File name:

7z2600-x64.exe

Full analysis: https://app.any.run/tasks/f3a9596b-f086-43c5-a316-3fc181a55a2b
Verdict: No threats detected
Analysis date: February 12, 2026, 16:00:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

8225B98C5F9F30859E0E9DD09A2B6860

SHA1:

50BAB6B6088E1C3C2F3ACC531EDC346534591DF5

SHA256:

6FE18D5B3080E39678CABFA6CEF12CFB25086377389B803A36A3C43236A8A82C

SSDEEP:

49152:PC4xcuy/K56EviUcBhlr/gg0rAGPuqOCsXEbP6Hozgro8sPr6pCa9nqOO5S0FMa3:qJum5ycB3/94AGPuP5JHJ1CMnqX5S2Ms

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Creates/Modifies COM task schedule object

      • 7z2600-x64.exe (PID: 9208)

    • Drops 7-zip archiver for unpacking

      • 7z2600-x64.exe (PID: 9208)

    • Executable content was dropped or overwritten

      • 7z2600-x64.exe (PID: 9208)

  • INFO

    • Checks supported languages

      • 7z2600-x64.exe (PID: 9208)
      • 7zFM.exe (PID: 8032)

    • Reads the computer name

      • 7z2600-x64.exe (PID: 9208)
      • 7zFM.exe (PID: 8032)

    • Creates files in the program directory

      • 7z2600-x64.exe (PID: 9208)

    • Creates a software uninstall entry

      • 7z2600-x64.exe (PID: 9208)

    • The sample compiled with english language support

      • 7z2600-x64.exe (PID: 9208)

    • The sample compiled with russian language support

      • 7z2600-x64.exe (PID: 9208)

    • Manual execution by a user

      • 7zFM.exe (PID: 8032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2026:02:12 12:00:00+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware
PEType: PE32+
LinkerVersion: 8
CodeSize: 32256
InitializedDataSize: 27136
UninitializedDataSize: -
EntryPoint: 0x8800
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 26.0.0.0
ProductVersionNumber: 26.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Igor Pavlov
FileDescription: 7-Zip Installer
FileVersion: 26
InternalName: 7zipInstall
LegalCopyright: Copyright (c) 1999-2026 Igor Pavlov
OriginalFileName: 7zipInstall.exe
ProductName: 7-Zip
ProductVersion: 26
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 7z2600-x64.exe slui.exe no specs 7zfm.exe no specs 7z2600-x64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6096C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7392"C:\Users\admin\AppData\Local\Temp\7z2600-x64.exe" C:\Users\admin\AppData\Local\Temp\7z2600-x64.exe—explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Installer
Exit code:
3221226540
Version:
26.00
Modules
Images
c:\users\admin\appdata\local\temp\7z2600-x64.exe
c:\windows\system32\ntdll.dll
8032"C:\Program Files\7-Zip\7zFM.exe" C:\Program Files\7-Zip\7zFM.exe—explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip File Manager
Version:
26.00
Modules
Images
c:\program files\7-zip\7zfm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
9208"C:\Users\admin\AppData\Local\Temp\7z2600-x64.exe" C:\Users\admin\AppData\Local\Temp\7z2600-x64.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Installer
Exit code:
0
Version:
26.00
Modules
Images
c:\users\admin\appdata\local\temp\7z2600-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\gdi32.dll
Total events
590
Read events
569
Write events
21
Delete events
0

Modification events

(PID) Process:(9208) 7z2600-x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\7-Zip
Operation:writeName:Path64
Value:
C:\Program Files\7-Zip\
(PID) Process:(9208) 7z2600-x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\7-Zip
Operation:writeName:Path
Value:
C:\Program Files\7-Zip\
(PID) Process:(9208) 7z2600-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\7-Zip
Operation:writeName:Path64
Value:
C:\Program Files\7-Zip\
(PID) Process:(9208) 7z2600-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\7-Zip
Operation:writeName:Path
Value:
C:\Program Files\7-Zip\
(PID) Process:(9208) 7z2600-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(9208) 7z2600-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(9208) 7z2600-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Operation:writeName:{23170F69-40C1-278A-1000-000100020000}
Value:
7-Zip Shell Extension
(PID) Process:(9208) 7z2600-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Operation:writeName:{23170F69-40C1-278A-1000-000100020000}
Value:
7-Zip Shell Extension
(PID) Process:(9208) 7z2600-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\7zFM.exe
Operation:writeName:Path
Value:
C:\Program Files\7-Zip\
(PID) Process:(9208) 7z2600-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
Operation:writeName:DisplayName
Value:
7-Zip 26.00 (x64)
Executable files
9
Suspicious files
3
Text files
97
Unknown types
0

Dropped files

PID
Process
Filename
Type
92087z2600-x64.exeC:\Program Files\7-Zip\7-zip.chmbinary
MD5:AD95170218E6C5ADB23874C46CBF4CA8
SHA256:CD851FFFE7E1B615A11AD22DB85197DF53C610873B7CBD157DCE38E4CF6C8E90
92087z2600-x64.exeC:\Program Files\7-Zip\Lang\az.txttext
MD5:9CD3A23CA6F66F570607F63BE6AA0001
SHA256:1DA941116E20E69F61A4A68481797E302C11FCF462CA7203A565588B26011615
92087z2600-x64.exeC:\Program Files\7-Zip\descript.iontext
MD5:EB7E322BDC62614E49DED60E0FB23845
SHA256:1DA513F5A4E8018B9AE143884EB3EAF72454B606FD51F2401B7CFD9BE4DBBF4F
92087z2600-x64.exeC:\Program Files\7-Zip\Lang\ar.txttext
MD5:A1811F34B8F15CC44AB7486CE1E7337B
SHA256:9B4459407E87310D5673040E5E9A364E49B430EA94037A63F30F0D9E5A34A342
92087z2600-x64.exeC:\Program Files\7-Zip\Lang\an.txttext
MD5:F16218139E027338A16C3199091D0600
SHA256:3AB9F7AACD38C4CDE814F86BC37EEC2B9DF8D0DDDB95FC1D09A5F5BCB11F0EEB
92087z2600-x64.exeC:\Program Files\7-Zip\Lang\be.txttext
MD5:B1DD654E9D8C8C1B001F7B3A15D7B5D3
SHA256:32071222AF04465A3D98BB30E253579AA4BECEAEB6B21AC7C15B25F46620BF30
92087z2600-x64.exeC:\Program Files\7-Zip\Lang\af.txttext
MD5:DF216FAE5B13D3C3AFE87E405FD34B97
SHA256:9CF684EA88EA5A479F510750E4089AEE60BBB2452AA85285312BAFCC02C10A34
92087z2600-x64.exeC:\Program Files\7-Zip\Lang\bg.txttext
MD5:2D0C8197D84A083EF904F8F5608AFE46
SHA256:62C6F410D011A109ABECB79CAA24D8AEB98B0046D329D611A4D07E66460EEF3F
92087z2600-x64.exeC:\Program Files\7-Zip\Lang\ca.txttext
MD5:A77210BE2527533D1ECEB8F0EA49607A
SHA256:DA4DF6490C7BC8AFD804509F696F9AFA6F709B7A327044E2781FA6C95770B239
92087z2600-x64.exeC:\Program Files\7-Zip\Lang\bn.txttext
MD5:771C8B73A374CB30DF4DF682D9C40EDF
SHA256:3F55B2EC5033C39C159593C6F5ECE667B92F32938B38FCAF58B4B2A98176C1FC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
29
DNS requests
22
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6768
MoUsoCoreWorker.exe
GET
304
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
—
—
GET
304
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
5468
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
5468
SIHClient.exe
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
5468
SIHClient.exe
GET
200
74.178.76.128:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
5468
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
5568
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
US
binary
314 b
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
US
binary
959 b
whitelisted
356
svchost.exe
POST
200
20.190.159.4:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
whitelisted
356
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5568
SearchApp.exe
92.123.104.9:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5568
SearchApp.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4948
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4256
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3412
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
356
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 20.42.73.28
whitelisted
google.com
  • 142.251.141.110
whitelisted
www.bing.com
  • 92.123.104.9
  • 92.123.104.5
  • 92.123.104.65
  • 92.123.104.61
  • 92.123.104.63
  • 92.123.104.66
  • 92.123.104.62
  • 92.123.104.8
  • 92.123.104.67
  • 2.16.204.150
  • 2.16.204.146
  • 2.16.204.147
  • 2.16.204.153
  • 2.16.204.152
  • 2.16.204.149
  • 2.16.204.157
  • 2.16.204.155
  • 2.16.204.151
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 23.63.118.230
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.3
  • 40.126.31.2
  • 40.126.31.67
  • 20.190.159.0
  • 40.126.31.69
  • 20.190.159.128
  • 40.126.31.128
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted

Threats

PID
Process
Class
Message
4256
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
5568
SearchApp.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Front Door domain observed in TLS SNI ( .azurefd .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7z2600-x64.exe