File name:

9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe

Full analysis: https://app.any.run/tasks/d8a95e43-8642-4d9e-9623-5524cbdedb62
Verdict: Malicious activity
Analysis date: October 03, 2025, 17:47:25
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
m0yv
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

F78A2D209C3C9430EA373BF76454E6DB

SHA1:

A01DCCC9E331033FFBC96318BEDC58328FE30A9F

SHA256:

9CB07C0BF061B82A68FDA7BF908B2AE7E029333772C6B9D6CA1F94871270C458

SSDEEP:

98304:p0LdR75wXRTFv6lBJqWeUBI5RB82s25p3MxV2nv3ASjdoc1Z9/pe09gWYLTT9vIB:7UsJ1/Jq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • 9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe (PID: 2568)
      • armsvc.exe (PID: 7628)
      • FlashPlayerUpdateService.exe (PID: 7220)
      • alg.exe (PID: 1388)
      • AppVClient.exe (PID: 4952)
      • MicrosoftEdgeUpdate.exe (PID: 7360)
      • FXSSVC.exe (PID: 1920)
      • GameInputSvc.exe (PID: 6156)
      • GameInputSvc.exe (PID: 6492)
      • elevation_service.exe (PID: 7076)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 2816)
      • updater.exe (PID: 6448)
      • elevation_service.exe (PID: 6868)
      • updater.exe (PID: 5424)
      • maintenanceservice.exe (PID: 7808)
      • updater.exe (PID: 5836)
      • msdtc.exe (PID: 8300)
      • PerceptionSimulationService.exe (PID: 8360)
      • perfhost.exe (PID: 8456)
      • updater.exe (PID: 3160)
      • updater.exe (PID: 7668)
      • updater.exe (PID: 4068)
      • PSEXESVC.exe (PID: 8500)
      • Locator.exe (PID: 8540)
      • snmptrap.exe (PID: 8628)
      • SensorDataService.exe (PID: 8580)
      • Spectrum.exe (PID: 8684)
      • ssh-agent.exe (PID: 8736)
      • SearchIndexer.exe (PID: 9132)
      • vds.exe (PID: 8932)
      • wbengine.exe (PID: 8980)
      • WmiApSrv.exe (PID: 9032)
      • TieringEngineService.exe (PID: 8796)
      • AgentService.exe (PID: 8896)

    • Connects to the CnC server

      • svchost.exe (PID: 2428)

    • M0YV has been detected (YARA)

      • alg.exe (PID: 1388)
      • armsvc.exe (PID: 7628)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 2816)
      • GameInputSvc.exe (PID: 6492)
      • elevation_service.exe (PID: 6868)
      • GameInputSvc.exe (PID: 6156)
      • elevation_service.exe (PID: 7076)
      • msdtc.exe (PID: 8300)
      • PerceptionSimulationService.exe (PID: 8360)
      • snmptrap.exe (PID: 8628)
      • PSEXESVC.exe (PID: 8500)
      • perfhost.exe (PID: 8456)
      • Locator.exe (PID: 8540)
      • Spectrum.exe (PID: 8684)

    • M0YV has been detected (SURICATA)

      • svchost.exe (PID: 2428)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe (PID: 2568)
      • armsvc.exe (PID: 7628)

    • Executes as Windows Service

      • armsvc.exe (PID: 7628)
      • FlashPlayerUpdateService.exe (PID: 7220)
      • alg.exe (PID: 1388)
      • AppVClient.exe (PID: 4952)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 2816)
      • MicrosoftEdgeUpdate.exe (PID: 7360)
      • GameInputSvc.exe (PID: 6156)
      • FXSSVC.exe (PID: 1920)
      • updater.exe (PID: 3160)
      • updater.exe (PID: 5424)
      • maintenanceservice.exe (PID: 7808)
      • msdtc.exe (PID: 8300)
      • perfhost.exe (PID: 8456)
      • PerceptionSimulationService.exe (PID: 8360)
      • PSEXESVC.exe (PID: 8500)
      • Locator.exe (PID: 8540)
      • SensorDataService.exe (PID: 8580)
      • snmptrap.exe (PID: 8628)
      • Spectrum.exe (PID: 8684)
      • ssh-agent.exe (PID: 8736)
      • TieringEngineService.exe (PID: 8796)
      • vds.exe (PID: 8932)
      • AgentService.exe (PID: 8896)
      • wbengine.exe (PID: 8980)
      • WmiApSrv.exe (PID: 9032)

    • Application launched itself

      • GameInputSvc.exe (PID: 6156)

    • Process drops legitimate windows executable

      • armsvc.exe (PID: 7628)

  • INFO

    • The sample compiled with english language support

      • 9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe (PID: 2568)
      • armsvc.exe (PID: 7628)

    • Creates files or folders in the user directory

      • 9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe (PID: 2568)

    • Checks supported languages

      • 9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe (PID: 2568)
      • armsvc.exe (PID: 7628)
      • FlashPlayerUpdateService.exe (PID: 7220)
      • MicrosoftEdgeUpdate.exe (PID: 7360)
      • elevation_service.exe (PID: 7076)
      • maintenanceservice.exe (PID: 7808)
      • PSEXESVC.exe (PID: 8500)
      • ssh-agent.exe (PID: 8736)

    • Reads the computer name

      • 9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe (PID: 2568)
      • armsvc.exe (PID: 7628)
      • FlashPlayerUpdateService.exe (PID: 7220)
      • MicrosoftEdgeUpdate.exe (PID: 7360)
      • elevation_service.exe (PID: 7076)
      • maintenanceservice.exe (PID: 7808)
      • PSEXESVC.exe (PID: 8500)
      • ssh-agent.exe (PID: 8736)

    • Create files in a temporary directory

      • 9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe (PID: 2568)

    • Creates files in the program directory

      • FXSSVC.exe (PID: 1920)
      • maintenanceservice.exe (PID: 7808)
      • SearchIndexer.exe (PID: 9132)

    • Reads the software policy settings

      • GameInputSvc.exe (PID: 6492)
      • slui.exe (PID: 9892)

    • Executes as Windows Service

      • elevation_service.exe (PID: 7076)
      • SearchIndexer.exe (PID: 9132)

    • Reads the time zone

      • TieringEngineService.exe (PID: 8796)

    • The sample compiled with bulgarian language support

      • armsvc.exe (PID: 7628)

    • Reads security settings of Internet Explorer

      • SearchProtocolHost.exe (PID: 9472)

    • Checks proxy server information

      • slui.exe (PID: 9892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:08:05 22:11:58+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.38
CodeSize: 4430336
InitializedDataSize: 4775424
UninitializedDataSize: -
EntryPoint: 0x2ee4a0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 5.1.0.211
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Malwarebytes
FileDescription: Malwarebytes Installer Service
FileVersion: 5.1.0.211
ProductName: Malwarebytes
ProductVersion: 5.1.0.211
LegalCopyright: (c) Malwarebytes. All rights reserved.
InternalName: MBAMIService.exe
OriginalFileName: MBAMIService.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
209
Monitored processes
40
Malicious processes
35
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #M0YV 9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe conhost.exe no specs #M0YV armsvc.exe #M0YV flashplayerupdateservice.exe no specs #M0YV alg.exe no specs #M0YV appvclient.exe no specs #M0YV diagnosticshub.standardcollector.service.exe no specs #M0YV microsoftedgeupdate.exe no specs #M0YV fxssvc.exe no specs #M0YV gameinputsvc.exe no specs #M0YV gameinputsvc.exe no specs #M0YV elevation_service.exe no specs #M0YV updater.exe no specs #M0YV updater.exe no specs #M0YV updater.exe no specs #M0YV updater.exe no specs #M0YV elevation_service.exe no specs #M0YV updater.exe no specs #M0YV maintenanceservice.exe no specs #M0YV updater.exe no specs #M0YV msdtc.exe no specs #M0YV perceptionsimulationservice.exe no specs #M0YV perfhost.exe no specs #M0YV psexesvc.exe no specs #M0YV locator.exe no specs #M0YV sensordataservice.exe no specs #M0YV snmptrap.exe no specs #M0YV spectrum.exe no specs #M0YV ssh-agent.exe no specs #M0YV tieringengineservice.exe no specs #M0YV agentservice.exe no specs #M0YV vds.exe no specs #M0YV wbengine.exe no specs #M0YV wmiapsrv.exe no specs #M0YV searchindexer.exe no specs #M0YV svchost.exe searchprotocolhost.exe no specs searchfilterhost.exe no specs slui.exe 9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1388C:\WINDOWS\System32\alg.exeC:\Windows\System32\alg.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Application Layer Gateway Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\alg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1920C:\WINDOWS\system32\fxssvc.exeC:\Windows\System32\FXSSVC.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Fax Service
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\fxssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shlwapi.dll
2364\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2428C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2568"C:\Users\admin\Desktop\9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe" C:\Users\admin\Desktop\9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe
explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
HIGH
Description:
Malwarebytes Installer Service
Exit code:
0
Version:
5.1.0.211
Modules
Images
c:\users\admin\desktop\9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\authz.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2816C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft (R) Diagnostics Hub Standard Collector
Version:
11.00.19041.3930 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\sechost.dll
3160"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --system --windows-service --service=update-internalC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe
services.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4068"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe
updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4952C:\WINDOWS\system32\AppVClient.exeC:\Windows\System32\AppVClient.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Application Virtualization Client Service
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\appvclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp_win.dll
5424"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --system --windows-service --service=update-internalC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe
services.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
50 820
Read events
50 705
Write events
91
Delete events
24

Modification events

(PID) Process:(7628) armsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Adobe\Adobe ARM\1.0\ARM
Operation:writeName:iLastSvcSuccess
Value:
1516703
(PID) Process:(1920) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax
Operation:writeName:RedirectionGuard
Value:
1
(PID) Process:(1920) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:Password
Value:
00
(PID) Process:(1920) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:delete valueName:Password
Value:
(PID) Process:(1920) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:Server
Value:
(PID) Process:(1920) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:From
Value:
(PID) Process:(1920) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:User
Value:
(PID) Process:(8736) ssh-agent.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\OpenSSH\Agent
Operation:writeName:ProcessID
Value:
8736
(PID) Process:(8684) Spectrum.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Spectrum
Operation:writeName:HeadCenterOfRotationFloat3
Value:
000000000AD7A3BD0AD7A33D
(PID) Process:(9132) SearchIndexer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Tracing\EventThrottleState
Operation:delete valueName:000003eb
Value:

Executable files
139
Suspicious files
6
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
25689cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exeC:\Users\admin\AppData\Local\Temp\mbamiservice.logtext
MD5:EEEFB800FDBC01B3F83F251A0DA4F4C8
SHA256:86E24E2B0E5A538BE80BD3373A25E4E6DE9F14BCBF7F88E4835595BA9C4515E4
25689cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exeC:\Users\admin\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:E29A0FC658789F1D063C6549AD72A11E
SHA256:018DB7DE4A35A64D093C5EB1B63B216A113685BE75756A03887543203F72985E
7628armsvc.exeC:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:AE56C60D18E2B3F02C703644490A6347
SHA256:D23360BEBC0F5D96D56105A14E364224B0FB0B796CAF407D9585C63C3283E77C
7628armsvc.exeC:\Windows\System32\alg.exeexecutable
MD5:710B089E4527D210CE668A5B0CE6CF58
SHA256:589ABE03A9EF8E410C3529DB8BD82C7E79969826250FFBD88A35F61BD38D9712
25689cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeexecutable
MD5:6D094D801ED3BB5DC0343C8D4CE95C61
SHA256:4C7C70431659783669DDB8FCD2D0F6802FA980523C67C08492009CADC8537003
7808maintenanceservice.exeC:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.logtext
MD5:FEE10A3714AF863A56732AD1862254F4
SHA256:AFE9E08E7A8D7254EE55106294AB13E5E0BD7BC5CDC9769EE7B9725FF4471B34
7628armsvc.exeC:\Windows\System32\msiexec.exeexecutable
MD5:E1116F52B72A3B3DB3C27CEF98589C38
SHA256:CB5B5C6AD2C1932B3507B29137CEAD3EE7D5248670D5D1533AEA2B3EE42EE2F4
7628armsvc.exeC:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeexecutable
MD5:A9C095CF5C4837A5A057B7D85A590894
SHA256:C076E79F944CC64FBE76733257BD2F3A0451D8D0347B95568CABAD7C70EA4C8A
7628armsvc.exeC:\Windows\System32\msdtc.exeexecutable
MD5:88C39B7D9742D4E21AF7D059EDB7C67B
SHA256:BB573EDA8DEB5220503727FEA0917CC0987AD156066510279311019B410B881E
7628armsvc.exeC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exeexecutable
MD5:1433B32C5DDE9D796F45EC310A5F5D67
SHA256:CDFF74693E53542EE0A429AF44D18C77752332489BA2E331CE199DECE6FFA9C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
78
TCP/UDP connections
88
DNS requests
61
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7628
armsvc.exe
POST
200
44.244.22.128:80
http://pywolwnvd.biz/jjcwhqymcjs
US
—
—
malicious
7628
armsvc.exe
POST
200
50.16.27.236:80
http://ssbzmoy.biz/olo
US
—
—
unknown
7628
armsvc.exe
POST
200
44.244.22.128:80
http://cvgrf.biz/gnjwawvrklkgnysc
US
—
—
malicious
7628
armsvc.exe
POST
200
3.229.117.57:80
http://npukfztj.biz/riuigyg
US
—
—
malicious
—
—
GET
200
23.192.36.137:443
https://www.bing.com/DSB/search?dsbmr=1&format=dsbjson&client=windowsminiserp&dsbschemaversion=1.1&dsbminiserp=1&q=q&cc=US&setlang=en-us&clientDateTime=10%2F3%2F2025%2C%205%3A47%3A41%20PM
US
binary
64.1 Kb
unknown
—
—
POST
204
23.192.36.137:443
https://www.bing.com/web/xlsc.aspx?t=5&dl=1&wsbc=1
US
—
—
unknown
—
—
POST
200
40.126.32.72:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
unknown
—
—
POST
200
40.126.32.72:443
https://login.live.com/RST2.srf
US
xml
11.2 Kb
unknown
—
—
POST
200
20.190.159.0:443
https://login.live.com/RST2.srf
US
xml
11.0 Kb
unknown
—
—
POST
200
20.190.159.128:443
https://login.live.com/RST2.srf
US
xml
11.3 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6016
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6168
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.192.36.142:443
www.bing.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7628
armsvc.exe
44.244.22.128:80
pywolwnvd.biz
AMAZON-02
US
malicious
6016
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7628
armsvc.exe
50.16.27.236:80
ssbzmoy.biz
AMAZON-AES
US
malicious
5948
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7628
armsvc.exe
3.229.117.57:80
npukfztj.biz
AMAZON-AES
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
www.bing.com
  • 23.192.36.142
  • 23.192.36.137
whitelisted
google.com
  • 172.217.16.206
whitelisted
pywolwnvd.biz
  • 44.244.22.128
malicious
ssbzmoy.biz
  • 50.16.27.236
unknown
cvgrf.biz
  • 44.244.22.128
malicious
npukfztj.biz
  • 3.229.117.57
malicious
login.live.com
  • 40.126.32.74
  • 20.190.160.2
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.138
  • 40.126.32.134
  • 20.190.160.132
  • 20.190.160.17
whitelisted
przvgke.biz
  • 172.233.219.123
  • 172.233.219.49
  • 172.237.146.8
  • 172.237.146.25
  • 172.237.146.38
  • 172.233.219.78
unknown
zlenh.biz
  • —
unknown

Threats

PID
Process
Class
Message
2428
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)
2428
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/m0yv CnC related domain (zlenh .biz)
7628
armsvc.exe
Misc activity
ET INFO Namecheap URL Forward
7628
armsvc.exe
Misc activity
ET INFO Namecheap URL Forward
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
9cb07c0bf061b82a68fda7bf908b2ae7e029333772c6b9d6ca1f94871270c458.exe