File name:

457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af

Full analysis: https://app.any.run/tasks/f08b1854-7a47-43c5-bb0e-9fbd9a4c3637
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: May 28, 2025, 19:00:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
floxif
backdoor
m0yv
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

7408965E3A5F6FFA0EAE6279AB61E8A8

SHA1:

9F2E59F4CAC2D6E32DA016D22FD786BEC84F9412

SHA256:

457378D4EE658FFC3A833CA502F9F74EFCD22684972E79E4F02307B24CE0F9AF

SSDEEP:

98304:7q+KlEpcWrV/i2zXKYUudnitJJupXnrUzf6DTmL5ve8XVmADtvbcpRXXQnXyIltc:mhk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • FlashPlayerUpdateService.exe (PID: 7888)
      • alg.exe (PID: 456)
      • AppVClient.exe (PID: 8156)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 7292)
      • FXSSVC.exe (PID: 1600)
      • elevation_service.exe (PID: 8044)
      • elevation_service.exe (PID: 2560)
      • maintenanceservice.exe (PID: 7696)
      • msdtc.exe (PID: 3008)
      • PSEXESVC.exe (PID: 6676)
      • PerceptionSimulationService.exe (PID: 7804)
      • Locator.exe (PID: 4180)
      • SensorDataService.exe (PID: 5020)
      • snmptrap.exe (PID: 3968)
      • Spectrum.exe (PID: 4728)
      • TieringEngineService.exe (PID: 2192)
      • ssh-agent.exe (PID: 5376)
      • AgentService.exe (PID: 4376)
      • VSSVC.exe (PID: 4740)
      • vds.exe (PID: 7144)
      • wbengine.exe (PID: 8088)
      • WmiApSrv.exe (PID: 7012)
      • SearchIndexer.exe (PID: 5204)

    • FLOXIF mutex has been found

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)

    • M0YV has been detected (YARA)

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • alg.exe (PID: 456)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 7292)
      • armsvc.exe (PID: 1324)
      • elevation_service.exe (PID: 8044)
      • GoogleUpdate.exe (PID: 7184)
      • MicrosoftEdgeUpdate.exe (PID: 2320)
      • GameInputSvc.exe (PID: 7668)
      • GameInputSvc.exe (PID: 7272)
      • MicrosoftEdgeUpdate.exe (PID: 728)
      • elevation_service.exe (PID: 2560)
      • GoogleUpdate.exe (PID: 8148)
      • msdtc.exe (PID: 3008)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • MicrosoftEdge_X64_136.0.3240.92.exe (PID: 5960)
      • setup.exe (PID: 6876)
      • MicrosoftEdgeUpdate.exe (PID: 5484)
      • MicrosoftEdgeUpdateSetup_X86_1.3.195.61.exe (PID: 1504)
      • MicrosoftEdgeUpdate.exe (PID: 6216)

    • There is functionality for taking screenshot (YARA)

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • GoogleUpdate.exe (PID: 7184)
      • GoogleUpdate.exe (PID: 8148)

    • Executable content was dropped or overwritten

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • svchost.exe (PID: 720)
      • GoogleUpdate.exe (PID: 4608)
      • MicrosoftEdge_X64_136.0.3240.92.exe (PID: 5960)
      • updater.exe (PID: 7692)
      • alg.exe (PID: 456)
      • updater.exe (PID: 3012)
      • setup.exe (PID: 6876)
      • 136.0.7103.116_chrome_installer.exe (PID: 5944)
      • MicrosoftEdgeUpdateSetup_X86_1.3.195.61.exe (PID: 1504)
      • setup.exe (PID: 3748)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 7292)

    • Reads security settings of Internet Explorer

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)

    • Application launched itself

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • MicrosoftEdgeUpdate.exe (PID: 7260)
      • GameInputSvc.exe (PID: 7668)
      • MicrosoftEdgeUpdate.exe (PID: 2320)
      • GoogleUpdate.exe (PID: 8032)
      • GoogleUpdate.exe (PID: 7184)
      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • GoogleUpdate.exe (PID: 4608)
      • setup.exe (PID: 6876)
      • updater.exe (PID: 7692)
      • updater.exe (PID: 3180)
      • updater.exe (PID: 7508)
      • updater.exe (PID: 3012)
      • updater.exe (PID: 2432)
      • MicrosoftEdgeUpdate.exe (PID: 5484)
      • setup.exe (PID: 3748)
      • setup.exe (PID: 6392)
      • setup.exe (PID: 5308)

    • Executes as Windows Service

      • FlashPlayerUpdateService.exe (PID: 7888)
      • armsvc.exe (PID: 1324)
      • alg.exe (PID: 456)
      • AppVClient.exe (PID: 8156)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 7292)
      • MicrosoftEdgeUpdate.exe (PID: 7260)
      • FXSSVC.exe (PID: 1600)
      • GameInputSvc.exe (PID: 7668)
      • GoogleUpdate.exe (PID: 8032)
      • maintenanceservice.exe (PID: 7696)
      • msdtc.exe (PID: 3008)
      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • PerceptionSimulationService.exe (PID: 7804)
      • Locator.exe (PID: 4180)
      • PSEXESVC.exe (PID: 6676)
      • perfhost.exe (PID: 7268)
      • snmptrap.exe (PID: 3968)
      • SensorDataService.exe (PID: 5020)
      • Spectrum.exe (PID: 4728)
      • ssh-agent.exe (PID: 5376)
      • TieringEngineService.exe (PID: 2192)
      • AgentService.exe (PID: 4376)
      • vds.exe (PID: 7144)
      • VSSVC.exe (PID: 4740)
      • WmiApSrv.exe (PID: 7012)
      • wbengine.exe (PID: 8088)
      • GoogleUpdate.exe (PID: 4608)
      • updater.exe (PID: 7508)
      • updater.exe (PID: 3012)
      • updater.exe (PID: 2432)
      • MicrosoftEdgeUpdate.exe (PID: 5484)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6248)
      • MicrosoftEdgeUpdate.exe (PID: 2136)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5228)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7448)

    • Process requests binary or script from the Internet

      • svchost.exe (PID: 720)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 720)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 6216)

  • INFO

    • The sample compiled with english language support

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • svchost.exe (PID: 720)
      • GoogleUpdate.exe (PID: 4608)
      • updater.exe (PID: 7692)
      • MicrosoftEdge_X64_136.0.3240.92.exe (PID: 5960)
      • alg.exe (PID: 456)
      • updater.exe (PID: 3012)
      • setup.exe (PID: 6876)
      • MicrosoftEdgeUpdateSetup_X86_1.3.195.61.exe (PID: 1504)
      • MicrosoftEdgeUpdate.exe (PID: 5484)
      • 136.0.7103.116_chrome_installer.exe (PID: 5944)
      • setup.exe (PID: 3748)
      • MicrosoftEdgeUpdate.exe (PID: 6216)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 7292)

    • Reads the computer name

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • armsvc.exe (PID: 1324)
      • FlashPlayerUpdateService.exe (PID: 7888)
      • MicrosoftEdgeUpdate.exe (PID: 2320)
      • MicrosoftEdgeUpdate.exe (PID: 2136)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6248)
      • elevation_service.exe (PID: 8044)
      • MicrosoftEdgeUpdate.exe (PID: 7260)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7448)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5228)
      • GoogleUpdate.exe (PID: 8032)
      • MicrosoftEdgeUpdate.exe (PID: 728)
      • GoogleUpdate.exe (PID: 7184)
      • elevation_service.exe (PID: 2560)
      • GoogleCrashHandler.exe (PID: 7468)
      • GoogleCrashHandler64.exe (PID: 7348)
      • maintenanceservice.exe (PID: 7696)
      • GoogleUpdate.exe (PID: 8148)
      • GoogleUpdate.exe (PID: 6960)
      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • PSEXESVC.exe (PID: 6676)
      • MicrosoftEdgeUpdate.exe (PID: 1312)
      • ssh-agent.exe (PID: 5376)

    • Checks supported languages

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • armsvc.exe (PID: 1324)
      • FlashPlayerUpdateService.exe (PID: 7888)
      • MicrosoftEdgeUpdate.exe (PID: 2320)
      • MicrosoftEdgeUpdate.exe (PID: 2136)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6248)
      • elevation_service.exe (PID: 8044)
      • MicrosoftEdgeUpdate.exe (PID: 7260)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7448)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5228)
      • GoogleUpdate.exe (PID: 8032)
      • MicrosoftEdgeUpdate.exe (PID: 728)
      • GoogleUpdate.exe (PID: 7184)
      • elevation_service.exe (PID: 2560)
      • GoogleCrashHandler.exe (PID: 7468)
      • GoogleCrashHandler64.exe (PID: 7348)
      • maintenanceservice.exe (PID: 7696)
      • GoogleUpdate.exe (PID: 8148)
      • PSEXESVC.exe (PID: 6676)
      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • GoogleUpdate.exe (PID: 6960)
      • MicrosoftEdgeUpdate.exe (PID: 1312)
      • ssh-agent.exe (PID: 5376)

    • Creates files or folders in the user directory

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • GoogleUpdate.exe (PID: 6960)

    • Checks proxy server information

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)

    • Create files in a temporary directory

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)

    • Process checks computer location settings

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)

    • Reads the software policy settings

      • slui.exe (PID: 1912)
      • GameInputSvc.exe (PID: 7272)
      • GoogleUpdate.exe (PID: 6960)
      • MicrosoftEdgeUpdate.exe (PID: 1312)
      • MicrosoftEdgeUpdate.exe (PID: 6040)

    • Creates files in the program directory

      • FXSSVC.exe (PID: 1600)
      • GoogleUpdate.exe (PID: 8032)
      • GoogleUpdate.exe (PID: 7184)
      • GoogleUpdate.exe (PID: 8148)
      • GoogleUpdate.exe (PID: 6960)
      • maintenanceservice.exe (PID: 7696)
      • SearchIndexer.exe (PID: 5204)

    • Executes as Windows Service

      • elevation_service.exe (PID: 8044)
      • elevation_service.exe (PID: 2560)
      • SearchIndexer.exe (PID: 5204)

    • Checks transactions between databases Windows and Oracle

      • msdtc.exe (PID: 3008)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 1312)

    • Reads the time zone

      • TieringEngineService.exe (PID: 2192)

    • The sample compiled with bulgarian language support

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:17 04:28:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 3651584
InitializedDataSize: 861184
UninitializedDataSize: -
EntryPoint: 0x36ef94
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.5.0.1383
ProductVersionNumber: 1.5.0.1383
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: voidtools
FileDescription: Everything
FileVersion: 1.5.0.1383a
InternalName: Everything
LegalCopyright: Copyright © 2024 voidtools
OriginalFileName: Everything.exe
ProductName: Everything
ProductVersion: 1.5.0.1383a
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
219
Monitored processes
87
Malicious processes
38
Suspicious processes
5

Behavior graph

Click at the process to see the details
start #FLOXIF 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe svchost.exe sppextcomobj.exe no specs slui.exe #M0YV 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe slui.exe #M0YV armsvc.exe no specs #M0YV flashplayerupdateservice.exe no specs #M0YV alg.exe #M0YV appvclient.exe no specs #M0YV diagnosticshub.standardcollector.service.exe microsoftedgeupdate.exe no specs #M0YV microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs #M0YV fxssvc.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV gameinputsvc.exe no specs #M0YV gameinputsvc.exe no specs #M0YV elevation_service.exe no specs microsoftedgeupdatecomregistershell64.exe no specs googleupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV microsoftedgeupdate.exe no specs #M0YV googleupdate.exe no specs #M0YV elevation_service.exe no specs googleupdate.exe googlecrashhandler.exe no specs googlecrashhandler64.exe no specs #M0YV googleupdate.exe no specs #M0YV maintenanceservice.exe no specs #M0YV msdtc.exe no specs microsoftedgeupdate.exe #M0YV perceptionsimulationservice.exe no specs perfhost.exe no specs #M0YV psexesvc.exe no specs #M0YV locator.exe no specs microsoftedgeupdate.exe #M0YV sensordataservice.exe no specs #M0YV snmptrap.exe no specs #M0YV spectrum.exe no specs #M0YV ssh-agent.exe no specs #M0YV tieringengineservice.exe no specs #M0YV agentservice.exe no specs Delivery Optimization User no specs #M0YV vds.exe no specs #M0YV vssvc.exe no specs #M0YV wbengine.exe no specs #M0YV wmiapsrv.exe no specs #M0YV searchindexer.exe no specs googleupdate.exe searchprotocolhost.exe no specs searchfilterhost.exe no specs svchost.exe updatersetup.exe no specs googleupdate.exe updater.exe updater.exe no specs microsoftedge_x64_136.0.3240.92.exe setup.exe setup.exe no specs updater.exe no specs updater.exe no specs updater.exe no specs updater.exe no specs updater.exe updater.exe no specs updater.exe updater.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe 136.0.7103.116_chrome_installer.exe microsoftedgeupdatesetup_x86_1.3.195.61.exe microsoftedgeupdate.exe setup.exe setup.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs searchfilterhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=138.0.7194.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x140609ff8,0x14060a004,0x14060a010C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater (x64)
Exit code:
0
Version:
138.0.7194.0
Modules
Images
c:\program files (x86)\google\googleupdater\138.0.7194.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
456C:\WINDOWS\System32\alg.exeC:\Windows\System32\alg.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Application Layer Gateway Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\alg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
720C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITSC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
728"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource coreC:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.147.37
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1012"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.61\MicrosoftEdgeUpdateComRegisterShell64.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.61\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.61
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.195.61\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1244C:\WINDOWS\SystemTemp\chrome_Unpacker_BeginUnzipping2432_1050923089\CR_E97BF.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=136.0.7103.116 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff7353ea3a0,0x7ff7353ea3ac,0x7ff7353ea3b8C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2432_1050923089\CR_E97BF.tmp\setup.exe—setup.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Chrome Installer
Exit code:
0
Version:
136.0.7103.116
Modules
Images
c:\windows\systemtemp\chrome_unpacker_beginunzipping2432_1050923089\cr_e97bf.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1312"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4xNDcuMzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0Y5RDE3MEQtNDg0NC00MTY4LTk1Q0MtNzE1MDJERDI5NTlGfSIgdXNlcmlkPSJ7RkQ5ODQ3MzktQTEyMi00REIwLUJFNUItNDZFM0UwOUQ4NEU0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QzAyNDI2ODItQjI4Mi00N0MwLUFENTktQzQwNjMzNDQ4NkZCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjQiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS40MDQ2IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRFTEwiIHByb2R1Y3RfbmFtZT0iREVMTCIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIyLjAuNjI2MS43MCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0NFQiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjE0MTIiIGluc3RhbGxkYXRlPSI2MjY1IiBpbnN0YWxsZGF0ZXRpbWU9IjE2MjY0NDE1MTYiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzMwNTg0MTM4NDU1MjgyNjUiIGZpcnN0X2ZyZV9zZWVuX3RpbWU9IjEzMzA1ODI1NDkyOTk3MjAxMCIgZmlyc3RfZnJlX3NlZW5fdmVyc2lvbj0iMTA0LjAuMTI5My42MyI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjEwNjU0OTAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMDk0MzI4MTI1Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.147.37
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1324"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
services.exe
User:
SYSTEM
Company:
Adobe Inc.
Integrity Level:
SYSTEM
Description:
Acrobat Update Service
Version:
1.824.460.1042
Modules
Images
c:\program files (x86)\common files\adobe\arm\1.0\armsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1504"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{178CE844-4333-4832-86EA-6C5C52EA77A3}\MicrosoftEdgeUpdateSetup_X86_1.3.195.61.exe" /update /sessionid "{E270AE21-70F8-4466-A93A-2807D183A083}"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{178CE844-4333-4832-86EA-6C5C52EA77A3}\MicrosoftEdgeUpdateSetup_X86_1.3.195.61.exe
MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.195.61
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\install\{178ce844-4333-4832-86ea-6c5c52ea77a3}\microsoftedgeupdatesetup_x86_1.3.195.61.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1512"C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=138.0.7194.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2bc,0x2c0,0x2c4,0x2b8,0x2c8,0x140609ff8,0x14060a004,0x14060a010C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater (x64)
Exit code:
0
Version:
138.0.7194.0
Modules
Images
c:\program files (x86)\google\googleupdater\138.0.7194.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
Total events
42 312
Read events
35 483
Write events
6 606
Delete events
223

Modification events

(PID) Process:(7608) 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
114
(PID) Process:(7608) 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
405D376800000000
(PID) Process:(1324) armsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Adobe\Adobe ARM\1.0\ARM
Operation:writeName:iLastSvcSuccess
Value:
1238734
(PID) Process:(7260) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers
Operation:writeName:omaha_version
Value:
1100B90003000100
(PID) Process:(7260) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Booleans
Operation:writeName:is_system_install
Value:
01000000
(PID) Process:(7260) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts
Operation:writeName:goopdate_main
Value:
1500000000000000
(PID) Process:(7260) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts
Operation:writeName:goopdate_constructor
Value:
1500000000000000
(PID) Process:(7260) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers
Operation:writeName:windows_major_version
Value:
0A00000000000000
(PID) Process:(1600) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:Server
Value:
(PID) Process:(1600) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:From
Value:
Executable files
369
Suspicious files
37
Text files
16
Unknown types
6

Dropped files

PID
Process
Filename
Type
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Users\admin\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:F706E1DF1E16D824C6C9C18A19581885
SHA256:3B8C75C34EF84006C3C2A8F80D998C12BD74327788E14118611C8E9A3FB92819
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exeexecutable
MD5:3B1333AE9A3047016A9E035FB1769130
SHA256:D47FEEDB5A0035D0382A051E5AAA26181F6E7FBC7BEB85086D13A4C118026245
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exeexecutable
MD5:FF129B3BD00DABE4CDB2BA7D078D636A
SHA256:21FDF22046784CA2CCD6FDD551090BE46AEDB559B296F2648041A186B889778F
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exeexecutable
MD5:082C959FEB267C2BEEC1045CF4885A57
SHA256:0CBF36ED612EB8C7E0FE38A213EFE7F7A86D80DA928840770A4CB3FCF5B57528
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeexecutable
MD5:5F85F97C725A7B9178571F692E7D709D
SHA256:BCCF9C5167CD58725A25AB4A46C8BB68D4D9D1ABE76F491468C7E9232EA51D71
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exeexecutable
MD5:38B7C69B2485AC3104A3761A95601887
SHA256:031E24D6AC54C25FC75AE32CB1E6170362CB602EE5A3713B11C3A36C78D2036C
6700457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Windows\System32\FXSSVC.exeexecutable
MD5:E3FCD685D94E34636C1C40D16106FB87
SHA256:A308692BC440904ABBC7A36D0CAD945AC3048F575D59968B9C6B6654EF9CE97F
6700457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeexecutable
MD5:9E775A3D0C4B0CB849E1669B2C0796CE
SHA256:0DB264DC9A80212E6FB439B47E96799BE42823A7577865707E2E412F0A68D13D
6700457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Windows\System32\AppVClient.exeexecutable
MD5:DFE778227F6CCCD9818003A92754212A
SHA256:9CB357D87CD487E0D715C3A1B2B5B048AF6C43E1CA1F1333DE97F07864B21666
6700457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Windows\System32\GameInputSvc.exeexecutable
MD5:F5A6593AC3F3C6335756B20BE533CE06
SHA256:BA54010950BCEBBFD489CD7FA5D66A2701F501E0C2F754DDB6494BCD6ABEA0F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
677
TCP/UDP connections
124
DNS requests
111
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
456
alg.exe
POST
200
18.234.103.197:80
http://knjghuig.biz/d
unknown
—
—
malicious
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
52.11.240.239:80
http://pywolwnvd.biz/du
unknown
—
—
malicious
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
52.11.240.239:80
http://cvgrf.biz/cycwnxsllmkyhlw
unknown
—
—
malicious
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
3.229.117.57:80
http://npukfztj.biz/sfgpgvjejmle
unknown
—
—
malicious
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
172.233.219.123:80
http://przvgke.biz/ihvijbdlfwl
unknown
—
—
unknown
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
172.233.219.123:80
http://przvgke.biz/uuhjqbonyujhv
unknown
—
—
unknown
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
18.234.103.197:80
http://ssbzmoy.biz/belbvrqhhvxwsma
unknown
—
—
unknown
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
302
192.64.119.165:80
http://anpmnmxo.biz/rjwswdfyl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7804
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
52.11.240.239:80
pywolwnvd.biz
AMAZON-02
US
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
18.234.103.197:80
ssbzmoy.biz
AMAZON-AES
US
malicious
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
3.229.117.57:80
npukfztj.biz
AMAZON-AES
US
malicious
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
172.233.219.123:80
przvgke.biz
Akamai International B.V.
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.153
  • 23.48.23.135
  • 23.48.23.132
  • 23.48.23.142
  • 23.48.23.151
  • 23.48.23.157
  • 23.48.23.146
  • 23.48.23.139
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
pywolwnvd.biz
  • 52.11.240.239
malicious
ssbzmoy.biz
  • 18.234.103.197
unknown
cvgrf.biz
  • 52.11.240.239
malicious
npukfztj.biz
  • 3.229.117.57
malicious
przvgke.biz
  • 172.233.219.123
  • 172.233.219.49
  • 172.233.219.78
unknown
zlenh.biz
  • —
unknown
knjghuig.biz
  • 18.234.103.197
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
Misc activity
ET INFO Namecheap URL Forward
2196
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)
456
alg.exe
Misc activity
ET INFO Namecheap URL Forward
720
svchost.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
720
svchost.exe
Misc activity
ET INFO EXE - Served Attached HTTP
6036
svchost.exe
Misc activity
ET INFO Packed Executable Download
Process
Message
MicrosoftEdgeUpdate.exe
LOG_SYSTEM: [MicrosoftEdgeUpdate:msedgeupdate]: Could not acquire logging mutex _Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af