File name:

457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af

Full analysis: https://app.any.run/tasks/f08b1854-7a47-43c5-bb0e-9fbd9a4c3637
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: May 28, 2025, 19:00:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
floxif
backdoor
m0yv
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

7408965E3A5F6FFA0EAE6279AB61E8A8

SHA1:

9F2E59F4CAC2D6E32DA016D22FD786BEC84F9412

SHA256:

457378D4EE658FFC3A833CA502F9F74EFCD22684972E79E4F02307B24CE0F9AF

SSDEEP:

98304:7q+KlEpcWrV/i2zXKYUudnitJJupXnrUzf6DTmL5ve8XVmADtvbcpRXXQnXyIltc:mhk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • FlashPlayerUpdateService.exe (PID: 7888)
      • alg.exe (PID: 456)
      • AppVClient.exe (PID: 8156)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 7292)
      • FXSSVC.exe (PID: 1600)
      • elevation_service.exe (PID: 8044)
      • elevation_service.exe (PID: 2560)
      • maintenanceservice.exe (PID: 7696)
      • msdtc.exe (PID: 3008)
      • Locator.exe (PID: 4180)
      • PerceptionSimulationService.exe (PID: 7804)
      • PSEXESVC.exe (PID: 6676)
      • SensorDataService.exe (PID: 5020)
      • snmptrap.exe (PID: 3968)
      • Spectrum.exe (PID: 4728)
      • ssh-agent.exe (PID: 5376)
      • AgentService.exe (PID: 4376)
      • TieringEngineService.exe (PID: 2192)
      • vds.exe (PID: 7144)
      • VSSVC.exe (PID: 4740)
      • wbengine.exe (PID: 8088)
      • WmiApSrv.exe (PID: 7012)
      • SearchIndexer.exe (PID: 5204)

    • FLOXIF mutex has been found

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)

    • M0YV has been detected (YARA)

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • alg.exe (PID: 456)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 7292)
      • armsvc.exe (PID: 1324)
      • GameInputSvc.exe (PID: 7668)
      • MicrosoftEdgeUpdate.exe (PID: 2320)
      • GameInputSvc.exe (PID: 7272)
      • elevation_service.exe (PID: 8044)
      • MicrosoftEdgeUpdate.exe (PID: 728)
      • GoogleUpdate.exe (PID: 7184)
      • elevation_service.exe (PID: 2560)
      • GoogleUpdate.exe (PID: 8148)
      • msdtc.exe (PID: 3008)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • MicrosoftEdge_X64_136.0.3240.92.exe (PID: 5960)
      • setup.exe (PID: 6876)
      • MicrosoftEdgeUpdate.exe (PID: 5484)
      • MicrosoftEdgeUpdateSetup_X86_1.3.195.61.exe (PID: 1504)
      • MicrosoftEdgeUpdate.exe (PID: 6216)

    • There is functionality for taking screenshot (YARA)

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • GoogleUpdate.exe (PID: 7184)
      • GoogleUpdate.exe (PID: 8148)

    • Executable content was dropped or overwritten

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • svchost.exe (PID: 720)
      • GoogleUpdate.exe (PID: 4608)
      • updater.exe (PID: 7692)
      • alg.exe (PID: 456)
      • MicrosoftEdge_X64_136.0.3240.92.exe (PID: 5960)
      • updater.exe (PID: 3012)
      • setup.exe (PID: 6876)
      • 136.0.7103.116_chrome_installer.exe (PID: 5944)
      • MicrosoftEdgeUpdateSetup_X86_1.3.195.61.exe (PID: 1504)
      • setup.exe (PID: 3748)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 7292)

    • Application launched itself

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • GameInputSvc.exe (PID: 7668)
      • MicrosoftEdgeUpdate.exe (PID: 7260)
      • MicrosoftEdgeUpdate.exe (PID: 2320)
      • GoogleUpdate.exe (PID: 8032)
      • GoogleUpdate.exe (PID: 7184)
      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • GoogleUpdate.exe (PID: 4608)
      • updater.exe (PID: 7692)
      • setup.exe (PID: 6876)
      • updater.exe (PID: 7508)
      • updater.exe (PID: 3180)
      • updater.exe (PID: 3012)
      • updater.exe (PID: 2432)
      • MicrosoftEdgeUpdate.exe (PID: 5484)
      • setup.exe (PID: 3748)
      • setup.exe (PID: 5308)
      • setup.exe (PID: 6392)

    • Reads security settings of Internet Explorer

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)

    • Executes as Windows Service

      • armsvc.exe (PID: 1324)
      • FlashPlayerUpdateService.exe (PID: 7888)
      • alg.exe (PID: 456)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 7292)
      • AppVClient.exe (PID: 8156)
      • MicrosoftEdgeUpdate.exe (PID: 7260)
      • FXSSVC.exe (PID: 1600)
      • GameInputSvc.exe (PID: 7668)
      • GoogleUpdate.exe (PID: 8032)
      • maintenanceservice.exe (PID: 7696)
      • msdtc.exe (PID: 3008)
      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • PerceptionSimulationService.exe (PID: 7804)
      • PSEXESVC.exe (PID: 6676)
      • perfhost.exe (PID: 7268)
      • Locator.exe (PID: 4180)
      • SensorDataService.exe (PID: 5020)
      • snmptrap.exe (PID: 3968)
      • Spectrum.exe (PID: 4728)
      • ssh-agent.exe (PID: 5376)
      • TieringEngineService.exe (PID: 2192)
      • AgentService.exe (PID: 4376)
      • VSSVC.exe (PID: 4740)
      • vds.exe (PID: 7144)
      • wbengine.exe (PID: 8088)
      • WmiApSrv.exe (PID: 7012)
      • GoogleUpdate.exe (PID: 4608)
      • updater.exe (PID: 7508)
      • updater.exe (PID: 3012)
      • updater.exe (PID: 2432)
      • MicrosoftEdgeUpdate.exe (PID: 5484)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 2136)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6248)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7448)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5228)

    • Process requests binary or script from the Internet

      • svchost.exe (PID: 720)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 720)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 6216)

  • INFO

    • Checks supported languages

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • armsvc.exe (PID: 1324)
      • FlashPlayerUpdateService.exe (PID: 7888)
      • MicrosoftEdgeUpdate.exe (PID: 2320)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6248)
      • MicrosoftEdgeUpdate.exe (PID: 2136)
      • elevation_service.exe (PID: 8044)
      • MicrosoftEdgeUpdate.exe (PID: 7260)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7448)
      • GoogleUpdate.exe (PID: 8032)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5228)
      • MicrosoftEdgeUpdate.exe (PID: 728)
      • GoogleUpdate.exe (PID: 7184)
      • GoogleCrashHandler.exe (PID: 7468)
      • GoogleCrashHandler64.exe (PID: 7348)
      • maintenanceservice.exe (PID: 7696)
      • GoogleUpdate.exe (PID: 8148)
      • elevation_service.exe (PID: 2560)
      • PSEXESVC.exe (PID: 6676)
      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • MicrosoftEdgeUpdate.exe (PID: 1312)
      • GoogleUpdate.exe (PID: 6960)
      • ssh-agent.exe (PID: 5376)

    • The sample compiled with english language support

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • svchost.exe (PID: 720)
      • GoogleUpdate.exe (PID: 4608)
      • updater.exe (PID: 7692)
      • alg.exe (PID: 456)
      • MicrosoftEdge_X64_136.0.3240.92.exe (PID: 5960)
      • updater.exe (PID: 3012)
      • setup.exe (PID: 6876)
      • MicrosoftEdgeUpdate.exe (PID: 5484)
      • 136.0.7103.116_chrome_installer.exe (PID: 5944)
      • MicrosoftEdgeUpdateSetup_X86_1.3.195.61.exe (PID: 1504)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 7292)
      • MicrosoftEdgeUpdate.exe (PID: 6216)
      • setup.exe (PID: 3748)

    • Creates files or folders in the user directory

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • GoogleUpdate.exe (PID: 6960)

    • Reads the computer name

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)
      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
      • FlashPlayerUpdateService.exe (PID: 7888)
      • armsvc.exe (PID: 1324)
      • MicrosoftEdgeUpdate.exe (PID: 2320)
      • MicrosoftEdgeUpdate.exe (PID: 7260)
      • MicrosoftEdgeUpdate.exe (PID: 2136)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6248)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7448)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5228)
      • GoogleUpdate.exe (PID: 8032)
      • MicrosoftEdgeUpdate.exe (PID: 728)
      • GoogleUpdate.exe (PID: 7184)
      • elevation_service.exe (PID: 8044)
      • elevation_service.exe (PID: 2560)
      • GoogleUpdate.exe (PID: 6960)
      • GoogleCrashHandler64.exe (PID: 7348)
      • maintenanceservice.exe (PID: 7696)
      • GoogleUpdate.exe (PID: 8148)
      • GoogleCrashHandler.exe (PID: 7468)
      • MicrosoftEdgeUpdate.exe (PID: 6040)
      • PSEXESVC.exe (PID: 6676)
      • MicrosoftEdgeUpdate.exe (PID: 1312)
      • ssh-agent.exe (PID: 5376)

    • Checks proxy server information

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)

    • Create files in a temporary directory

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)

    • Process checks computer location settings

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 7608)

    • Reads the software policy settings

      • slui.exe (PID: 1912)
      • GameInputSvc.exe (PID: 7272)
      • GoogleUpdate.exe (PID: 6960)
      • MicrosoftEdgeUpdate.exe (PID: 1312)
      • MicrosoftEdgeUpdate.exe (PID: 6040)

    • Creates files in the program directory

      • FXSSVC.exe (PID: 1600)
      • GoogleUpdate.exe (PID: 8032)
      • maintenanceservice.exe (PID: 7696)
      • GoogleUpdate.exe (PID: 6960)
      • GoogleUpdate.exe (PID: 7184)
      • GoogleUpdate.exe (PID: 8148)
      • SearchIndexer.exe (PID: 5204)

    • Executes as Windows Service

      • elevation_service.exe (PID: 8044)
      • elevation_service.exe (PID: 2560)
      • SearchIndexer.exe (PID: 5204)

    • Checks transactions between databases Windows and Oracle

      • msdtc.exe (PID: 3008)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 1312)

    • Reads the time zone

      • TieringEngineService.exe (PID: 2192)

    • The sample compiled with bulgarian language support

      • 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe (PID: 6700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:17 04:28:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 3651584
InitializedDataSize: 861184
UninitializedDataSize: -
EntryPoint: 0x36ef94
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.5.0.1383
ProductVersionNumber: 1.5.0.1383
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: voidtools
FileDescription: Everything
FileVersion: 1.5.0.1383a
InternalName: Everything
LegalCopyright: Copyright © 2024 voidtools
OriginalFileName: Everything.exe
ProductName: Everything
ProductVersion: 1.5.0.1383a
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
219
Monitored processes
87
Malicious processes
38
Suspicious processes
5

Behavior graph

Click at the process to see the details
start #FLOXIF 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe svchost.exe sppextcomobj.exe no specs slui.exe #M0YV 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe slui.exe #M0YV armsvc.exe no specs #M0YV flashplayerupdateservice.exe no specs #M0YV alg.exe #M0YV appvclient.exe no specs #M0YV diagnosticshub.standardcollector.service.exe microsoftedgeupdate.exe no specs #M0YV microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs #M0YV fxssvc.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV gameinputsvc.exe no specs #M0YV gameinputsvc.exe no specs #M0YV elevation_service.exe no specs microsoftedgeupdatecomregistershell64.exe no specs googleupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV microsoftedgeupdate.exe no specs #M0YV googleupdate.exe no specs #M0YV elevation_service.exe no specs googleupdate.exe googlecrashhandler.exe no specs googlecrashhandler64.exe no specs #M0YV googleupdate.exe no specs #M0YV maintenanceservice.exe no specs #M0YV msdtc.exe no specs microsoftedgeupdate.exe #M0YV perceptionsimulationservice.exe no specs perfhost.exe no specs #M0YV psexesvc.exe no specs #M0YV locator.exe no specs microsoftedgeupdate.exe #M0YV sensordataservice.exe no specs #M0YV snmptrap.exe no specs #M0YV spectrum.exe no specs #M0YV ssh-agent.exe no specs #M0YV tieringengineservice.exe no specs #M0YV agentservice.exe no specs Delivery Optimization User no specs #M0YV vds.exe no specs #M0YV vssvc.exe no specs #M0YV wbengine.exe no specs #M0YV wmiapsrv.exe no specs #M0YV searchindexer.exe no specs googleupdate.exe searchprotocolhost.exe no specs searchfilterhost.exe no specs svchost.exe updatersetup.exe no specs googleupdate.exe updater.exe updater.exe no specs microsoftedge_x64_136.0.3240.92.exe setup.exe setup.exe no specs updater.exe no specs updater.exe no specs updater.exe no specs updater.exe no specs updater.exe updater.exe no specs updater.exe updater.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe 136.0.7103.116_chrome_installer.exe microsoftedgeupdatesetup_x86_1.3.195.61.exe microsoftedgeupdate.exe setup.exe setup.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs searchfilterhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=138.0.7194.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x140609ff8,0x14060a004,0x14060a010C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater (x64)
Exit code:
0
Version:
138.0.7194.0
Modules
Images
c:\program files (x86)\google\googleupdater\138.0.7194.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
456C:\WINDOWS\System32\alg.exeC:\Windows\System32\alg.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Application Layer Gateway Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\alg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
720C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITSC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
728"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource coreC:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.147.37
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1012"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.61\MicrosoftEdgeUpdateComRegisterShell64.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.61\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.61
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.195.61\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1244C:\WINDOWS\SystemTemp\chrome_Unpacker_BeginUnzipping2432_1050923089\CR_E97BF.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=136.0.7103.116 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff7353ea3a0,0x7ff7353ea3ac,0x7ff7353ea3b8C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2432_1050923089\CR_E97BF.tmp\setup.exe—setup.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Chrome Installer
Exit code:
0
Version:
136.0.7103.116
Modules
Images
c:\windows\systemtemp\chrome_unpacker_beginunzipping2432_1050923089\cr_e97bf.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1312"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4xNDcuMzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0Y5RDE3MEQtNDg0NC00MTY4LTk1Q0MtNzE1MDJERDI5NTlGfSIgdXNlcmlkPSJ7RkQ5ODQ3MzktQTEyMi00REIwLUJFNUItNDZFM0UwOUQ4NEU0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QzAyNDI2ODItQjI4Mi00N0MwLUFENTktQzQwNjMzNDQ4NkZCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjQiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS40MDQ2IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRFTEwiIHByb2R1Y3RfbmFtZT0iREVMTCIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIyLjAuNjI2MS43MCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0NFQiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjE0MTIiIGluc3RhbGxkYXRlPSI2MjY1IiBpbnN0YWxsZGF0ZXRpbWU9IjE2MjY0NDE1MTYiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzMwNTg0MTM4NDU1MjgyNjUiIGZpcnN0X2ZyZV9zZWVuX3RpbWU9IjEzMzA1ODI1NDkyOTk3MjAxMCIgZmlyc3RfZnJlX3NlZW5fdmVyc2lvbj0iMTA0LjAuMTI5My42MyI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjEwNjU0OTAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMDk0MzI4MTI1Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.147.37
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1324"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
services.exe
User:
SYSTEM
Company:
Adobe Inc.
Integrity Level:
SYSTEM
Description:
Acrobat Update Service
Version:
1.824.460.1042
Modules
Images
c:\program files (x86)\common files\adobe\arm\1.0\armsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1504"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{178CE844-4333-4832-86EA-6C5C52EA77A3}\MicrosoftEdgeUpdateSetup_X86_1.3.195.61.exe" /update /sessionid "{E270AE21-70F8-4466-A93A-2807D183A083}"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{178CE844-4333-4832-86EA-6C5C52EA77A3}\MicrosoftEdgeUpdateSetup_X86_1.3.195.61.exe
MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.195.61
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\install\{178ce844-4333-4832-86ea-6c5c52ea77a3}\microsoftedgeupdatesetup_x86_1.3.195.61.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1512"C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=138.0.7194.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2bc,0x2c0,0x2c4,0x2b8,0x2c8,0x140609ff8,0x14060a004,0x14060a010C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater (x64)
Exit code:
0
Version:
138.0.7194.0
Modules
Images
c:\program files (x86)\google\googleupdater\138.0.7194.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
Total events
42 312
Read events
35 483
Write events
6 606
Delete events
223

Modification events

(PID) Process:(7608) 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
114
(PID) Process:(7608) 457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
405D376800000000
(PID) Process:(1324) armsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Adobe\Adobe ARM\1.0\ARM
Operation:writeName:iLastSvcSuccess
Value:
1238734
(PID) Process:(7260) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers
Operation:writeName:omaha_version
Value:
1100B90003000100
(PID) Process:(7260) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Booleans
Operation:writeName:is_system_install
Value:
01000000
(PID) Process:(7260) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts
Operation:writeName:goopdate_main
Value:
1500000000000000
(PID) Process:(7260) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts
Operation:writeName:goopdate_constructor
Value:
1500000000000000
(PID) Process:(7260) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers
Operation:writeName:windows_major_version
Value:
0A00000000000000
(PID) Process:(1600) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:Server
Value:
(PID) Process:(1600) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:From
Value:
Executable files
369
Suspicious files
37
Text files
16
Unknown types
6

Dropped files

PID
Process
Filename
Type
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exeexecutable
MD5:38B7C69B2485AC3104A3761A95601887
SHA256:031E24D6AC54C25FC75AE32CB1E6170362CB602EE5A3713B11C3A36C78D2036C
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exeexecutable
MD5:20415EE326CC53C1EF4C1B113FEF5C90
SHA256:32A774B42189E15288B6CF8D7DCD3E9DF08611DB89DACF9174377BADB9329FF9
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeexecutable
MD5:5F85F97C725A7B9178571F692E7D709D
SHA256:BCCF9C5167CD58725A25AB4A46C8BB68D4D9D1ABE76F491468C7E9232EA51D71
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exeexecutable
MD5:83B06B14D98B0FF3FF700AAC86EC0C42
SHA256:8FE470A926A7089B0D85F5D60AD36A5E3381FF7FDC0FB80C8BFF037CA7055D4D
6700457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeexecutable
MD5:B4EA7CDE196CC788976324774E3D753B
SHA256:692CA9EF7C6591827E0817AEE05D3C05E4E214DA628F489A61AC665773BC1755
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exeexecutable
MD5:3B1333AE9A3047016A9E035FB1769130
SHA256:D47FEEDB5A0035D0382A051E5AAA26181F6E7FBC7BEB85086D13A4C118026245
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exeexecutable
MD5:FF129B3BD00DABE4CDB2BA7D078D636A
SHA256:21FDF22046784CA2CCD6FDD551090BE46AEDB559B296F2648041A186B889778F
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Users\admin\AppData\Local\Temp\Everything-1.5a.ini.tmptext
MD5:D0AA8C0A742774E1A092B83DB84D0634
SHA256:28E9E45FEFCC6A675538D16A98F9C1DD70D68FABD946BCC114DDD6AD679135E1
7608457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exeexecutable
MD5:082C959FEB267C2BEEC1045CF4885A57
SHA256:0CBF36ED612EB8C7E0FE38A213EFE7F7A86D80DA928840770A4CB3FCF5B57528
456alg.exeC:\Windows\System32\config\systemprofile\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:458B1DD1F306D5CD44A5B34D300C5BA3
SHA256:5C9AD5474F094F969D6FFFEB451C83E43519EB50A47D5B89FD56DF6A73C3B4AC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
677
TCP/UDP connections
124
DNS requests
111
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
456
alg.exe
POST
200
18.234.103.197:80
http://ssbzmoy.biz/s
unknown
—
—
unknown
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
18.234.103.197:80
http://ssbzmoy.biz/belbvrqhhvxwsma
unknown
—
—
unknown
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
52.11.240.239:80
http://pywolwnvd.biz/du
unknown
—
—
malicious
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
52.11.240.239:80
http://cvgrf.biz/cycwnxsllmkyhlw
unknown
—
—
malicious
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
3.229.117.57:80
http://npukfztj.biz/sfgpgvjejmle
unknown
—
—
malicious
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
172.233.219.123:80
http://przvgke.biz/ihvijbdlfwl
unknown
—
—
unknown
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
172.233.219.123:80
http://przvgke.biz/uuhjqbonyujhv
unknown
—
—
unknown
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
POST
200
18.234.103.197:80
http://knjghuig.biz/hspdm
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7804
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
52.11.240.239:80
pywolwnvd.biz
AMAZON-02
US
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
18.234.103.197:80
ssbzmoy.biz
AMAZON-AES
US
malicious
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
3.229.117.57:80
npukfztj.biz
AMAZON-AES
US
malicious
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
172.233.219.123:80
przvgke.biz
Akamai International B.V.
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.153
  • 23.48.23.135
  • 23.48.23.132
  • 23.48.23.142
  • 23.48.23.151
  • 23.48.23.157
  • 23.48.23.146
  • 23.48.23.139
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
pywolwnvd.biz
  • 52.11.240.239
malicious
ssbzmoy.biz
  • 18.234.103.197
unknown
cvgrf.biz
  • 52.11.240.239
malicious
npukfztj.biz
  • 3.229.117.57
malicious
przvgke.biz
  • 172.233.219.123
  • 172.233.219.49
  • 172.233.219.78
unknown
zlenh.biz
  • —
unknown
knjghuig.biz
  • 18.234.103.197
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)
7608
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af.exe
Misc activity
ET INFO Namecheap URL Forward
2196
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)
456
alg.exe
Misc activity
ET INFO Namecheap URL Forward
720
svchost.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
720
svchost.exe
Misc activity
ET INFO EXE - Served Attached HTTP
6036
svchost.exe
Misc activity
ET INFO Packed Executable Download
Process
Message
MicrosoftEdgeUpdate.exe
LOG_SYSTEM: [MicrosoftEdgeUpdate:msedgeupdate]: Could not acquire logging mutex _Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
457378d4ee658ffc3a833ca502f9f74efcd22684972e79e4f02307b24ce0f9af