File name:

RivalMods.exe

Full analysis: https://app.any.run/tasks/a6b0f048-7338-4fae-a3b3-8bd3e1cc55c6
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: July 06, 2025, 04:48:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
telegram
lumma
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

05F9C88136CE0445F054242D2E6B4FBF

SHA1:

B71C794044A62E178270C5E415A26A7FE3362C30

SHA256:

15E29F4C6C01354665A7627319D38C7AD284DC21A6B43BDC4C9160653CD83B70

SSDEEP:

49152:V4H6hOE/04xYkoPlPRns1j+OzIpgS0MPeGQFeq/NXS0yWQUu7zLdtQjfpaVmILaE:V4H0OQ3x3118p2kQd/NX5yWQlPdtQQs8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • Shepherd.com (PID: 4044)

    • LUMMA mutex has been found

      • Shepherd.com (PID: 4044)

    • Actions looks like stealing of personal data

      • Shepherd.com (PID: 4044)

  • SUSPICIOUS

    • Get information on the list of running processes

      • cmd.exe (PID: 6240)

    • Executing commands from a ".bat" file

      • RivalMods.exe (PID: 2076)

    • Reads security settings of Internet Explorer

      • RivalMods.exe (PID: 2076)

    • The executable file from the user directory is run by the CMD process

      • Shepherd.com (PID: 4044)

    • Starts CMD.EXE for commands execution

      • RivalMods.exe (PID: 2076)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6240)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6240)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6240)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Shepherd.com (PID: 4044)

    • Searches for installed software

      • Shepherd.com (PID: 4044)

    • There is functionality for taking screenshot (YARA)

      • Shepherd.com (PID: 4044)

  • INFO

    • The sample compiled with english language support

      • RivalMods.exe (PID: 2076)

    • Reads the computer name

      • RivalMods.exe (PID: 2076)
      • extrac32.exe (PID: 5612)
      • Shepherd.com (PID: 4044)

    • Process checks computer location settings

      • RivalMods.exe (PID: 2076)

    • Create files in a temporary directory

      • RivalMods.exe (PID: 2076)
      • extrac32.exe (PID: 5612)

    • Checks supported languages

      • RivalMods.exe (PID: 2076)
      • extrac32.exe (PID: 5612)
      • Shepherd.com (PID: 4044)

    • Reads mouse settings

      • Shepherd.com (PID: 4044)

    • Reads the machine GUID from the registry

      • Shepherd.com (PID: 4044)

    • Reads the software policy settings

      • Shepherd.com (PID: 4044)
      • slui.exe (PID: 3836)

    • Application launched itself

      • chrome.exe (PID: 6376)
      • chrome.exe (PID: 2976)
      • chrome.exe (PID: 3956)
      • chrome.exe (PID: 2792)
      • msedge.exe (PID: 2804)
      • msedge.exe (PID: 1976)
      • msedge.exe (PID: 1440)
      • msedge.exe (PID: 6812)
      • msedge.exe (PID: 3860)
      • msedge.exe (PID: 3900)

    • Checks proxy server information

      • slui.exe (PID: 3836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 518656
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 8.9.7.4688
ProductVersionNumber: 8.9.7.4688
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Seamless data synchronization.
CompanyName: SyncInnovate Dynamics
FileDescription: Seamless data synchronization.
FileVersion: 8.09.7.4688
LegalCopyright: Copyright © SyncInnovate Dynamics 2010 All rights reserved.
LegalTrademarks: SwiftSync is a trademark of SyncInnovate Dynamics
ProductName: SwiftSync
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
210
Monitored processes
74
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rivalmods.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs extrac32.exe no specs findstr.exe no specs #LUMMA shepherd.com choice.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.127 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ffc455cfff8,0x7ffc455d0004,0x7ffc455d0010C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunchC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
868"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2000,i,11160831306186616481,8826467468257423311,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=1996 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1036"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=4860,i,2786145110835837740,7131265935251884773,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4876 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1136"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3620,i,7573984271558235874,12804392460481965053,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=2400,i,11160831306186616481,8826467468257423311,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=2488 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1440"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—Shepherd.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1932"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,11160831306186616481,8826467468257423311,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=3112 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1936"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2416,i,7573984271558235874,12804392460481965053,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1976"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—Shepherd.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
22 856
Read events
22 804
Write events
52
Delete events
0

Modification events

(PID) Process:(6376) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6376) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6376) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6376) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6376) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2976) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
10
Suspicious files
123
Text files
161
Unknown types
0

Dropped files

PID
Process
Filename
Type
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Have.pptmbinary
MD5:F79370414B4BAD977133115B9D147996
SHA256:E2079F00C336F0D29713B3E4DAD492EEF3BFC1E55F76C21FBA7EBE7698433121
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Straight.pptmbinary
MD5:758D7020BDAD44A9C2FAA320142724CB
SHA256:09577725C00E7580A2BBDF23184AD206BC3FBB9B9EBBB0CF7F296CACF534336C
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Trip.pptmbinary
MD5:FFC02349003F16270DF9561432CECA6F
SHA256:1E9020DFB12EAFF409847E717BF76F7D144862703FA2C205D2D44B9894DCB082
5612extrac32.exeC:\Users\admin\AppData\Local\Temp\Fleetbinary
MD5:E5857962842B21A7FF10FB26826A9C4D
SHA256:77A66437DCA61B4A6CDDD4032AA3E6F34EC4A032E45454DDCBFD4906BB5EDF6A
5612extrac32.exeC:\Users\admin\AppData\Local\Temp\Theatrebinary
MD5:994C2B5A4BC6D86CDCF4FF1D48E1BF00
SHA256:8C1D2A69EFD853F23EB8478E27B031C52DD180199C2DB3C3A01B1A092ABB0F06
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Nasdaq.pptmbinary
MD5:31277C3F56607C182F8B8DDA39EAE8E2
SHA256:D0F7CB1BAEBC8516B34CB4D045B945D7BD55701C2C61CFA9879D5732C8F30DA5
5612extrac32.exeC:\Users\admin\AppData\Local\Temp\Brieflybinary
MD5:9B78191C048489AC1FA38F39F7348D26
SHA256:5FEF3F4E3B52369BD7DC72D9A5560EF60E5C2DBD821708541026D9CC4CE19562
5612extrac32.exeC:\Users\admin\AppData\Local\Temp\Hospitalitybinary
MD5:EEA60AB02F9DF476EEA3A7832269171C
SHA256:CFCB19D7067B563FA705E90F349599BC16767BC6DC742DAB70728EE03161ED18
5612extrac32.exeC:\Users\admin\AppData\Local\Temp\Strokebinary
MD5:C9E872F8E8C9A700831D77C9895AAA01
SHA256:2A810F8A54604BA3424346FDB768330F7FDE10CD2CA99F32B846F00E4ED595F7
5612extrac32.exeC:\Users\admin\AppData\Local\Temp\Loanbinary
MD5:35EC53468364A6DA04A51F24896B0B79
SHA256:60FBA47F92AC164B7889DEBEB1E1B5A0D6CBCAA9A2042CF58764544796388986
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
94
TCP/UDP connections
164
DNS requests
123
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
SE
binary
825 b
whitelisted
—
—
GET
200
142.250.186.68:443
https://www.google.com/async/newtab_promos
US
text
29 b
whitelisted
—
—
GET
200
142.250.186.68:443
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
US
binary
128 Kb
whitelisted
—
—
GET
200
142.250.185.67:443
https://www.gstatic.com/og/_/ss/k=og.qtm.s_dlZ5UpxbM.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTtbmt94jBJE4wiLQx8WTidTulKPQw
US
text
5.08 Kb
whitelisted
1268
svchost.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
SE
binary
825 b
whitelisted
2192
RUXIMICS.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
SE
binary
825 b
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
2192
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
—
—
GET
200
149.154.167.99:443
https://t.me/xfbeh45trehgs5y4
GB
html
12.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2192
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5944
MoUsoCoreWorker.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
2192
RUXIMICS.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
eOQsYmwYeDJqeVNtIbGxQxU.eOQsYmwYeDJqeVNtIbGxQxU
  • —
unknown
t.me
  • 149.154.167.99
whitelisted
triobm.xyz
  • 144.172.115.212
unknown
clients2.google.com
  • 172.217.17.110
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 216.58.212.10
  • 216.58.212.42
  • 216.58.213.106
  • 142.251.140.10
  • 142.251.140.42
  • 142.251.140.74
  • 142.251.141.42
  • 172.217.169.170
  • 172.217.169.202
  • 142.250.184.138
  • 142.250.187.106
  • 142.250.187.138
  • 142.250.187.170
  • 172.217.17.106
  • 172.217.17.138
  • 172.217.20.74
whitelisted
clientservices.googleapis.com
  • 142.251.141.35
whitelisted

Threats

PID
Process
Class
Message
4044
Shepherd.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
—
—
Malware Command and Control Activity Detected
MALWARE [ANY.RUN] Win32/Lumma CnC HTTP Activity observed
—
—
Malware Command and Control Activity Detected
MALWARE [ANY.RUN] Win32/Lumma CnC HTTP Activity observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RivalMods.exe