File name:

44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe

Full analysis: https://app.any.run/tasks/2c11ff37-b533-42cf-979c-4a3f26f421d5
Verdict: Malicious activity
Analysis date: July 26, 2025, 01:52:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
MD5:

1E001C8C4A9831010E8E7A0EBAB41573

SHA1:

84E46F1034E19DA418B0959E0DB30677A1A6682D

SHA256:

44836B58EADC4F3C058E8D10CFF700D1F193663D1953235A2F0CA76B98097112

SSDEEP:

393216:seNwCUyJ7/JGMKBtZ8kA9SF7pjEluxwG2ZBOMH2cUYdJxvw+IB5vzJU08bVFieV7:seNwCUyJ7/JGMKBtZ8kA9SF7pjEluxwh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • 44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe (PID: 1356)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • 44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe (PID: 1356)

    • Executable content was dropped or overwritten

      • 44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe (PID: 1356)

    • The process creates files with name similar to system file names

      • 44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe (PID: 1356)

  • INFO

    • Creates files or folders in the user directory

      • 44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe (PID: 1356)

    • Checks supported languages

      • 44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe (PID: 1356)

    • Reads the software policy settings

      • slui.exe (PID: 6892)

    • Checks proxy server information

      • slui.exe (PID: 6892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.4)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x6000
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE 44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1356"C:\Users\admin\Desktop\44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe" C:\Users\admin\Desktop\44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6892C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 491
Read events
3 491
Write events
0
Delete events
0

Modification events

No data
Executable files
241
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
135644836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exe —
MD5:—
SHA256:—
135644836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe —
MD5:—
SHA256:—
135644836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmpexecutable
MD5:62F856BDFC057C52A8E834FD588C44BF
SHA256:3715D75F0BF39BD57DA547E84CEB8077B998BABCFB3F1927BAA49E0BFF731D41
135644836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe.tmpexecutable
MD5:B37972DFDA654248E618B3D80E4A9F9F
SHA256:18FA2A6595A4CEF0C09DFE9013DBDB53A17C3B487098E66B0DA8735474F8E4E8
135644836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exeC:\Users\admin\AppData\Local\VirtualStore\BOOTNXT.tmpexecutable
MD5:96B3BDA7CA852E5AEECC96A50AFC8F8A
SHA256:9AE988120864E472951C67807D649A06A90E03E45748F77C48EA952BFA7AA902
135644836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:A63CD23A295B97429618BC56B8FA4575
SHA256:41B772D3EBEBF7F1664DC60CA7BD3B4971DD3CEEED8E66CB79FAD6E82FF421CC
135644836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmpexecutable
MD5:47B7E996080C7AC06A696C71EF6D3884
SHA256:A3BD2032CA463870A00F9C43DFF41B9F71CB4957B8E7F9FFD43A3FB4C22F7518
135644836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll.tmpexecutable
MD5:BD44E9736FABFDF53B6A31CADE659F4C
SHA256:C1F8A3A7693F3A04E39248388979D99BAFCDE6D4EE35121A5E62905C3C953EA9
135644836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef.pak.tmpexecutable
MD5:32286483553749BBCF90DDB3FE85794A
SHA256:D69C55731588D94B8AA9B61D1D01DEBD94FBC8A3E4D73738DDE298C1EA110655
135644836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:AE7FE509FC132539B552E9658727029D
SHA256:6EF9F1CE82C2455231D6DC56FC5BDC56F7CB3D5FBC15FFC99B7A91EF90C52A5E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
49
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.55.110.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2992
RUXIMICS.exe
GET
200
23.55.110.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.55.110.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2992
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.160.2:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
200
20.190.160.132:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
—
—
POST
200
20.190.160.22:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
POST
200
20.190.160.66:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
POST
400
20.190.160.2:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2992
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.55.110.193:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.55.110.193:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2992
RUXIMICS.exe
23.55.110.193:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 23.55.110.193
  • 23.55.110.211
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.69
  • 40.126.31.1
  • 20.190.159.23
  • 20.190.159.71
  • 20.190.159.130
  • 20.190.159.2
  • 40.126.31.2
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
self.events.data.microsoft.com
  • 52.182.143.210
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
44836b58eadc4f3c058e8d10cff700d1f193663d1953235a2f0ca76b98097112.exe