File name:

2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7

Full analysis: https://app.any.run/tasks/3b7b3404-dd7e-4abb-883f-dcf322f1c245
Verdict: Malicious activity
Analysis date: May 18, 2025, 10:00:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
MD5:

81FC313583CCF1AF2E200D929F8296AC

SHA1:

367EBE8C9279CFE7FF9BCFCFB79ABE2A84AB5AAC

SHA256:

2DB302B332C82E45BB493BA1EB081041DA9EC60C861EC82C65D6F5177D13B9D7

SSDEEP:

384:Ujmr2zerFvXxSnt+bbu2EB9F8xiwEB9F8xi3:UjVzMlXAqbur9F8xi59F8xi3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

    • The process creates files with name similar to system file names

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

    • Executable content was dropped or overwritten

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

  • INFO

    • Creates files or folders in the user directory

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

    • Checks supported languages

      • 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe (PID: 7432)

    • Checks proxy server information

      • slui.exe (PID: 7940)

    • Reads the software policy settings

      • slui.exe (PID: 7940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.4)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x6000
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7432"C:\Users\admin\Desktop\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe" C:\Users\admin\Desktop\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7940C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 369
Read events
3 369
Write events
0
Delete events
0

Modification events

No data
Executable files
1 730
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exe —
MD5:—
SHA256:—
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.tmpexecutable
MD5:084740AA0867F7DAA2D5BA30DA6575DB
SHA256:0A593FF0FD1EFAAE200DBC4D349C2BDEFB8FA425A837652BAD978725A760CA3B
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\BOOTNXT.tmpexecutable
MD5:904690355CC93D1BF4165E4CBC631811
SHA256:D669940B2655AE3BAD5FCF9469918C9CCA93A9A45A64F9F3CE998797924C477F
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:32BA993D991B4138948B83ED5ADFAD61
SHA256:BE15919165DBF8A976808565236A3FD6E8C6A96E45A0677FDD76C111FA7AFA80
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exeexecutable
MD5:084740AA0867F7DAA2D5BA30DA6575DB
SHA256:0A593FF0FD1EFAAE200DBC4D349C2BDEFB8FA425A837652BAD978725A760CA3B
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:3F19C9B6998EE66CE14F7088D1E51829
SHA256:BE13EC0E895ED7D5CE5C70D5CAADA65D2017846708BC54CFDBEB74B27375D369
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmpexecutable
MD5:578353F75356657EB0318BA707F0A702
SHA256:CBFDBE8DC8A1F5FA32BCBCD7AF77F45F0BA8E3E70DD1E3DC4DE52CF4BBADB5BD
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmpexecutable
MD5:8CD72574821F6E72208689043BBE6D34
SHA256:23C10290FE536F3064440FEF7912CFEA6B0A1A970D6D6BE918B3154C23794C5D
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.tmpexecutable
MD5:77B96EB1905BAB20A8F068581089C70B
SHA256:F5AC4AD45049A9220EB8F510FC2F297B630B3F65CC206ED1AB70F3C791ED325E
74322db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.tmpexecutable
MD5:F71AAE3FEC73FF68C342C8B07636D788
SHA256:9138D6CA961955CADD2C7274243E08B9AA496AEC265ACEF6DC741C656C49B018
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
49
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5680
RUXIMICS.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5680
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5680
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5680
RUXIMICS.exe
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5680
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7728
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
7728
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.74.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.37
  • 23.216.77.35
  • 23.216.77.41
  • 23.216.77.38
  • 23.216.77.31
  • 23.216.77.28
  • 23.216.77.8
  • 23.216.77.6
  • 23.216.77.42
  • 23.216.77.22
  • 23.216.77.20
  • 23.216.77.36
  • 23.216.77.19
  • 23.216.77.25
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.4
  • 40.126.31.69
  • 40.126.31.67
  • 20.190.159.2
  • 40.126.31.71
  • 20.190.159.23
  • 20.190.159.64
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7