File name:

Universal IPTV Scan v2.0.exe

Full analysis: https://app.any.run/tasks/3b85eda1-dcbd-4ac3-a4e6-cf1185120451
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 22, 2025, 02:48:42
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
themida
svcstealer
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

C55CEB63EB3EC8A06A860D9027A746BD

SHA1:

5A9C77967C6F4C537117B5E8AD2598D493F22958

SHA256:

55D8840C57A46A9F77FBBF5DF22F545E947E7D90965F7FE064C383289821ADEE

SSDEEP:

196608:ArwITwx2UTRuEzSG+8sYkXxn9fqJ+emLuFkxBz:V9n1rSgMh1Mg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • nbnbnvbcv.exe (PID: 5640)
      • A1FA.tmp.exe (PID: 2192)
      • explorer.exe (PID: 5492)

    • Actions looks like stealing of personal data

      • cvcxvcxvxc.exe (PID: 960)

    • SVCSTEALER mutex has been found

      • A1FA.tmp.exe (PID: 2192)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • cvcxvcxvxc.exe (PID: 960)
      • ShellExperienceHost.exe (PID: 4572)

    • Executable content was dropped or overwritten

      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • nbnbnvbcv.exe (PID: 5640)
      • Launcher.exe (PID: 5064)
      • explorer.exe (PID: 5492)
      • A1FA.tmp.exe (PID: 2192)

    • Reads the date of Windows installation

      • Universal IPTV Scan v2.0.exe (PID: 4988)

    • Reads the BIOS version

      • Launcher.exe (PID: 5064)

    • Potential Corporate Privacy Violation

      • cvcxvcxvxc.exe (PID: 960)

    • Connects to the server without a host name

      • cvcxvcxvxc.exe (PID: 960)
      • explorer.exe (PID: 5492)

    • Starts a Microsoft application from unusual location

      • A1FA.tmp.exe (PID: 2192)

    • The process creates files with name similar to system file names

      • A1FA.tmp.exe (PID: 2192)

    • Found regular expressions for crypto-addresses (YARA)

      • A1FA.tmp.exe (PID: 2192)

  • INFO

    • Create files in a temporary directory

      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • cvcxvcxvxc.exe (PID: 960)
      • Launcher.exe (PID: 5064)
      • explorer.exe (PID: 5492)

    • Checks supported languages

      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • nbnbnvbcv.exe (PID: 5640)
      • cvcxvcxvxc.exe (PID: 960)
      • Launcher.exe (PID: 5064)
      • ShellExperienceHost.exe (PID: 4572)
      • A1FA.tmp.exe (PID: 2192)

    • The sample compiled with english language support

      • Universal IPTV Scan v2.0.exe (PID: 4988)

    • Creates files in the program directory

      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • nbnbnvbcv.exe (PID: 5640)
      • cvcxvcxvxc.exe (PID: 960)
      • A1FA.tmp.exe (PID: 2192)

    • Reads the computer name

      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • cvcxvcxvxc.exe (PID: 960)
      • Launcher.exe (PID: 5064)
      • ShellExperienceHost.exe (PID: 4572)

    • Reads the machine GUID from the registry

      • nbnbnvbcv.exe (PID: 5640)

    • Process checks computer location settings

      • Universal IPTV Scan v2.0.exe (PID: 4988)

    • Checks proxy server information

      • cvcxvcxvxc.exe (PID: 960)
      • BackgroundTransferHost.exe (PID: 2420)
      • explorer.exe (PID: 5492)
      • slui.exe (PID: 5212)

    • Creates files or folders in the user directory

      • cvcxvcxvxc.exe (PID: 960)
      • BackgroundTransferHost.exe (PID: 2420)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 2420)
      • BackgroundTransferHost.exe (PID: 7036)
      • BackgroundTransferHost.exe (PID: 5408)
      • BackgroundTransferHost.exe (PID: 1912)
      • BackgroundTransferHost.exe (PID: 1764)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 2420)
      • slui.exe (PID: 5212)

    • Themida protector has been detected

      • Launcher.exe (PID: 5064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:02:09 07:46:40+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 123392
InitializedDataSize: 16502784
UninitializedDataSize: -
EntryPoint: 0x5f50
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.2.1.1
ProductVersionNumber: 3.1.1.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Application
FileDescription: Application
FileVersion: 1.2.1.1
InternalName: Application.exe
LegalCopyright: (C) 2026
OriginalFileName: Application.exe
ProductName: Appcx
ProductVersion: 3.1.1.1
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
13
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start universal iptv scan v2.0.exe nbnbnvbcv.exe cvcxvcxvxc.exe launcher.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs explorer.exe shellexperiencehost.exe no specs #SVCSTEALER a1fa.tmp.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
960"C:\ProgramData\cvcxvcxvxc.exe" C:\ProgramData\cvcxvcxvxc.exe
Universal IPTV Scan v2.0.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\cvcxvcxvxc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1764"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1912"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2192C:\Users\admin\AppData\Local\Temp\A1FA.tmp.exeC:\Users\admin\AppData\Local\Temp\A1FA.tmp.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System
Version:
6.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\a1fa.tmp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2420"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4572"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
4988"C:\Users\admin\AppData\Local\Temp\Universal IPTV Scan v2.0.exe" C:\Users\admin\AppData\Local\Temp\Universal IPTV Scan v2.0.exe
explorer.exe
User:
admin
Company:
Application
Integrity Level:
MEDIUM
Description:
Application
Exit code:
0
Version:
1.2.1.1
Modules
Images
c:\users\admin\appdata\local\temp\universal iptv scan v2.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
5064"C:\Users\admin\AppData\Local\Temp\Launcher.exe" C:\Users\admin\AppData\Local\Temp\Launcher.exe
Universal IPTV Scan v2.0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Universal IPTV Scan
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5212C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5408"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
6 084
Read events
5 933
Write events
149
Delete events
2

Modification events

(PID) Process:(5640) nbnbnvbcv.exeKey:HKEY_CURRENT_USER\SOFTWARE\bbeecafdaeec
Operation:writeName:CurrentPath
Value:
C:\ProgramData\nbnbnvbcv.exe
(PID) Process:(5640) nbnbnvbcv.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:bbeecafdaeec
Value:
"C:\ProgramData\bbeecafdaeec.exe"
(PID) Process:(960) cvcxvcxvxc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(960) cvcxvcxvxc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(960) cvcxvcxvxc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1912) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1912) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1912) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2420) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2420) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
7
Suspicious files
10
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Chrome_History.txt —
MD5:—
SHA256:—
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Chrome_Downloads.txt —
MD5:—
SHA256:—
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Edge_Downloads.txt —
MD5:—
SHA256:—
2420BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\468ef59b-8e3a-458e-b696-446794b6feeb.down_data —
MD5:—
SHA256:—
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\Software_Info.txttext
MD5:DDD0D6B9992364DC4CEF1A21F83CB957
SHA256:2D6DE0073E64A958C02EFC65E0E1F4A8B2F2FC91057FBB4C71FFDAE3F904AB53
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\FTP Clients\FileZilla\filezilla.xmlxml
MD5:32F683306CE4FA78157113BB9EACB51D
SHA256:16283B36975456118FBAC2A0CB0AB466C2D26E2B396DD938CDF129F2D3224570
2420BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:B97E400964900BC2D8274B887D5AA1F4
SHA256:9EE0020FE1FECDEEE0309A80F5EB6BC02AF0793E11C4A230C7931D4C6BC662ED
4988Universal IPTV Scan v2.0.exeC:\ProgramData\nbnbnvbcv.exeexecutable
MD5:3D5EDF0BC8665D99D5A71A73FB55A1A8
SHA256:EE7CDD06CF0CB78B462BA21081593D78994E5A301488AA1917C9400B1D3C3653
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\Screenshot.jpgbinary
MD5:DBA03065AF4DE587B2C0DD3A8820ED7F
SHA256:3864C58A0CBD5FBBB8C01A80536942080EAFB3E79754E073E94E9CF176178F73
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\FTP Clients\FileZilla\layout.xmlxml
MD5:4526724CD149C14EF9D37D86F825B9F7
SHA256:138167D8F03D48E88DA0AEC3DF38F723BC1895822F75660CCCB5E994814BEE90
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
33
DNS requests
18
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
960
cvcxvcxvxc.exe
POST
200
185.81.68.156:80
http://185.81.68.156/svcstealer/get.php
unknown
—
—
malicious
960
cvcxvcxvxc.exe
POST
200
185.81.68.156:80
http://185.81.68.156/svcstealer/get.php
unknown
—
—
malicious
960
cvcxvcxvxc.exe
POST
200
185.81.68.156:80
http://185.81.68.156/svcstealer/get.php
unknown
—
—
malicious
2420
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
960
cvcxvcxvxc.exe
POST
200
185.81.68.156:80
http://185.81.68.156/svcstealer/get.php
unknown
—
—
malicious
6744
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5492
explorer.exe
POST
200
185.81.68.156:80
http://185.81.68.156/diamo/post.php
unknown
—
—
malicious
5640
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5492
explorer.exe
POST
200
185.81.68.156:80
http://185.81.68.156/diamo/post.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
960
cvcxvcxvxc.exe
185.81.68.156:80
—
Chang Way Technologies Co. Limited
RU
malicious
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6744
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 20.198.162.78
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.14
  • 20.190.160.128
  • 20.190.160.65
  • 20.190.160.17
  • 40.126.32.76
  • 20.190.160.64
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
www.bing.com
  • 2.16.204.161
  • 2.16.204.141
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted

Threats

PID
Process
Class
Message
960
cvcxvcxvxc.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
960
cvcxvcxvxc.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 30
960
cvcxvcxvxc.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Sending Screenshot in Archive via POST Request
960
cvcxvcxvxc.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
960
cvcxvcxvxc.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
960
cvcxvcxvxc.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Universal IPTV Scan v2.0.exe