File name:

Universal IPTV Scan v2.0.exe

Full analysis: https://app.any.run/tasks/3b85eda1-dcbd-4ac3-a4e6-cf1185120451
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 22, 2025, 02:48:42
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
themida
svcstealer
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

C55CEB63EB3EC8A06A860D9027A746BD

SHA1:

5A9C77967C6F4C537117B5E8AD2598D493F22958

SHA256:

55D8840C57A46A9F77FBBF5DF22F545E947E7D90965F7FE064C383289821ADEE

SSDEEP:

196608:ArwITwx2UTRuEzSG+8sYkXxn9fqJ+emLuFkxBz:V9n1rSgMh1Mg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • nbnbnvbcv.exe (PID: 5640)
      • A1FA.tmp.exe (PID: 2192)
      • explorer.exe (PID: 5492)

    • Actions looks like stealing of personal data

      • cvcxvcxvxc.exe (PID: 960)

    • SVCSTEALER mutex has been found

      • A1FA.tmp.exe (PID: 2192)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • Universal IPTV Scan v2.0.exe (PID: 4988)

    • Executable content was dropped or overwritten

      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • nbnbnvbcv.exe (PID: 5640)
      • Launcher.exe (PID: 5064)
      • explorer.exe (PID: 5492)
      • A1FA.tmp.exe (PID: 2192)

    • Reads security settings of Internet Explorer

      • cvcxvcxvxc.exe (PID: 960)
      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • ShellExperienceHost.exe (PID: 4572)

    • Reads the BIOS version

      • Launcher.exe (PID: 5064)

    • Connects to the server without a host name

      • cvcxvcxvxc.exe (PID: 960)
      • explorer.exe (PID: 5492)

    • Potential Corporate Privacy Violation

      • cvcxvcxvxc.exe (PID: 960)

    • The process creates files with name similar to system file names

      • A1FA.tmp.exe (PID: 2192)

    • Starts a Microsoft application from unusual location

      • A1FA.tmp.exe (PID: 2192)

    • Found regular expressions for crypto-addresses (YARA)

      • A1FA.tmp.exe (PID: 2192)

  • INFO

    • The sample compiled with english language support

      • Universal IPTV Scan v2.0.exe (PID: 4988)

    • Reads the machine GUID from the registry

      • nbnbnvbcv.exe (PID: 5640)

    • Checks supported languages

      • cvcxvcxvxc.exe (PID: 960)
      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • nbnbnvbcv.exe (PID: 5640)
      • Launcher.exe (PID: 5064)
      • ShellExperienceHost.exe (PID: 4572)
      • A1FA.tmp.exe (PID: 2192)

    • Create files in a temporary directory

      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • cvcxvcxvxc.exe (PID: 960)
      • Launcher.exe (PID: 5064)
      • explorer.exe (PID: 5492)

    • Creates files in the program directory

      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • nbnbnvbcv.exe (PID: 5640)
      • cvcxvcxvxc.exe (PID: 960)
      • A1FA.tmp.exe (PID: 2192)

    • Reads the computer name

      • Universal IPTV Scan v2.0.exe (PID: 4988)
      • cvcxvcxvxc.exe (PID: 960)
      • Launcher.exe (PID: 5064)
      • ShellExperienceHost.exe (PID: 4572)

    • Checks proxy server information

      • cvcxvcxvxc.exe (PID: 960)
      • explorer.exe (PID: 5492)
      • BackgroundTransferHost.exe (PID: 2420)
      • slui.exe (PID: 5212)

    • Process checks computer location settings

      • Universal IPTV Scan v2.0.exe (PID: 4988)

    • Creates files or folders in the user directory

      • cvcxvcxvxc.exe (PID: 960)
      • BackgroundTransferHost.exe (PID: 2420)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 1764)
      • BackgroundTransferHost.exe (PID: 7036)
      • BackgroundTransferHost.exe (PID: 5408)
      • BackgroundTransferHost.exe (PID: 1912)
      • BackgroundTransferHost.exe (PID: 2420)

    • Themida protector has been detected

      • Launcher.exe (PID: 5064)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 2420)
      • slui.exe (PID: 5212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:02:09 07:46:40+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 123392
InitializedDataSize: 16502784
UninitializedDataSize: -
EntryPoint: 0x5f50
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.2.1.1
ProductVersionNumber: 3.1.1.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Application
FileDescription: Application
FileVersion: 1.2.1.1
InternalName: Application.exe
LegalCopyright: (C) 2026
OriginalFileName: Application.exe
ProductName: Appcx
ProductVersion: 3.1.1.1
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
13
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start universal iptv scan v2.0.exe nbnbnvbcv.exe cvcxvcxvxc.exe launcher.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs explorer.exe shellexperiencehost.exe no specs #SVCSTEALER a1fa.tmp.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
960"C:\ProgramData\cvcxvcxvxc.exe" C:\ProgramData\cvcxvcxvxc.exe
Universal IPTV Scan v2.0.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\cvcxvcxvxc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1764"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1912"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2192C:\Users\admin\AppData\Local\Temp\A1FA.tmp.exeC:\Users\admin\AppData\Local\Temp\A1FA.tmp.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System
Version:
6.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\a1fa.tmp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2420"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4572"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
4988"C:\Users\admin\AppData\Local\Temp\Universal IPTV Scan v2.0.exe" C:\Users\admin\AppData\Local\Temp\Universal IPTV Scan v2.0.exe
explorer.exe
User:
admin
Company:
Application
Integrity Level:
MEDIUM
Description:
Application
Exit code:
0
Version:
1.2.1.1
Modules
Images
c:\users\admin\appdata\local\temp\universal iptv scan v2.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
5064"C:\Users\admin\AppData\Local\Temp\Launcher.exe" C:\Users\admin\AppData\Local\Temp\Launcher.exe
Universal IPTV Scan v2.0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Universal IPTV Scan
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5212C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5408"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
6 084
Read events
5 933
Write events
149
Delete events
2

Modification events

(PID) Process:(5640) nbnbnvbcv.exeKey:HKEY_CURRENT_USER\SOFTWARE\bbeecafdaeec
Operation:writeName:CurrentPath
Value:
C:\ProgramData\nbnbnvbcv.exe
(PID) Process:(5640) nbnbnvbcv.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:bbeecafdaeec
Value:
"C:\ProgramData\bbeecafdaeec.exe"
(PID) Process:(960) cvcxvcxvxc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(960) cvcxvcxvxc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(960) cvcxvcxvxc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1912) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1912) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1912) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2420) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2420) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
7
Suspicious files
10
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Chrome_History.txt —
MD5:—
SHA256:—
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Chrome_Downloads.txt —
MD5:—
SHA256:—
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Edge_Downloads.txt —
MD5:—
SHA256:—
2420BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\468ef59b-8e3a-458e-b696-446794b6feeb.down_data —
MD5:—
SHA256:—
4988Universal IPTV Scan v2.0.exeC:\Users\admin\AppData\Local\Temp\Launcher.exeexecutable
MD5:E4F681A9727AD415D5A61E0246A16A30
SHA256:7F1EEE7CAE84A77840FA08A4ED7BA8CC94BF79B933901ECE4840F035D56BE51B
4988Universal IPTV Scan v2.0.exeC:\ProgramData\nbnbnvbcv.exeexecutable
MD5:3D5EDF0BC8665D99D5A71A73FB55A1A8
SHA256:EE7CDD06CF0CB78B462BA21081593D78994E5A301488AA1917C9400B1D3C3653
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\FTP Clients\FileZilla\layout.xmlxml
MD5:4526724CD149C14EF9D37D86F825B9F7
SHA256:138167D8F03D48E88DA0AEC3DF38F723BC1895822F75660CCCB5E994814BEE90
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\FTP Clients\FileZilla\filezilla.xmlxml
MD5:32F683306CE4FA78157113BB9EACB51D
SHA256:16283B36975456118FBAC2A0CB0AB466C2D26E2B396DD938CDF129F2D3224570
960cvcxvcxvxc.exeC:\ProgramData\6830FA554F652512029130\Windows_Info.txttext
MD5:40A2F8B424AD18767F8BC8A9C063BC5B
SHA256:2BFA6C0374D3F0F95FF38F59C7DAE23F788528CE0213DD5E0BFF923AB2DC3C3D
960cvcxvcxvxc.exeC:\Users\admin\AppData\Local\Temp\Historybinary
MD5:FDDE63730E15DD2E18C540BA52B6A945
SHA256:40740EAABD14FC0E08D3B5EE340C1E1B372E158F61EF58AEED1EE4B3A3F4492E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
33
DNS requests
18
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6744
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
960
cvcxvcxvxc.exe
POST
200
185.81.68.156:80
http://185.81.68.156/svcstealer/get.php
unknown
—
—
malicious
5640
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5492
explorer.exe
POST
200
185.81.68.156:80
http://185.81.68.156/diamo/post.php
unknown
—
—
malicious
5492
explorer.exe
POST
200
185.81.68.156:80
http://185.81.68.156/diamo/post.php
unknown
—
—
malicious
5492
explorer.exe
POST
200
185.81.68.156:80
http://185.81.68.156/diamo/post.php
unknown
—
—
malicious
2420
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5492
explorer.exe
POST
200
185.81.68.156:80
http://185.81.68.156/diamo/post.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
960
cvcxvcxvxc.exe
185.81.68.156:80
—
Chang Way Technologies Co. Limited
RU
malicious
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6744
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 20.198.162.78
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.14
  • 20.190.160.128
  • 20.190.160.65
  • 20.190.160.17
  • 40.126.32.76
  • 20.190.160.64
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
www.bing.com
  • 2.16.204.161
  • 2.16.204.141
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted

Threats

PID
Process
Class
Message
960
cvcxvcxvxc.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
960
cvcxvcxvxc.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 30
960
cvcxvcxvxc.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Sending Screenshot in Archive via POST Request
960
cvcxvcxvxc.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
960
cvcxvcxvxc.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
960
cvcxvcxvxc.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Universal IPTV Scan v2.0.exe