File name:

prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.7z

Full analysis: https://app.any.run/tasks/906d20ab-4907-4ff0-98cc-bacbfb32c228
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 11:54:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
telegram
stealer
lumma
autoit-loader
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

174BA359E43464E18A57B85F07DA6BD8

SHA1:

BFC9AA7F4342770FFA5DA4BC4397631AAC40C133

SHA256:

04EDCC26D24FA93CA05EB2C607E6D964A3F6505EBA5818A9637A9B02A755CAF7

SSDEEP:

98304:GiQiBHIjUZAtIfPzGch9jSaJsZoWJuoCXfC5xH5UQ0Ue6UW4N33bkYq7IS3YhXcx:FAagbvOQgkw5BiFAoOmV8xdMzEzUJv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Police.com (PID: 6620)

    • LUMMA mutex has been found

      • Police.com (PID: 6620)

    • Steals credentials from Web Browsers

      • Police.com (PID: 6620)

    • AutoIt loader has been detected (YARA)

      • Police.com (PID: 680)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7592)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Starts CMD.EXE for commands execution

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • cmd.exe (PID: 7952)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)
      • cmd.exe (PID: 4572)

    • Executing commands from a ".bat" file

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Get information on the list of running processes

      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 4572)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 4572)

    • Application launched itself

      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 4572)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 4572)

    • The executable file from the user directory is run by the CMD process

      • Police.com (PID: 6620)
      • Police.com (PID: 680)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 4572)

    • There is functionality for taking screenshot (YARA)

      • Police.com (PID: 6620)
      • Police.com (PID: 680)

    • Searches for installed software

      • Police.com (PID: 6620)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Police.com (PID: 6620)
      • Police.com (PID: 680)

  • INFO

    • Create files in a temporary directory

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • extrac32.exe (PID: 1532)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Checks supported languages

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • extrac32.exe (PID: 1532)
      • Police.com (PID: 6620)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Reads the computer name

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • extrac32.exe (PID: 1532)
      • Police.com (PID: 6620)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Process checks computer location settings

      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7892)
      • prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe (PID: 7156)

    • Creates a new folder

      • cmd.exe (PID: 6108)
      • cmd.exe (PID: 8012)

    • Reads mouse settings

      • Police.com (PID: 6620)

    • Application launched itself

      • firefox.exe (PID: 2088)
      • firefox.exe (PID: 1180)

    • Reads the software policy settings

      • slui.exe (PID: 4424)
      • Police.com (PID: 6620)

    • Manual execution by a user

      • firefox.exe (PID: 2088)

    • Checks proxy server information

      • slui.exe (PID: 4424)

    • Attempting to use instant messaging service

      • Police.com (PID: 6620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
39
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs #LUMMA police.com choice.exe no specs slui.exe rundll32.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs police.com choice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 4 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1244 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c1ed46f-8c18-4a65-880a-eba1b0603426} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 219e68e7f50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
680Police.com T C:\Users\admin\AppData\Local\Temp\497346\Police.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\497346\police.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
1132C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1180"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1532extrac32 /Y /E Dishes.mpgC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
2088"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\program files\mozilla firefox\msvcp140.dll
2140choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
2236choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
3012findstr /V "checking" Realistic C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
4424C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
18 416
Read events
18 404
Write events
12
Delete events
0

Modification events

(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.7z
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
1
Suspicious files
81
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
7592WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb7592.12553\prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exe —
MD5:—
SHA256:—
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Statistics.mpgbinary
MD5:6C24A4930FC619BBAF4918D2E5ECE25F
SHA256:24EC87CF181235E79AAA88E7B203C443A5E33CF5D25E11BC00348A192F58FA04
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Rec.mpgbinary
MD5:4DDDB17822C57B52816E74E67C694DE6
SHA256:261D1CB857B6F80D506079FDC877C0EB586D8289AC2E3F097AC5CB7D4B646E5B
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Instructor.mpgtext
MD5:B38F98F2BCEC9278700CE565B176A18B
SHA256:BEFF1D83A5FB638B3CB8FB6F87AA96070E82E22447E6C8639E37B33A7EE1B3E1
7952cmd.exeC:\Users\admin\AppData\Local\Temp\Lithuania.mpg.battext
MD5:CFCF74C912478F52EEF5D109249AE0F2
SHA256:2FD19D882075829554E6AF5C3454269320FD58F8E70279EB18FB0FF2928DC14A
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Pensions.mpgbinary
MD5:6A68DDBBA1CD2B7EBFBC6A2228C9CC6E
SHA256:B173E91D091EC5F721FD9B64FC82CC06C1F53D6D13B449F0E007E83B8ED40FB7
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Genius.mpgbinary
MD5:9883842A781BA15AF904654D31BD4832
SHA256:9CE0BC2F009A71AA620B2835A36DADD3D09FA5A0683FB36D5B3103331B277E9F
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Lithuania.mpgtext
MD5:CFCF74C912478F52EEF5D109249AE0F2
SHA256:2FD19D882075829554E6AF5C3454269320FD58F8E70279EB18FB0FF2928DC14A
1180firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
7892prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.exeC:\Users\admin\AppData\Local\Temp\Dishes.mpgcompressed
MD5:2315EA1CFE6A661D27CF6BD1D8FF56A1
SHA256:8D42625A02563B4B512DE1166888E69A4B4A3C55604EEA959DC9CCDAAB3D7E71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
62
DNS requests
85
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1276
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1276
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1180
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
1180
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
216.58.206.35:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
184.24.77.80:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
184.24.77.83:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
184.24.77.80:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
1180
firefox.exe
POST
200
184.24.77.83:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1512
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.65
  • 20.190.160.17
  • 20.190.160.2
  • 20.190.160.20
  • 20.190.160.3
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
KkohxloJqyIpvzOKGSXHiPhpSSuH.KkohxloJqyIpvzOKGSXHiPhpSSuH
  • —
unknown

Threats

PID
Process
Class
Message
6620
Police.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
680
Police.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
prüfungstraining_goethe_zertifikat_b1_cornelsen_pdf.7z