File name:

Live.exe

Full analysis: https://app.any.run/tasks/946cb367-0320-4b67-bdda-99f7e14c08c0
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 09, 2025, 21:34:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
m0yv
themida
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 12 sections
MD5:

F9EDA08739249C98565F1DE79091D63C

SHA1:

6DD81B815B462DA1497ABD28CB1CF7A8DB6BD9A1

SHA256:

A663F53559230F7793D17C659D039E3B2A2F8F6BC2055B1458E3C609D6F1238B

SSDEEP:

98304:FPcjaIaOr3NTPW966ZOCmwtGp5OwU2gBBu9fzwtBMhvAemLppUJoZaE4Y4CRxkOn:FrFd0G8OWt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • Live.exe (PID: 6988)
      • armsvc.exe (PID: 6048)
      • FlashPlayerUpdateService.exe (PID: 5096)
      • alg.exe (PID: 6240)
      • AppVClient.exe (PID: 5776)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 5228)
      • FXSSVC.exe (PID: 5720)
      • elevation_service.exe (PID: 7960)
      • GoogleUpdate.exe (PID: 7232)
      • GoogleUpdate.exe (PID: 6876)
      • elevation_service.exe (PID: 864)
      • maintenanceservice.exe (PID: 8168)
      • msdtc.exe (PID: 7456)
      • GoogleUpdate.exe (PID: 7580)
      • GoogleUpdate.exe (PID: 7724)
      • PerceptionSimulationService.exe (PID: 7880)
      • perfhost.exe (PID: 1672)
      • PSEXESVC.exe (PID: 2432)
      • Locator.exe (PID: 208)
      • ssh-agent.exe (PID: 7964)
      • Spectrum.exe (PID: 7984)
      • TieringEngineService.exe (PID: 5116)
      • snmptrap.exe (PID: 7204)
      • AgentService.exe (PID: 8032)
      • vds.exe (PID: 7544)
      • wbengine.exe (PID: 7036)
      • VSSVC.exe (PID: 6712)
      • WmiApSrv.exe (PID: 8236)
      • SearchIndexer.exe (PID: 8300)
      • GoogleUpdate.exe (PID: 9164)
      • SensorDataService.exe (PID: 7012)

    • M0YV has been detected (YARA)

      • Live.exe (PID: 6988)

  • SUSPICIOUS

    • Executes as Windows Service

      • armsvc.exe (PID: 6048)
      • FlashPlayerUpdateService.exe (PID: 5096)
      • MicrosoftEdgeUpdate.exe (PID: 6828)
      • alg.exe (PID: 6240)
      • AppVClient.exe (PID: 5776)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 5228)
      • FXSSVC.exe (PID: 5720)
      • GoogleUpdate.exe (PID: 7232)
      • GameInputSvc.exe (PID: 7576)
      • maintenanceservice.exe (PID: 8168)
      • msdtc.exe (PID: 7456)
      • PerceptionSimulationService.exe (PID: 7880)
      • perfhost.exe (PID: 1672)
      • MicrosoftEdgeUpdate.exe (PID: 6980)
      • PSEXESVC.exe (PID: 2432)
      • Locator.exe (PID: 208)
      • ssh-agent.exe (PID: 7964)
      • Spectrum.exe (PID: 7984)
      • snmptrap.exe (PID: 7204)
      • TieringEngineService.exe (PID: 5116)
      • SensorDataService.exe (PID: 7012)
      • AgentService.exe (PID: 8032)
      • vds.exe (PID: 7544)
      • VSSVC.exe (PID: 6712)
      • wbengine.exe (PID: 7036)
      • WmiApSrv.exe (PID: 8236)
      • GoogleUpdate.exe (PID: 9164)

    • Reads the BIOS version

      • Live.exe (PID: 6988)

    • Application launched itself

      • MicrosoftEdgeUpdate.exe (PID: 6828)
      • MicrosoftEdgeUpdate.exe (PID: 7888)
      • GameInputSvc.exe (PID: 7576)
      • GoogleUpdate.exe (PID: 7232)
      • GoogleUpdate.exe (PID: 6876)
      • setup.exe (PID: 6800)
      • MicrosoftEdgeUpdate.exe (PID: 6980)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2568)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8152)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7288)
      • MicrosoftEdgeUpdate.exe (PID: 3996)

    • Process drops legitimate windows executable

      • Live.exe (PID: 6988)
      • MicrosoftEdge_X64_137.0.3296.68.exe (PID: 7992)

    • Process requests binary or script from the Internet

      • svchost.exe (PID: 4844)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 4844)

    • Executable content was dropped or overwritten

      • MicrosoftEdge_X64_137.0.3296.68.exe (PID: 7992)
      • Live.exe (PID: 6988)

  • INFO

    • Creates files or folders in the user directory

      • Live.exe (PID: 6988)
      • GoogleUpdate.exe (PID: 7724)

    • Checks supported languages

      • Live.exe (PID: 6988)
      • armsvc.exe (PID: 6048)
      • FlashPlayerUpdateService.exe (PID: 5096)
      • MicrosoftEdgeUpdate.exe (PID: 7888)
      • MicrosoftEdgeUpdate.exe (PID: 6828)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2568)
      • MicrosoftEdgeUpdate.exe (PID: 3996)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8152)
      • elevation_service.exe (PID: 7960)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7288)
      • GoogleUpdate.exe (PID: 7232)
      • GoogleUpdate.exe (PID: 6876)
      • MicrosoftEdgeUpdate.exe (PID: 7292)
      • elevation_service.exe (PID: 864)
      • maintenanceservice.exe (PID: 8168)
      • GoogleCrashHandler.exe (PID: 7872)
      • GoogleUpdate.exe (PID: 7724)
      • GoogleCrashHandler64.exe (PID: 6960)
      • GoogleUpdate.exe (PID: 7580)
      • PSEXESVC.exe (PID: 2432)
      • ssh-agent.exe (PID: 7964)
      • MicrosoftEdgeUpdate.exe (PID: 6980)
      • GoogleUpdate.exe (PID: 9164)
      • MicrosoftEdgeUpdate.exe (PID: 6820)

    • Reads the computer name

      • Live.exe (PID: 6988)
      • armsvc.exe (PID: 6048)
      • FlashPlayerUpdateService.exe (PID: 5096)
      • MicrosoftEdgeUpdate.exe (PID: 7888)
      • MicrosoftEdgeUpdate.exe (PID: 6828)
      • MicrosoftEdgeUpdate.exe (PID: 3996)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2568)
      • elevation_service.exe (PID: 7960)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8152)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7288)
      • GoogleUpdate.exe (PID: 6876)
      • MicrosoftEdgeUpdate.exe (PID: 7292)
      • elevation_service.exe (PID: 864)
      • GoogleUpdate.exe (PID: 7232)
      • maintenanceservice.exe (PID: 8168)
      • GoogleUpdate.exe (PID: 7580)
      • GoogleCrashHandler.exe (PID: 7872)
      • GoogleCrashHandler64.exe (PID: 6960)
      • GoogleUpdate.exe (PID: 7724)
      • MicrosoftEdgeUpdate.exe (PID: 6980)
      • PSEXESVC.exe (PID: 2432)
      • ssh-agent.exe (PID: 7964)
      • MicrosoftEdgeUpdate.exe (PID: 6820)
      • GoogleUpdate.exe (PID: 9164)

    • Process checks whether UAC notifications are on

      • Live.exe (PID: 6988)

    • Creates files in the program directory

      • FXSSVC.exe (PID: 5720)
      • GoogleUpdate.exe (PID: 7232)
      • GoogleUpdate.exe (PID: 6876)
      • maintenanceservice.exe (PID: 8168)
      • GoogleUpdate.exe (PID: 7724)
      • GoogleUpdate.exe (PID: 7580)
      • GoogleUpdate.exe (PID: 9164)
      • SearchIndexer.exe (PID: 8300)

    • Executes as Windows Service

      • elevation_service.exe (PID: 7960)
      • elevation_service.exe (PID: 864)
      • SearchIndexer.exe (PID: 8300)

    • Reads the software policy settings

      • GameInputSvc.exe (PID: 1328)
      • GoogleUpdate.exe (PID: 7724)
      • MicrosoftEdgeUpdate.exe (PID: 6820)
      • MicrosoftEdgeUpdate.exe (PID: 6980)
      • GoogleUpdate.exe (PID: 9164)

    • Checks proxy server information

      • Live.exe (PID: 6988)

    • Checks transactions between databases Windows and Oracle

      • msdtc.exe (PID: 7456)

    • The sample compiled with english language support

      • Live.exe (PID: 6988)
      • MicrosoftEdge_X64_137.0.3296.68.exe (PID: 7992)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 6820)

    • Reads the time zone

      • TieringEngineService.exe (PID: 5116)

    • Themida protector has been detected

      • Live.exe (PID: 6988)

    • The sample compiled with bulgarian language support

      • Live.exe (PID: 6988)

    • Create files in a temporary directory

      • svchost.exe (PID: 4844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:04:04 06:52:22+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 594944
InitializedDataSize: 1881088
UninitializedDataSize: -
EntryPoint: 0x8a3058
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
186
Monitored processes
56
Malicious processes
32
Suspicious processes
3

Behavior graph

Click at the process to see the details
start #M0YV live.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe #M0YV armsvc.exe #M0YV flashplayerupdateservice.exe no specs #M0YV alg.exe no specs #M0YV appvclient.exe no specs #M0YV diagnosticshub.standardcollector.service.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV fxssvc.exe no specs gameinputsvc.exe no specs gameinputsvc.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV elevation_service.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV googleupdate.exe no specs microsoftedgeupdate.exe no specs #M0YV googleupdate.exe no specs #M0YV elevation_service.exe no specs #M0YV googleupdate.exe googlecrashhandler.exe no specs #M0YV maintenanceservice.exe no specs googlecrashhandler64.exe no specs #M0YV msdtc.exe no specs #M0YV googleupdate.exe no specs #M0YV perceptionsimulationservice.exe no specs #M0YV perfhost.exe no specs microsoftedgeupdate.exe #M0YV psexesvc.exe no specs #M0YV locator.exe no specs #M0YV sensordataservice.exe no specs microsoftedgeupdate.exe #M0YV snmptrap.exe no specs #M0YV spectrum.exe no specs #M0YV ssh-agent.exe no specs #M0YV tieringengineservice.exe no specs #M0YV agentservice.exe no specs #M0YV vds.exe no specs #M0YV vssvc.exe no specs #M0YV wbengine.exe no specs #M0YV wmiapsrv.exe no specs #M0YV searchindexer.exe no specs Delivery Optimization User no specs #M0YV googleupdate.exe svchost.exe searchprotocolhost.exe no specs searchfilterhost.exe no specs microsoftedge_x64_137.0.3296.68.exe setup.exe no specs setup.exe no specs svchost.exe live.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\WINDOWS\system32\locator.exeC:\Windows\System32\Locator.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Rpc Locator
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\locator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
864"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\elevation_service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
1328"C:\WINDOWS\System32\GameInputSvc.exe" Global\GameInputSession_5C:\Windows\System32\GameInputSvc.exe—GameInputSvc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
GameInput Host Service
Version:
0.2309.19041.4046
Modules
Images
c:\windows\system32\gameinputsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\wintrust.dll
1672C:\WINDOWS\SysWow64\perfhost.exeC:\Windows\SysWOW64\perfhost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
x86 Performance Counter Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\perfhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2432C:\WINDOWS\PSEXESVC.exeC:\Windows\PSEXESVC.exe
services.exe
User:
SYSTEM
Company:
Sysinternals
Integrity Level:
SYSTEM
Description:
PsExec Service
Version:
2.34
Modules
Images
c:\windows\psexesvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2568"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateComRegisterShell64.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3208"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3364\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Live.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3996"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.147.37
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
Total events
20 672
Read events
18 474
Write events
2 133
Delete events
65

Modification events

(PID) Process:(6048) armsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Adobe\Adobe ARM\1.0\ARM
Operation:writeName:iLastSvcSuccess
Value:
1177796
(PID) Process:(3996) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(3996) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(3996) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25D72A6A-8A84-4E25-886B-02FD23A7A104}\InprocHandler32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(3996) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{491B3F26-48E7-4BF4-9079-EEAC5D81371F}\InProcServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(3996) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(3996) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}
Operation:delete keyName:(default)
Value:
(PID) Process:(3996) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(3996) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}
Operation:delete keyName:(default)
Value:
(PID) Process:(3996) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25D72A6A-8A84-4E25-886B-02FD23A7A104}\InprocHandler32
Operation:delete keyName:(default)
Value:
Executable files
146
Suspicious files
4
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6988Live.exeC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeexecutable
MD5:D889844E970DB7D51977E327C84253EA
SHA256:7390721FD762118F7BE9E529B11F232DB4BF3E2BA3948CEDA970435E7810985B
6048armsvc.exeC:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:3689075D64761B8849AC5E2AAAE0BE86
SHA256:EA7637CDDBB97AC8ED528F1009372662EEE326C8B259EB48D3403E25311A13ED
6988Live.exeC:\Users\admin\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:A4E0B8099DC1780912314E87E4A598B1
SHA256:DF1E052A5ECC6B6BC9662BB31FAAA622F757082E6BDAEB05915008771978C347
6988Live.exeC:\Windows\System32\alg.exeexecutable
MD5:8BBDE628B6774E59324EE0EE954B8755
SHA256:3A907C3B2222E3F72CBAB6EC9ED62DFE21A4E21146D87D6A47D2214517E8DC68
6988Live.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeexecutable
MD5:B782ED38A9F83F9E474BF279137C68A7
SHA256:50E2E34E5D25B6D5083BEF0B56E65A501DECE5E9C8FA1343F1A9049C0F635A25
6828MicrosoftEdgeUpdate.exeC:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.logtext
MD5:A9C92846B93AC472B703EC0485FD6D15
SHA256:A73E359371905D879849615181E5214B757D1B51B8EF3C1416B9245F25F299A4
6988Live.exeC:\Windows\System32\msdtc.exeexecutable
MD5:AC25CB9271F38363E91D2C5374C70CF9
SHA256:DDE8E3F87EAC9100679AE90FEE45CAF8BE5879867C91C07F373A47C759F44F85
6988Live.exeC:\Windows\System32\AppVClient.exeexecutable
MD5:67E0F898F3223D5200293EE81751ED28
SHA256:7D0C3BAC0B2B1D0A0CFBFC11E50B89D7A24B26CEEF3F5261191DA15862E4908A
6988Live.exeC:\Windows\System32\FXSSVC.exeexecutable
MD5:4BC39221F8CC5C4273A874066BB56F92
SHA256:54618963CBB311CC1BAE1A7F104DFC51B159833DB15FD2DC8CC352E388B438F1
6988Live.exeC:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeexecutable
MD5:608EF0FEF4ABA8C3B31E6EDA9E99BA2F
SHA256:CA64E35AC14F52FF46204A8EA0FC5BC2820A99E24A34DEC526A39FB7ADE8D7D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
210
TCP/UDP connections
53
DNS requests
41
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8280
svchost.exe
GET
206
128.251.172.10:80
http://128.251.172.10/filestreamingservice/files/dd10bb14-d22e-42e7-9282-77f2eefe7577?P1=1750109704&P2=404&P3=2&P4=C%2boV4PwM4ng0LK%2fWS%2b2UaSAb2%2bAwxREdG127O9kvGv%2fxBv31vcpxlbMjxi%2bMSIpUfIe2NmTxGgqYdILr5bypwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
unknown
—
—
unknown
8280
svchost.exe
GET
206
128.251.172.10:80
http://128.251.172.10/filestreamingservice/files/dd10bb14-d22e-42e7-9282-77f2eefe7577?P1=1750109704&P2=404&P3=2&P4=C%2boV4PwM4ng0LK%2fWS%2b2UaSAb2%2bAwxREdG127O9kvGv%2fxBv31vcpxlbMjxi%2bMSIpUfIe2NmTxGgqYdILr5bypwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
unknown
—
—
unknown
8280
svchost.exe
GET
206
128.251.172.10:80
http://128.251.172.10/filestreamingservice/files/dd10bb14-d22e-42e7-9282-77f2eefe7577?P1=1750109704&P2=404&P3=2&P4=C%2boV4PwM4ng0LK%2fWS%2b2UaSAb2%2bAwxREdG127O9kvGv%2fxBv31vcpxlbMjxi%2bMSIpUfIe2NmTxGgqYdILr5bypwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
unknown
—
—
unknown
8280
svchost.exe
GET
206
128.251.172.10:80
http://128.251.172.10/filestreamingservice/files/dd10bb14-d22e-42e7-9282-77f2eefe7577?P1=1750109704&P2=404&P3=2&P4=C%2boV4PwM4ng0LK%2fWS%2b2UaSAb2%2bAwxREdG127O9kvGv%2fxBv31vcpxlbMjxi%2bMSIpUfIe2NmTxGgqYdILr5bypwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
unknown
—
—
unknown
8280
svchost.exe
GET
206
128.251.172.10:80
http://128.251.172.10/filestreamingservice/files/dd10bb14-d22e-42e7-9282-77f2eefe7577?P1=1750109704&P2=404&P3=2&P4=C%2boV4PwM4ng0LK%2fWS%2b2UaSAb2%2bAwxREdG127O9kvGv%2fxBv31vcpxlbMjxi%2bMSIpUfIe2NmTxGgqYdILr5bypwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
unknown
—
—
unknown
8280
svchost.exe
GET
206
128.251.172.10:80
http://128.251.172.10/filestreamingservice/files/dd10bb14-d22e-42e7-9282-77f2eefe7577?P1=1750109704&P2=404&P3=2&P4=C%2boV4PwM4ng0LK%2fWS%2b2UaSAb2%2bAwxREdG127O9kvGv%2fxBv31vcpxlbMjxi%2bMSIpUfIe2NmTxGgqYdILr5bypwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
unknown
—
—
unknown
8280
svchost.exe
GET
206
128.251.172.10:80
http://128.251.172.10/filestreamingservice/files/dd10bb14-d22e-42e7-9282-77f2eefe7577?P1=1750109704&P2=404&P3=2&P4=C%2boV4PwM4ng0LK%2fWS%2b2UaSAb2%2bAwxREdG127O9kvGv%2fxBv31vcpxlbMjxi%2bMSIpUfIe2NmTxGgqYdILr5bypwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
unknown
—
—
unknown
8280
svchost.exe
GET
206
128.251.172.10:80
http://128.251.172.10/filestreamingservice/files/dd10bb14-d22e-42e7-9282-77f2eefe7577?P1=1750109704&P2=404&P3=2&P4=C%2boV4PwM4ng0LK%2fWS%2b2UaSAb2%2bAwxREdG127O9kvGv%2fxBv31vcpxlbMjxi%2bMSIpUfIe2NmTxGgqYdILr5bypwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
unknown
—
—
unknown
—
—
GET
200
23.216.77.34:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6544
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.34:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4164
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6988
Live.exe
52.11.240.239:80
pywolwnvd.biz
AMAZON-02
US
malicious
6048
armsvc.exe
52.11.240.239:80
pywolwnvd.biz
AMAZON-02
US
malicious
6048
armsvc.exe
18.234.103.197:80
ssbzmoy.biz
AMAZON-AES
US
malicious

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.73
  • 40.126.31.129
  • 40.126.31.71
  • 20.190.159.130
  • 20.190.159.71
  • 20.190.159.131
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.216.77.34
  • 23.216.77.30
  • 23.216.77.33
  • 23.216.77.27
  • 23.216.77.28
  • 23.216.77.25
  • 23.216.77.29
  • 23.216.77.35
  • 23.216.77.32
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
pywolwnvd.biz
  • 52.11.240.239
malicious
ssbzmoy.biz
  • 18.234.103.197
unknown
cvgrf.biz
  • 52.11.240.239
malicious
clients2.google.com
  • 142.250.74.206
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
msedge.api.cdp.microsoft.com
  • 4.175.87.113
whitelisted

Threats

PID
Process
Class
Message
4844
svchost.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4844
svchost.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2196
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)
2196
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)
6048
armsvc.exe
Misc activity
ET INFO Namecheap URL Forward
6988
Live.exe
Misc activity
ET INFO Namecheap URL Forward
6048
armsvc.exe
Misc activity
ET INFO Namecheap URL Forward
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Live.exe