File name:

x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe

Full analysis: https://app.any.run/tasks/0a9993db-bc45-4627-8846-13a55f4a945b
Verdict: Malicious activity
Analysis date: March 01, 2026, 19:56:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
m0yv
phishing
sinkhole
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 12 sections
MD5:

E06670367787B6C796A5F4BCC71E5696

SHA1:

7881BA3D554D06757409F3547E6DB03050E3BBA9

SHA256:

8106A4B7AF82561CE069C1ED58C9560ADB127F598B98FF6E4983A0C2CA77A476

SSDEEP:

98304:c1tWt2HCmiq9McQaciFxnQkAhBw3NrCRXgdDQcVGMFxXFr/90loXxZcuPHx26Bjf:HaciBXPl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)
      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 1424)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2292)

    • M0YV has been detected (SURICATA)

      • svchost.exe (PID: 2292)
      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)

    • M0YV has been detected (YARA)

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)

  • SUSPICIOUS

    • Browser headless start

      • chrome.exe (PID: 6912)
      • chrome.exe (PID: 7476)
      • chrome.exe (PID: 8432)
      • chrome.exe (PID: 7376)

    • Browser launch with unusual user-data-dir

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)
      • chrome.exe (PID: 6912)
      • chrome.exe (PID: 8432)

    • The process executes via Task Scheduler

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 1424)

  • INFO

    • Checks supported languages

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)
      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 1424)

    • The sample compiled with english language support

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)

    • Reads the computer name

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)
      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 1424)

    • Create files in a temporary directory

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)

    • Creates files or folders in the user directory

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)
      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 1424)

    • Checks proxy server information

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)
      • slui.exe (PID: 6724)

    • Application launched itself

      • chrome.exe (PID: 6912)
      • chrome.exe (PID: 8432)

    • Drops script file

      • chrome.exe (PID: 8320)
      • chrome.exe (PID: 8300)
      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)

    • Reads the machine GUID from the registry

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)

    • Process checks computer location settings

      • x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe (PID: 5184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2026:01:30 04:11:19+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14
CodeSize: 3288064
InitializedDataSize: 874496
UninitializedDataSize: -
EntryPoint: 0x2eaed0
OSVersion: 10
ImageVersion: -
SubsystemVersion: 10
Subsystem: Windows GUI
FileVersionNumber: 146.0.7659.1
ProductVersionNumber: 146.0.7659.1
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Google LLC
FileDescription: Google Chrome
FileVersion: 146.0.7659.1
InternalName: platform_experience_helper
LegalCopyright: Copyright 2026 Google LLC. All rights reserved.
OriginalFileName: platform_experience_helper.exe
ProductName: Google Chrome
ProductVersion: 146.0.7659.1
CompanyShortName: Google
ProductShortName: Chrome
LastChange: f9ef68d4ad1d944673acc51a771e31f29f060f50-refs/branch-heads/7659@{#2}
OfficialBuild: 1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
208
Monitored processes
67
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start #M0YV x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs #PHISHING svchost.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe #M0YV x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950" --field-trial-handle=6368,i,3538491958183521743,17253627871192605394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6668 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1424"C:\Users\admin\Desktop\x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe" --delete-shortcutC:\Users\admin\Desktop\x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe
svchost.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
146.0.7659.1
Modules
Images
c:\users\admin\desktop\x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1464"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950" --field-trial-handle=6532,i,3538491958183521743,17253627871192605394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6528 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1520"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950" --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5104,i,3538491958183521743,17253627871192605394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5024 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1656"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950" --field-trial-handle=6888,i,3538491958183521743,17253627871192605394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6524 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950" --field-trial-handle=6768,i,3538491958183521743,17253627871192605394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6772 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1904"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950" --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4804,i,3538491958183521743,17253627871192605394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=3428 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1908"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950" --field-trial-handle=6784,i,3538491958183521743,17253627871192605394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6664 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2248"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950" --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2880,i,3538491958183521743,17253627871192605394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=2888 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2292C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
8 983
Read events
8 981
Write events
2
Delete events
0

Modification events

(PID) Process:(5184) x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}
Operation:writeName:dr
Value:
1
(PID) Process:(5184) x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\PlatformExperienceHelper
Operation:writeName:DaysUntilNextNotification
Value:
4
Executable files
0
Suspicious files
0
Text files
9
Unknown types
613

Dropped files

PID
Process
Filename
Type
6912chrome.exeC:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950\ShaderCache\data_0binary
MD5:CF89D16BB9107C631DAABF0C0EE58EFB
SHA256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
5184x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exeC:\Users\admin\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:9BEF627FE8ED89FD8184177D50215F21
SHA256:F467ACA36C249915B224A2F36E741311BAE24CF32869326F240CAF82657000A3
5184x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exeC:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950\Local Statebinary
MD5:D513ECFFE446763EF0D61B8150D397DA
SHA256:89B2FF3035FBBD25E7D702E3E6D096175C62E639C12298A92CAB3D9AEDAB32D9
5184x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:FC81892AC822DCBB09441D3B58B47125
SHA256:FB077C966296D02D50CCBF7F761D2A3311A206A784A7496F331C2B0D6AD205C8
6912chrome.exeC:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950\ShaderCache\data_1binary
MD5:259E7ED5FB3C6C90533B963DA5B2FC1B
SHA256:35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
6912chrome.exeC:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950\Last Versionbinary
MD5:D18CE7F480944AE4E61A969D8C1E5003
SHA256:E0CB362A73D69BAD940A018881701B5F2A8527C13C3F5ACBBEA43B8820DFC199
6912chrome.exeC:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950\Crashpad\settings.datbinary
MD5:CCB6285129BE0C5911A4F4F5079B8E70
SHA256:F93EF3E60AF228AAE0B22D887E44870B3B2FA9DD5A6529CE463A665D2721DC0A
6912chrome.exeC:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950\Variationsbinary
MD5:961E3604F228B0D10541EBF921500C86
SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
6912chrome.exeC:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950\Default\Code Cache\js\indexbinary
MD5:54CB446F628B2EA4A5BCE5769910512E
SHA256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
6912chrome.exeC:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950\Default\History-journal —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
190
TCP/UDP connections
142
DNS requests
132
Threats
84

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2036
svchost.exe
GET
200
184.24.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
4516
RUXIMICS.exe
GET
200
184.24.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
184.24.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
2036
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
—
—
GET
200
142.251.37.3:443
https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=133
US
binary
88.2 Kb
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
—
—
GET
200
142.251.140.170:443
https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
US
binary
41 b
whitelisted
—
—
GET
200
142.251.127.139:443
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=133.0.6943.127&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DGCEB%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DGCEB%26ping%3Dr%253D-1%2526e%253D1
US
binary
1.31 Kb
whitelisted
5184
x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe
POST
200
44.244.22.128:80
http://pywolwnvd.biz/xkmsx
US
—
—
malicious
6720
chrome.exe
GET
200
142.251.127.139:80
http://clients2.google.com/time/1/current?cup2key=8:sPtxhXB8CBtqbU74Bl7Ed0hbXVvjTy1ulP0L79DeGEs&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
US
binary
108 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4516
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
92.123.104.61:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
2036
svchost.exe
184.24.77.10:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
4516
RUXIMICS.exe
184.24.77.10:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
184.24.77.10:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
2036
svchost.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
6768
MoUsoCoreWorker.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 20.42.73.31
  • 13.69.239.68
whitelisted
www.bing.com
  • 92.123.104.61
  • 92.123.104.11
  • 92.123.104.4
  • 92.123.104.47
  • 92.123.104.9
  • 92.123.104.53
  • 92.123.104.6
  • 92.123.104.12
  • 92.123.104.5
whitelisted
google.com
  • 142.251.208.14
whitelisted
crl.microsoft.com
  • 184.24.77.10
  • 184.24.77.19
  • 184.24.77.6
  • 184.24.77.34
  • 184.24.77.22
  • 184.24.77.28
  • 184.24.77.42
  • 184.24.77.7
  • 184.24.77.38
  • 184.24.77.15
  • 184.24.77.25
  • 184.24.77.31
  • 184.24.77.41
  • 184.24.77.14
whitelisted
www.microsoft.com
  • 23.52.181.212
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
clients2.google.com
  • 142.251.127.139
  • 142.251.127.138
  • 142.251.127.100
  • 142.251.127.101
  • 142.251.127.102
  • 142.251.127.113
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 142.251.140.170
  • 172.217.20.138
  • 172.217.16.202
  • 142.251.141.138
  • 142.251.141.74
  • 142.251.37.10
  • 142.251.208.10
  • 172.217.16.170
  • 142.251.127.95
  • 142.250.201.74
  • 142.251.141.106
  • 172.217.168.74
  • 216.58.206.74
whitelisted
clientservices.googleapis.com
  • 142.251.37.3
whitelisted
accounts.google.com
  • 142.251.127.84
whitelisted

Threats

PID
Process
Class
Message
2292
svchost.exe
Domain Observed Used for C2 Detected
MALWARE [ANY.RUN] Win32/m0yv related domain (pywolwnvd .biz)
5184
x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/m0yv activity observed
2292
svchost.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing Domain (.cvgrf .biz)
2292
svchost.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing Domain (.npukfztj .biz)
5184
x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/m0yv activity observed
5184
x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/m0yv activity observed
2292
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/m0yv CnC related domain (zlenh .biz)
2292
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)
5184
x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/m0yv activity observed
5184
x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/m0yv activity observed
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950 directory exists )
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\scoped_dir5184_1950319950 directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
x8106a4b7af82561ce069c1ed58c9560adb127f598b98ff6e4983a0c2ca77a476.exe