File name:

2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7

Full analysis: https://app.any.run/tasks/3b7b3404-dd7e-4abb-883f-dcf322f1c245
Verdict: Malicious activity
Analysis date: May 18, 2025, 10:00:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
MD5:

81FC313583CCF1AF2E200D929F8296AC

SHA1:

367EBE8C9279CFE7FF9BCFCFB79ABE2A84AB5AAC

SHA256:

2DB302B332C82E45BB493BA1EB081041DA9EC60C861EC82C65D6F5177D13B9D7

SSDEEP:

384:Ujmr2zerFvXxSnt+bbu2EB9F8xiwEB9F8xi3:UjVzMlXAqbur9F8xi59F8xi3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

    • The process creates files with name similar to system file names

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

    • Creates file in the systems drive root

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

  • INFO

    • Creates files or folders in the user directory

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

    • Checks supported languages

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

    • Checks proxy server information

      • slui.exe (PID: 7940)

    • Reads the software policy settings

      • slui.exe (PID: 7940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.4)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x6000
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7432"C:\Users\admin\Desktop\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe" C:\Users\admin\Desktop\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7940C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 369
Read events
3 369
Write events
0
Delete events
0

Modification events

No data
Executable files
1 730
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe —
MD5:—
SHA256:—
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:32BA993D991B4138948B83ED5ADFAD61
SHA256:BE15919165DBF8A976808565236A3FD6E8C6A96E45A0677FDD76C111FA7AFA80
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\BOOTNXT.tmpexecutable
MD5:904690355CC93D1BF4165E4CBC631811
SHA256:D669940B2655AE3BAD5FCF9469918C9CCA93A9A45A64F9F3CE998797924C477F
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:3F19C9B6998EE66CE14F7088D1E51829
SHA256:BE13EC0E895ED7D5CE5C70D5CAADA65D2017846708BC54CFDBEB74B27375D369
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe.tmpexecutable
MD5:9CDEF24664FCED8A3046F62D57CF4D7C
SHA256:03C3ECD2C1C6CF1720E91E5369A65ABCE513D26524DF63DE7048974A1A08B9FE
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll.tmpexecutable
MD5:E9E2F68226B70497399DE4F78F32CA4A
SHA256:AA63C78CFBFAC3B96B275D23B0A5AD11784A44B9E3A9699A9C6046B636A41922
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.tmpexecutable
MD5:F71AAE3FEC73FF68C342C8B07636D788
SHA256:9138D6CA961955CADD2C7274243E08B9AA496AEC265ACEF6DC741C656C49B018
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatRes.dll.tmpexecutable
MD5:70C8B91B5F89CC48C44DF608309E07BA
SHA256:D50BA7EF9D9BDBFEC2EDD45BD98E6E3D27F86B5944B944119EC7D73AE730FC93
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.tmpexecutable
MD5:77B96EB1905BAB20A8F068581089C70B
SHA256:F5AC4AD45049A9220EB8F510FC2F297B630B3F65CC206ED1AB70F3C791ED325E
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe.tmpexecutable
MD5:7592D058E0896059B0DAAF8691F2AA9B
SHA256:FEB4EC2C24947E7205EFA89CEA820FF3C95C2B9CB66889DBAA9D9AC82DD25301
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
49
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5680
RUXIMICS.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5680
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5680
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5680
RUXIMICS.exe
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5680
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7728
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
7728
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.74.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.37
  • 23.216.77.35
  • 23.216.77.41
  • 23.216.77.38
  • 23.216.77.31
  • 23.216.77.28
  • 23.216.77.8
  • 23.216.77.6
  • 23.216.77.42
  • 23.216.77.22
  • 23.216.77.20
  • 23.216.77.36
  • 23.216.77.19
  • 23.216.77.25
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.4
  • 40.126.31.69
  • 40.126.31.67
  • 20.190.159.2
  • 40.126.31.71
  • 20.190.159.23
  • 20.190.159.64
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7