File name:

1 (359)

Full analysis: https://app.any.run/tasks/03f1cdb6-5d59-454b-9fe1-f2a71fffa3d0
Verdict: Malicious activity
Analysis date: March 24, 2025, 20:26:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 7 sections
MD5:

7CDE8978C8BE0A81DEF9335814B93E00

SHA1:

35264BF3D6A6D90F577D17B179F0ED413FC2920B

SHA256:

C4703DAA3165F51C39A625BB995A6ADA77DB70EF4BA6E058C5BFF7EE4A64C5F4

SSDEEP:

98304:Cp7jwpUIuH9Yh5FURos9kuqPy2sTkrsJOWooS0nbmPdTIwRoXklq5OXpmqffffs/:z10nbkrY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • 1 (359).exe (PID: 7464)

    • Changes the autorun value in the registry

      • 1 (359).exe (PID: 7464)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 1 (359).exe (PID: 7464)

    • Starts itself from another location

      • 1 (359).exe (PID: 7464)

    • There is functionality for taking screenshot (YARA)

      • 1 (359).exe (PID: 7464)
      • optimdev.exe (PID: 7580)
      • adobeapp.exe (PID: 7600)

  • INFO

    • The sample compiled with english language support

      • 1 (359).exe (PID: 7464)

    • Reads the computer name

      • 1 (359).exe (PID: 7464)
      • optimdev.exe (PID: 7580)
      • adobeapp.exe (PID: 7600)
      • optimdev.exe (PID: 4172)

    • Checks supported languages

      • 1 (359).exe (PID: 7464)
      • optimdev.exe (PID: 7580)
      • adobeapp.exe (PID: 7600)
      • optimdev.exe (PID: 4172)

    • Creates files or folders in the user directory

      • 1 (359).exe (PID: 7464)

    • Autorun file from Startup directory

      • 1 (359).exe (PID: 7464)

    • Manual execution by a user

      • optimdev.exe (PID: 4172)

    • Compiled with Borland Delphi (YARA)

      • 1 (359).exe (PID: 7464)
      • optimdev.exe (PID: 7580)
      • adobeapp.exe (PID: 7600)

    • Reads the software policy settings

      • slui.exe (PID: 7692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.1)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 3.22
CodeSize: 1533024
InitializedDataSize: 118452
UninitializedDataSize: 38660
EntryPoint: 0x2ef0
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.5.0.0
ProductVersionNumber: 5.5.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileDescription: System Devices Optimizer
InternalName: Devices Optimus
ProductName: Devices Optimus
ProductVersion: 5.5.0.0
Comments: -
CompanyName: -
FileVersion: 5.5.0.0
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1 (359).exe optimdev.exe no specs adobeapp.exe no specs sppextcomobj.exe no specs slui.exe optimdev.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2504C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4172"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\optimdev.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\optimdev.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
System Devices Optimizer
Exit code:
0
Version:
5.5.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\optimdev.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7464"C:\Users\admin\AppData\Local\Temp\1 (359).exe" C:\Users\admin\AppData\Local\Temp\1 (359).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
System Devices Optimizer
Version:
5.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\1 (359).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7580"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\optimdev.exe"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\optimdev.exe—1 (359).exe
User:
admin
Integrity Level:
MEDIUM
Description:
System Devices Optimizer
Version:
5.5.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\optimdev.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7600C:\AdobeC\adobeapp.exeC:\AdobeC\adobeapp.exe—1 (359).exe
User:
admin
Integrity Level:
MEDIUM
Description:
System Devices Optimizer
Version:
5.5.0.0
Modules
Images
c:\adobec\adobeapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7652C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7692"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 887
Read events
1 885
Write events
2
Delete events
0

Modification events

(PID) Process:(7464) 1 (359).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Adobe Cabinet
Value:
C:\AdobeC\adobeapp.exe
(PID) Process:(7464) 1 (359).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:KABx64
Value:
C:\KABx64\systempx.exe
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
74641 (359).exeC:\AdobeC\adobeapp.exeexecutable
MD5:5FE6313CFF5324EFE3DC77177B88BE5A
SHA256:1E536C6F8CD3CF6B02E3C10A28546D29A4C8107C98FBADC0FA8F2E1150248DC8
74641 (359).exeC:\KABx64\systempx.exeexecutable
MD5:F44816FC27B6F63454D8A9E340DC981D
SHA256:6019A9D398623BBB64AB693179CFD33B6E6193D0AB770D96762BF3E1F53AC74C
74641 (359).exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\optimdev.exeexecutable
MD5:23E529ECE5210B3B8DF76D63845396E9
SHA256:A4C3923D48D464B65E9272194330DB5E84D72460D9B3BF4E989590A99A4076DB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
26
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.158:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
4040
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
7548
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
4040
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
unknown
5496
MoUsoCoreWorker.exe
23.48.23.158:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5404
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
unknown
google.com
  • 142.250.185.142
unknown
crl.microsoft.com
  • 23.48.23.158
  • 23.48.23.173
  • 23.48.23.141
  • 23.48.23.176
  • 23.48.23.180
  • 23.48.23.194
  • 23.48.23.193
  • 23.48.23.162
  • 23.48.23.169
unknown
client.wns.windows.com
  • 40.115.3.253
unknown
login.live.com
  • 20.190.159.75
  • 20.190.159.2
  • 40.126.31.1
  • 20.190.159.130
  • 20.190.159.129
  • 20.190.159.4
  • 40.126.31.2
  • 40.126.31.131
unknown
ocsp.digicert.com
  • 23.54.109.203
unknown
arc.msn.com
  • 20.223.36.55
unknown
slscr.update.microsoft.com
  • 4.175.87.197
unknown
www.microsoft.com
  • 184.30.21.171
unknown
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (359)