File name:

prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.7z

Full analysis: https://app.any.run/tasks/906d20ab-4907-4ff0-98cc-bacbfb32c228
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 11:54:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
telegram
stealer
lumma
autoit-loader
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

174BA359E43464E18A57B85F07DA6BD8

SHA1:

BFC9AA7F4342770FFA5DA4BC4397631AAC40C133

SHA256:

04EDCC26D24FA93CA05EB2C607E6D964A3F6505EBA5818A9637A9B02A755CAF7

SSDEEP:

98304:GiQiBHIjUZAtIfPzGch9jSaJsZoWJuoCXfC5xH5UQ0Ue6UW4N33bkYq7IS3YhXcx:FAagbvOQgkw5BiFAoOmV8xdMzEzUJv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • Police.com (PID: 6620)

    • Actions looks like stealing of personal data

      • Police.com (PID: 6620)

    • Steals credentials from Web Browsers

      • Police.com (PID: 6620)

    • AutoIt loader has been detected (YARA)

      • Police.com (PID: 680)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 4572)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7592)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Application launched itself

      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 4572)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 4572)

    • Executing commands from a ".bat" file

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Get information on the list of running processes

      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 4572)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 4572)

    • The executable file from the user directory is run by the CMD process

      • Police.com (PID: 6620)
      • Police.com (PID: 680)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 4572)

    • There is functionality for taking screenshot (YARA)

      • Police.com (PID: 6620)
      • Police.com (PID: 680)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Police.com (PID: 6620)
      • Police.com (PID: 680)

    • Searches for installed software

      • Police.com (PID: 6620)

  • INFO

    • Reads the computer name

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • extrac32.exe (PID: 1532)
      • Police.com (PID: 6620)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Create files in a temporary directory

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • extrac32.exe (PID: 1532)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Checks supported languages

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • extrac32.exe (PID: 1532)
      • Police.com (PID: 6620)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Reads mouse settings

      • Police.com (PID: 6620)

    • Creates a new folder

      • cmd.exe (PID: 6108)
      • cmd.exe (PID: 8012)

    • Process checks computer location settings

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Reads the software policy settings

      • Police.com (PID: 6620)
      • slui.exe (PID: 4424)

    • Attempting to use instant messaging service

      • Police.com (PID: 6620)

    • Application launched itself

      • firefox.exe (PID: 2088)
      • firefox.exe (PID: 1180)

    • Checks proxy server information

      • slui.exe (PID: 4424)

    • Manual execution by a user

      • firefox.exe (PID: 2088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
39
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs #LUMMA police.com choice.exe no specs slui.exe rundll32.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs police.com choice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 4 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1244 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c1ed46f-8c18-4a65-880a-eba1b0603426} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 219e68e7f50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
680Police.com T C:\Users\admin\AppData\Local\Temp\497346\Police.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\497346\police.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
1132C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1180"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1532extrac32 /Y /E Dishes.mpgC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
2088"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\program files\mozilla firefox\msvcp140.dll
2140choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
2236choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
3012findstr /V "checking" Realistic C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
4424C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
18 416
Read events
18 404
Write events
12
Delete events
0

Modification events

(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.7z
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
1
Suspicious files
81
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
7592WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb7592.12553\prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe —
MD5:—
SHA256:—
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Statistics.mpgbinary
MD5:6C24A4930FC619BBAF4918D2E5ECE25F
SHA256:24EC87CF181235E79AAA88E7B203C443A5E33CF5D25E11BC00348A192F58FA04
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Small.mpgbinary
MD5:5C75A958C80A283B6E6AD60C38DC9E46
SHA256:DFEC60AD9A6CDEB14D78B9B424218E804F22AEC2A8F0F0B12B5A2D166E60F6B3
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Lithuania.mpgtext
MD5:CFCF74C912478F52EEF5D109249AE0F2
SHA256:2FD19D882075829554E6AF5C3454269320FD58F8E70279EB18FB0FF2928DC14A
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Instructor.mpgtext
MD5:B38F98F2BCEC9278700CE565B176A18B
SHA256:BEFF1D83A5FB638B3CB8FB6F87AA96070E82E22447E6C8639E37B33A7EE1B3E1
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Prefers.mpgbinary
MD5:EF6BD4EDFF3BBEDBB98B61CCF1C0E1DF
SHA256:2138037A85499B271EB5AFB015CD37652FF8E6239AA0927B720141B194F752C9
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Rec.mpgbinary
MD5:4DDDB17822C57B52816E74E67C694DE6
SHA256:261D1CB857B6F80D506079FDC877C0EB586D8289AC2E3F097AC5CB7D4B646E5B
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Pensions.mpgbinary
MD5:6A68DDBBA1CD2B7EBFBC6A2228C9CC6E
SHA256:B173E91D091EC5F721FD9B64FC82CC06C1F53D6D13B449F0E007E83B8ED40FB7
1180firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
1532extrac32.exeC:\Users\admin\AppData\Local\Temp\Disclosebinary
MD5:0C683C216602156DF07671F84DCA42A0
SHA256:9A1B90896311E5D2EA3E0A42B92F777198D3129014D38B65ACCBF3FD55846CF9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
62
DNS requests
85
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
216.58.206.35:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1276
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
184.24.77.83:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
216.58.206.35:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
184.24.77.80:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
184.24.77.80:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
184.24.77.83:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
184.24.77.80:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1512
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.65
  • 20.190.160.17
  • 20.190.160.2
  • 20.190.160.20
  • 20.190.160.3
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
KkohxloJqyIpvzOKGSXHiPhpSSuH.KkohxloJqyIpvzOKGSXHiPhpSSuH
  • —
unknown

Threats

PID
Process
Class
Message
6620
Police.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
680
Police.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.7z