File name:

76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe

Full analysis: https://app.any.run/tasks/68fa2a5b-eaac-43a8-9af1-bb6c48bb6834
Verdict: Malicious activity
Analysis date: October 03, 2025, 17:42:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
m0yv
putty
rmm-tool
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 10 sections
MD5:

DE1303808EE6DD3D99B345EF675DE839

SHA1:

6B038DC198A672517761442D1C56B524A6FE304F

SHA256:

76423ACC2735E6B92208010048D11B9D3BFBB1D1A24BC47F2C71A38BCA0BD4BD

SSDEEP:

98304:1zNfSNEFwD4iYwRFjKmGc6iaFo71k12PV3Ftvgd9/n:S7mq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • 76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe (PID: 5212)

    • Connects to the CnC server

      • svchost.exe (PID: 2428)

    • M0YV has been detected (SURICATA)

      • svchost.exe (PID: 2428)

    • M0YV has been detected (YARA)

      • 76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe (PID: 5212)

  • SUSPICIOUS

    • PUTTY has been detected

      • 76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe (PID: 5212)

    • Process drops legitimate windows executable

      • 76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe (PID: 5212)

    • Executable content was dropped or overwritten

      • 76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe (PID: 5212)

  • INFO

    • The sample compiled with english language support

      • 76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe (PID: 5212)

    • Checks supported languages

      • 76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe (PID: 5212)

    • Creates files or folders in the user directory

      • 76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe (PID: 5212)

    • Reads the computer name

      • 76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe (PID: 5212)

    • Checks proxy server information

      • 76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe (PID: 5212)
      • slui.exe (PID: 1188)

    • Reads the software policy settings

      • slui.exe (PID: 1188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:04:06 09:49:51+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14
CodeSize: 950784
InitializedDataSize: 689152
UninitializedDataSize: -
EntryPoint: 0xbaf04
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.81.0.0
ProductVersionNumber: 0.81.0.0
FileFlagsMask: 0x000b
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
CompanyName: Simon Tatham
ProductName: PuTTY suite
FileDescription: SSH, Telnet, Rlogin, and SUPDUP client
InternalName: PuTTY
OriginalFileName: PuTTY
FileVersion: Release 0.81 (with embedded help)
ProductVersion: Release 0.81
LegalCopyright: Copyright © 1997-2024 Simon Tatham.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
1188C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2428C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5212"C:\Users\admin\Desktop\76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe" C:\Users\admin\Desktop\76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
explorer.exe
User:
admin
Company:
Simon Tatham
Integrity Level:
MEDIUM
Description:
SSH, Telnet, Rlogin, and SUPDUP client
Version:
Release 0.81 (with embedded help)
Modules
Images
c:\users\admin\desktop\76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
4 826
Read events
4 826
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
521276423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeexecutable
MD5:517B0CA531F72A4F0EB5B02DAB86F438
SHA256:2DAC12F7ECDE11BEA99B18414A56A528E10C8942A805C6C78FB32182721F3BFE
521276423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exeexecutable
MD5:223146726DB9B55BFEFAE79B8EDA67FD
SHA256:56B2023EFDB3FA61C73DD841919B8BDC403944B46AB5FF8B8079B43E29AFA119
521276423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exeC:\Users\admin\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:29DC9C28851DDA5285C939AD11B4864B
SHA256:D1B47A16FCE361E7E3F5AAF75FB2B09A2D0ECEC72F87BA9A65A72D8241D8DF5A
521276423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exeexecutable
MD5:01314B383FEEF1EED3997EF91F22E40A
SHA256:85437ED510B3BE7660AB0A204339F9F4C35114B882166CE207C2C3BE6FD17A80
521276423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exeexecutable
MD5:A3A96A5A4E511D544215F65067650534
SHA256:8506445B5B7709C35E190A13EBB7DC1DA5E5C69277173AA7B175CDE437E1D886
521276423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exeC:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exeexecutable
MD5:F5F8A6BE144B19F75DAB52BDD126E54E
SHA256:37D4A75C8CC69AAD4626DF8546B31C5EE8781946AC73FD0F0AFE3036B02F9FAE
521276423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exeexecutable
MD5:B9F945E819937577B5557FCC472235C0
SHA256:5A4FD75B2C138106F16B2CC23B9B1B1FF65279366526E0CBE6188D3FB7030712
521276423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exeexecutable
MD5:BA9FD3B3966BE34BA7785E357582A673
SHA256:8A0A13204DD0E0CA80BB26E8A1A0F1D593080100F3FD50265ECD22E273DC697B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
55
DNS requests
49
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
POST
200
44.244.22.128:80
http://cvgrf.biz/ws
US
—
—
malicious
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
POST
200
3.229.117.57:80
http://npukfztj.biz/isivxykcb
US
—
—
malicious
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
POST
200
44.244.22.128:80
http://pywolwnvd.biz/rrtbjkapnysu
US
—
—
malicious
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
POST
200
172.237.146.38:80
http://przvgke.biz/kjnqfmiaj
US
binary
4.33 Kb
unknown
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
POST
200
50.16.27.236:80
http://knjghuig.biz/bvitg
US
—
—
malicious
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
POST
302
192.64.119.165:80
http://anpmnmxo.biz/lbltdckfaws
US
—
—
unknown
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
POST
302
192.64.119.165:80
http://anpmnmxo.biz/orqgdhivpkv
US
—
—
unknown
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
POST
—
176.100.243.135:80
http://lpuegx.biz/dmat
RU
—
—
malicious
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
GET
403
91.195.240.19:80
http://www.anpmnmxo.biz/orqgdhivpkv
DE
html
93 b
unknown
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
GET
403
91.195.240.19:80
http://www.anpmnmxo.biz/lbltdckfaws
DE
html
93 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7068
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6016
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.192.36.137:443
www.bing.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6016
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
44.244.22.128:80
pywolwnvd.biz
AMAZON-02
US
malicious
5948
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
50.16.27.236:80
ssbzmoy.biz
AMAZON-AES
US
malicious
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
3.229.117.57:80
npukfztj.biz
AMAZON-AES
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
www.bing.com
  • 23.192.36.137
  • 23.192.36.142
whitelisted
google.com
  • 142.250.185.78
whitelisted
pywolwnvd.biz
  • 44.244.22.128
malicious
ssbzmoy.biz
  • 50.16.27.236
unknown
cvgrf.biz
  • 44.244.22.128
malicious
npukfztj.biz
  • 3.229.117.57
malicious
przvgke.biz
  • 172.237.146.38
  • 172.233.219.123
  • 172.233.219.49
  • 172.233.219.78
  • 172.237.146.8
  • 172.237.146.25
unknown
zlenh.biz
  • —
unknown
knjghuig.biz
  • 50.16.27.236
malicious

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2428
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)
2428
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/m0yv CnC related domain (zlenh .biz)
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
Misc activity
ET INFO Namecheap URL Forward
5212
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe
Misc activity
ET INFO Namecheap URL Forward
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
76423acc2735e6b92208010048d11b9d3bfbb1d1a24bc47f2c71a38bca0bd4bd.exe