296A86917F450C8CBB9BB0
7396c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:C28F73F7D0FBEAEBDF7A70EC93F51344
SHA256:F402347167CCB6665515168FFDEBD70E8448A02940F54F762D1A35413B1DA20B
7396c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_reader_appicon_16.png.tmpexecutable
MD5:F53008DB169A8C0AEE678545F0D0568B
SHA256:95AD22725216A23566F911D3FC2F0A0D42039812657F5111AE8A28FF7AE0ED84
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
19
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4220
RUXIMICS.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4220
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4220
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4220
RUXIMICS.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4220
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7252
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7764
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
c2c3cb3d4698965980ca8615ff9a5709f99b5e92398e0c79e20ef9ab45fa37f6