File name:

in.exe

Full analysis: https://app.any.run/tasks/f1b81053-a258-45f6-b13c-a40a3cb07cc0
Verdict: Malicious activity
Analysis date: July 20, 2024, 20:30:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

9C048FFDE580EA3E0F890A63AE2249C2

SHA1:

CEE91EA1321E83EDD305945224F611B6A5900A41

SHA256:

E70F64A374E1784942C771940F07F08CDEE78144F2135BF1665557D1FCEE0F16

SSDEEP:

49152:6AZUXbnbcIm/NSekcsE3ciNaUsqhsxTY+:bZUXbnbcIm/NSekcsE3ciNaU5s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • in.exe (PID: 1668)

    • Actions looks like stealing of personal data

      • in.exe (PID: 1668)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Checks supported languages

      • in.exe (PID: 1668)

    • Creates files or folders in the user directory

      • in.exe (PID: 1668)

    • Reads the software policy settings

      • slui.exe (PID: 5768)

    • Checks proxy server information

      • slui.exe (PID: 5768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:06:26 19:39:54+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.39
CodeSize: 1670656
InitializedDataSize: 456192
UninitializedDataSize: -
EntryPoint: 0xc499e
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start in.exe slui.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1668"C:\Users\admin\Desktop\in.exe" C:\Users\admin\Desktop\in.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\in.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1920C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5768C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 763
Read events
3 763
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
175
Text files
1 417
Unknown types
0

Dropped files

PID
Process
Filename
Type
1668in.exeC:\Users\admin\AppData\Roaming\htdocs\UninstallPersistSqlState.sqltext
MD5:EBD3EBDCAE391B0098D795A084AC38F2
SHA256:7B35F634C8096D607E8832FE4179E9E30A740BDC2641A55BB98F956E9E6DBDDA
1668in.exeC:\Users\admin\AppData\Roaming\htdocs\UninstallSqlState.sqltext
MD5:F7444C2379E975A3B9AE7FE113AF7D75
SHA256:87FAF5B5C314A5B639F3662A3AA646FF375CC6E99474A389EFA2630588474229
1668in.exeC:\Users\admin\AppData\Roaming\htdocs\UninstallSqlStateTemplate.sqltext
MD5:738AC3DAF1A1CAF913613FEE905615F1
SHA256:04E7227B71D44EDE4C1645890D427A6A8B371336B54D4B54D239A5B428CDBAAD
1668in.exeC:\Users\admin\AppData\Roaming\htdocs\InstallCommon.sqltext
MD5:9F98C2C73863465CDFC92B677859967D
SHA256:47AB5F8CD157CBE69F64356EC83E6BD15BA7D927220FD6B08B7AF7BAA50C60B3
1668in.exeC:\Users\admin\AppData\Roaming\htdocs\UninstallPersonalization.sqltext
MD5:A469BDC86EC8C008E153B1965FB6E7B7
SHA256:727DF02B1A88D25C94A087F23EE1248756A0DF9853C135E6703078E68F78CCA5
1668in.exeC:\Users\admin\AppData\Roaming\htdocs\InstallSqlState.sqltext
MD5:5455E04BD4519A417B95630567897DD6
SHA256:3877F089AC05150C23D40E4BB0097CBF47FBF3BFDF6624905951F4FF4F5D990D
1668in.exeC:\Users\admin\AppData\Roaming\htdocs\InstallSqlStateTemplate.sqltext
MD5:CC70B7258A6139FA927CE8DA5436BEF4
SHA256:5820FE72835736CB0C0E079E4C2094963E4C362D352F66FF3F54BBE74346CD0F
1668in.exeC:\Users\admin\AppData\Roaming\htdocs\SqlPersistenceService_Logic.sqltext
MD5:6FBA390544C4617B7CC44DEB8869F9DA
SHA256:36AAE1040C82432E277452526FE1C2294EF6A0A784A5691856B04D38CE63D4C4
1668in.exeC:\Users\admin\AppData\Roaming\htdocs\Tracking_Logic.sqltext
MD5:0F6AE4C239543E3E55178E6380B0BC2D
SHA256:710EC48B1A6CAB84FE5B2C0DBD6D9DDC79B5FC6823D82B9676B6D5EC473411DF
1668in.exeC:\Users\admin\AppData\Roaming\htdocs\InstallPersistSqlState.sqltext
MD5:429359283F28499C0BDFE9A5EDD1B51F
SHA256:2D13E917D26835160429D1D398270678FCC082E3980A8B0220F7EBA6655F5EFF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
46
DNS requests
12
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
20.242.39.171:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
—
—
GET
200
20.12.23.50:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
—
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
104.126.37.176:443
https://www.bing.com/client/config?cc=US&setlang=en-US
unknown
binary
2.15 Kb
—
—
—
GET
200
20.223.35.26:443
https://fd.api.iris.microsoft.com/v4/api/selection?&asid=37CAC9FDF19846BD879DB04A65D45F55&nct=1&placement=88000677&bcnt=30&country=US&locale=en-US&poptin=0&fmt=json&arch=AMD64&chassis=1&concp=0&d3dfl=D3D_FEATURE_LEVEL_12_1&devfam=Windows.Desktop&devosver=10.0.19045.4046&dinst=1661339444&dmret=0&flightbranch=&flightring=Retail&icluc=0&localid=w%3AAC7699B0-48EA-FD22-C8DC-06A02098A0F0&oem=DELL&osbranch=vb_release&oslocale=en-US&osret=1&ossku=Professional&osskuid=48&prccn=4&prccs=3094&prcmf=AuthenticAMD&procm=Intel%28R%29%20Core%28TM%29%20i5-6400%20CPU%20%40%202.70GHz&ram=4096&tinst=Client&tl=1&pat=0&smc=0&sac=0&disphorzres=1280&dispsize=15.3&dispvertres=720&ldisphorzres=1280&ldispvertres=720&moncnt=1&cpdsk=260281&frdsk=218542&lo=3612270&tsu=1002800
unknown
binary
102 b
—
—
—
POST
200
20.103.156.88:443
https://arc.msn.com/v4/api/register?asid=ABEC3AE5C2F542CB9AF7353CEEDD63B3&placement=cdmdevreg&country=US&locale=en-US&poptin=0&fmt=json&arch=AMD64&chassis=1&concp=0&d3dfl=D3D_FEATURE_LEVEL_12_1&devfam=Windows.Desktop&devosver=10.0.19045.4046&dinst=1661339444&dmret=0&flightbranch=&flightring=Retail&icluc=0&localid=w%3AAC7699B0-48EA-FD22-C8DC-06A02098A0F0&oem=DELL&osbranch=vb_release&oslocale=en-US&osret=1&ossku=Professional&osskuid=48&prccn=4&prccs=3094&prcmf=AuthenticAMD&procm=Intel%28R%29%20Core%28TM%29%20i5-6400%20CPU%20%40%202.70GHz&ram=4096&tinst=Client&tl=1&pat=0&smc=0&sac=0&disphorzres=1280&dispsize=15.3&dispvertres=720&ldisphorzres=1280&ldispvertres=720&moncnt=1&cpdsk=260281&frdsk=218542&lo=3612270&tsu=1002800
unknown
—
—
—
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4716
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5620
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
7856
svchost.exe
4.209.32.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
8056
backgroundTaskHost.exe
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
unknown
2760
svchost.exe
40.113.103.199:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5620
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3400
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 40.126.32.133
  • 20.190.160.20
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.140
  • 40.126.32.76
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.174
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.136
  • 104.126.37.139
  • 104.126.37.185
  • 104.126.37.130
  • 104.126.37.131
  • 104.126.37.155
  • 104.126.37.163
  • 104.126.37.176
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
—
—
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
in.exe