File name:

b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85

Full analysis: https://app.any.run/tasks/ffe97131-9fb6-44fd-9466-8946c8deb075
Verdict: Malicious activity
Analysis date: June 21, 2025, 12:55:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections
MD5:

EBDFCEDE9DD0D557C9D547CAEC387F2F

SHA1:

5340B6D190103FED2E11CC22E8316D510658B587

SHA256:

B27E0688411793B98F48F9C771C9C6F3265BD25A6C5183B77E8370053C483C85

SSDEEP:

49152:wicAytHo+hOVmmmmmmmmmmmmmmmhJL+F8g+nZTnAHFo2i7B/qeOFw/vHSdKbJJb3:veoKVl+ynZTnG5i7iFwTfb3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.mm (PID: 504)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe (PID: 3752)

    • Executable content was dropped or overwritten

      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe (PID: 3752)

    • Starts application with an unusual extension

      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe (PID: 3752)

    • There is functionality for taking screenshot (YARA)

      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe (PID: 3752)

  • INFO

    • Checks supported languages

      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe (PID: 3752)
      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.tmp (PID: 5616)
      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.mm (PID: 504)

    • The sample compiled with english language support

      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe (PID: 3752)

    • Create files in a temporary directory

      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.tmp (PID: 5616)

    • Failed to create an executable file in Windows directory

      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.mm (PID: 504)
      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe (PID: 3752)

    • Launching a file from a Registry key

      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.mm (PID: 504)

    • Compiled with Borland Delphi (YARA)

      • b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe (PID: 3752)

    • Checks proxy server information

      • slui.exe (PID: 1660)

    • Reads the software policy settings

      • slui.exe (PID: 1660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: 512
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x2a594
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.tmp no specs b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.mm slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
504C:\Users\admin\Desktop\b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.mm /zhjC:\Users\admin\Desktop\b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.mm
b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.mm
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1660C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3752"C:\Users\admin\Desktop\b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe" C:\Users\admin\Desktop\b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5616C:\Users\admin\Desktop\b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.tmpC:\Users\admin\Desktop\b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.tmp—b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2147500037
Modules
Images
c:\users\admin\desktop\b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
3 522
Read events
3 521
Write events
1
Delete events
0

Modification events

(PID) Process:(504) b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.mmKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:GOG
Value:
C:\WINDOWS\GOG.exe
Executable files
7
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
5616b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.tmpC:\Users\admin\AppData\Local\Temp\Setup_20250621125527_Failed.txttext
MD5:A91399B8389173C95D2F0141F433582B
SHA256:5E1A170A32881C78CB6FCFD2CB73AAAFBE6EAE8EDA22CA337270092191C39877
3752b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exeC:\Users\admin\Desktop\b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.tmpexecutable
MD5:06BCEC7981ADD80FA0A456C85058532D
SHA256:067017ECBE1E90B9FDE6F4BC40CDE9E8E072FE996B226A384B226547F070F645
3752b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exeexecutable
MD5:EC2801072AABFC363B3174CF96FB9B30
SHA256:DD93927FD7C5EBB7B35D3DA250E776AEB5A36486BD111671E9CC6749FDCBAF13
3752b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exeexecutable
MD5:561E46D582ADC58011D784E069815E55
SHA256:5F4CBD9BCD0251DD2C8422BC7EDB6A1F8028568C1577EE65B8BCA461400EA115
3752b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exeC:\Users\admin\Desktop\b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.mmexecutable
MD5:6DAD671EF18179F129DA5E21E4A65E77
SHA256:CF362FD725FFD6872DBAD4C3BE82328662B39BCE2AEFB0AF14126D37E82A6B6C
3752b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exeexecutable
MD5:7A6368F154EBF99ED03A9B7C3C4E120B
SHA256:65A5F770478E68718B844A355031226DCDD9B32ED2F74FC294EB5C24834FC2D1
3752b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exeexecutable
MD5:FE0157F0E4569785A2F1522ECA407C15
SHA256:76091C4D384620A5A18AEAC16DCE52F14BE21BE5BB864D3AE8B4F73A976609EE
3752b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeexecutable
MD5:99F9C86140A126206FFD2657EC59EF5F
SHA256:766910E038375E7D667DF9F45652182A39B8A386BA373765F73BB3B46575A013
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
47
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5476
RUXIMICS.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5476
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.159.0:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
200
40.126.31.128:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
—
—
POST
200
20.190.159.0:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
POST
200
40.126.31.1:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5476
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5476
RUXIMICS.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5944
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5476
RUXIMICS.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.66
  • 20.190.160.20
  • 20.190.160.17
  • 20.190.160.4
  • 40.126.32.134
  • 20.190.160.64
  • 20.190.160.2
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
b27e0688411793b98f48f9c771c9c6f3265bd25a6c5183b77e8370053c483c85