File name:

ORDER NAME MV MYNY IMO.exe

Full analysis: https://app.any.run/tasks/0ca8bbbb-59e3-45b1-aaf9-39457c2ac42f
Verdict: Malicious activity
Threats:

First identified in March 2021, PureCrypter is a .NET-based loader that employs obfuscation techniques, such as SmartAssembly, to evade detection. It has been used to distribute malware families including AgentTesla, RedLine Stealer, and SnakeKeylogger. The malware is typically delivered through phishing campaigns and malicious downloads, often masquerading as legitimate files with extensions like .mp4 or .pdf. PureCrypter utilizes encryption and compression to conceal its payloads and can inject malicious code into legitimate processes to maintain persistence on the infected system.

Malware Trends Tracker     >>>
Analysis date: March 23, 2025, 23:14:44
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
opendir
purecrypter
remote
xworm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

BA18F4E4A8A2B81DE4A47A93A02FC8B5

SHA1:

07893F128DF30F82811503FA567BAAE1751BBAC8

SHA256:

3BF9DF96547C080C337AC832DBB50F0BD779E3FE6C7CE7DB47A827AA74FC4764

SSDEEP:

96:qwl5DOl4Fny7u111111111111gbYpp2byj3t50sTbPRMk5SPzxtNW8Q3KzNt:X5qlgsbPy3nzek0Nu8gs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PURECRYPTER has been detected (YARA)

      • ORDER NAME MV MYNY IMO.exe (PID: 6540)

    • Create files in the Startup directory

      • ORDER NAME MV MYNY IMO.exe (PID: 6540)

    • XWORM has been detected (YARA)

      • ORDER NAME MV MYNY IMO.exe (PID: 7856)
      • SyncRoot.exe (PID: 8040)

    • XWORM has been detected (SURICATA)

      • ORDER NAME MV MYNY IMO.exe (PID: 7856)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ORDER NAME MV MYNY IMO.exe (PID: 6540)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7908)

    • Connects to unusual port

      • ORDER NAME MV MYNY IMO.exe (PID: 7856)

    • Contacting a server suspected of hosting an CnC

      • ORDER NAME MV MYNY IMO.exe (PID: 7856)

  • INFO

    • Reads the machine GUID from the registry

      • ORDER NAME MV MYNY IMO.exe (PID: 6540)
      • SyncRoot.exe (PID: 7960)
      • ORDER NAME MV MYNY IMO.exe (PID: 7856)
      • SyncRoot.exe (PID: 8040)

    • Disables trace logs

      • ORDER NAME MV MYNY IMO.exe (PID: 6540)
      • SyncRoot.exe (PID: 7960)

    • Reads the computer name

      • ORDER NAME MV MYNY IMO.exe (PID: 6540)
      • ORDER NAME MV MYNY IMO.exe (PID: 7856)
      • SyncRoot.exe (PID: 7960)
      • SyncRoot.exe (PID: 8040)

    • Checks supported languages

      • ORDER NAME MV MYNY IMO.exe (PID: 6540)
      • SyncRoot.exe (PID: 7960)
      • SyncRoot.exe (PID: 8040)
      • ORDER NAME MV MYNY IMO.exe (PID: 7856)

    • Checks proxy server information

      • ORDER NAME MV MYNY IMO.exe (PID: 6540)
      • BackgroundTransferHost.exe (PID: 8024)
      • SyncRoot.exe (PID: 7960)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 8024)
      • ORDER NAME MV MYNY IMO.exe (PID: 6540)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7816)
      • BackgroundTransferHost.exe (PID: 8124)
      • BackgroundTransferHost.exe (PID: 7452)
      • BackgroundTransferHost.exe (PID: 8024)
      • BackgroundTransferHost.exe (PID: 7728)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 8024)
      • slui.exe (PID: 6620)

    • Autorun file from Startup directory

      • ORDER NAME MV MYNY IMO.exe (PID: 6540)

    • Manual execution by a user

      • wscript.exe (PID: 7908)
      • SyncRoot.exe (PID: 8040)
      • ORDER NAME MV MYNY IMO.exe (PID: 7856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:23 21:17:34+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 4096
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x2f3e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Sbmmhtw ARJ
FileVersion: 1.0.0.0
InternalName: Sbmmhtw ARJ.exe
LegalCopyright: Copyright © 2021
LegalTrademarks: -
OriginalFileName: Sbmmhtw ARJ.exe
ProductName: Sbmmhtw ARJ
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
13
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #PURECRYPTER order name mv myny imo.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #XWORM order name mv myny imo.exe wscript.exe no specs syncroot.exe #XWORM syncroot.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4944C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6540"C:\Users\admin\AppData\Local\Temp\ORDER NAME MV MYNY IMO.exe" C:\Users\admin\AppData\Local\Temp\ORDER NAME MV MYNY IMO.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Sbmmhtw ARJ
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\order name mv myny imo.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6620"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7452"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7724C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7728"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7816"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7856"C:\Users\admin\AppData\Local\Temp\ORDER NAME MV MYNY IMO.exe"C:\Users\admin\AppData\Local\Temp\ORDER NAME MV MYNY IMO.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Sbmmhtw ARJ
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\order name mv myny imo.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7908"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncRoot.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7960"C:\Users\admin\AppData\Roaming\SyncRoot.exe" C:\Users\admin\AppData\Roaming\SyncRoot.exe
wscript.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Sbmmhtw ARJ
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\syncroot.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
4 891
Read events
4 848
Write events
43
Delete events
0

Modification events

(PID) Process:(6540) ORDER NAME MV MYNY IMO.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER NAME MV MYNY IMO_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6540) ORDER NAME MV MYNY IMO.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER NAME MV MYNY IMO_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6540) ORDER NAME MV MYNY IMO.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER NAME MV MYNY IMO_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6540) ORDER NAME MV MYNY IMO.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER NAME MV MYNY IMO_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6540) ORDER NAME MV MYNY IMO.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER NAME MV MYNY IMO_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6540) ORDER NAME MV MYNY IMO.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER NAME MV MYNY IMO_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6540) ORDER NAME MV MYNY IMO.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER NAME MV MYNY IMO_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6540) ORDER NAME MV MYNY IMO.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER NAME MV MYNY IMO_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6540) ORDER NAME MV MYNY IMO.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER NAME MV MYNY IMO_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6540) ORDER NAME MV MYNY IMO.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER NAME MV MYNY IMO_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
8024BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D —
MD5:—
SHA256:—
8024BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\092e88f5-7f5e-41d8-8c3e-a018aef74aad.down_data —
MD5:—
SHA256:—
8024BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\e1b937c5-796e-4d5e-a994-168c8fc64421.up_meta_securebinary
MD5:C24FFC1EB9F2EDB8F83D4A16B0A174DE
SHA256:5398BE42AA3EB6454E7571FFE9877B4EF13666F1F5E124E8163825AF6AFADCF1
8024BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:DFB7AED37783ABA55857FAC47E2DCCAB
SHA256:469B2DCF3B468F06BC50FEF1D5B50AF4A268AA9966F496E3A9A4B068495CFA77
8024BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\092e88f5-7f5e-41d8-8c3e-a018aef74aad.67f6f732-8feb-4f08-9aa2-a1b49fd1d782.down_metabinary
MD5:6A564E1112295F2F7153286606256735
SHA256:17F19445346D196FB0621C85850FE3C40C27AF9AE07630C67BC98B16566C3978
8024BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\e1b937c5-796e-4d5e-a994-168c8fc64421.67f6f732-8feb-4f08-9aa2-a1b49fd1d782.down_metabinary
MD5:6A564E1112295F2F7153286606256735
SHA256:17F19445346D196FB0621C85850FE3C40C27AF9AE07630C67BC98B16566C3978
6540ORDER NAME MV MYNY IMO.exeC:\Users\admin\AppData\Roaming\SyncRoot.exeexecutable
MD5:BA18F4E4A8A2B81DE4A47A93A02FC8B5
SHA256:3BF9DF96547C080C337AC832DBB50F0BD779E3FE6C7CE7DB47A827AA74FC4764
6540ORDER NAME MV MYNY IMO.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncRoot.vbstext
MD5:51FA879C7DDD38E6CA3BE6D6C6810573
SHA256:A81FC2091D7DE90FF46BC39B40463EFD3349CE27E218C8277EC09841CA7F5944
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
28
DNS requests
19
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6540
ORDER NAME MV MYNY IMO.exe
GET
200
185.253.218.211:80
http://hirosavva-cn.com/panel/uploads/Igxpjc.mp4
unknown
—
—
malicious
—
—
GET
200
2.22.242.90:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7192
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8024
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7960
SyncRoot.exe
GET
200
185.253.218.211:80
http://hirosavva-cn.com/panel/uploads/Igxpjc.mp4
unknown
—
—
malicious
8168
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8168
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.22.242.90:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6540
ORDER NAME MV MYNY IMO.exe
185.253.218.211:80
hirosavva-cn.com
NETH LLC
UA
malicious
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7192
backgroundTaskHost.exe
20.86.201.138:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7192
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.22.242.90
  • 2.22.242.121
whitelisted
hirosavva-cn.com
  • 185.253.218.211
unknown
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.66
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.140
  • 20.190.160.22
  • 40.126.32.136
  • 40.126.32.133
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.86.201.138
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
INFO [ANY.RUN] Dynamic DNS Service (ydns .eu)
7856
ORDER NAME MV MYNY IMO.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ORDER NAME MV MYNY IMO.exe