File name:

RivalMods.exe

Full analysis: https://app.any.run/tasks/a6b0f048-7338-4fae-a3b3-8bd3e1cc55c6
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: July 06, 2025, 04:48:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
telegram
lumma
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

05F9C88136CE0445F054242D2E6B4FBF

SHA1:

B71C794044A62E178270C5E415A26A7FE3362C30

SHA256:

15E29F4C6C01354665A7627319D38C7AD284DC21A6B43BDC4C9160653CD83B70

SSDEEP:

49152:V4H6hOE/04xYkoPlPRns1j+OzIpgS0MPeGQFeq/NXS0yWQUu7zLdtQjfpaVmILaE:V4H0OQ3x3118p2kQd/NX5yWQlPdtQQs8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • Shepherd.com (PID: 4044)

    • Actions looks like stealing of personal data

      • Shepherd.com (PID: 4044)

    • Steals credentials from Web Browsers

      • Shepherd.com (PID: 4044)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • RivalMods.exe (PID: 2076)

    • Executing commands from a ".bat" file

      • RivalMods.exe (PID: 2076)

    • Starts CMD.EXE for commands execution

      • RivalMods.exe (PID: 2076)

    • Get information on the list of running processes

      • cmd.exe (PID: 6240)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6240)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6240)

    • The executable file from the user directory is run by the CMD process

      • Shepherd.com (PID: 4044)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6240)

    • There is functionality for taking screenshot (YARA)

      • Shepherd.com (PID: 4044)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Shepherd.com (PID: 4044)

    • Searches for installed software

      • Shepherd.com (PID: 4044)

  • INFO

    • The sample compiled with english language support

      • RivalMods.exe (PID: 2076)

    • Checks supported languages

      • RivalMods.exe (PID: 2076)
      • extrac32.exe (PID: 5612)
      • Shepherd.com (PID: 4044)

    • Reads the computer name

      • RivalMods.exe (PID: 2076)
      • extrac32.exe (PID: 5612)
      • Shepherd.com (PID: 4044)

    • Process checks computer location settings

      • RivalMods.exe (PID: 2076)

    • Create files in a temporary directory

      • RivalMods.exe (PID: 2076)
      • extrac32.exe (PID: 5612)

    • Reads mouse settings

      • Shepherd.com (PID: 4044)

    • Reads the machine GUID from the registry

      • Shepherd.com (PID: 4044)

    • Reads the software policy settings

      • Shepherd.com (PID: 4044)
      • slui.exe (PID: 3836)

    • Application launched itself

      • chrome.exe (PID: 6376)
      • chrome.exe (PID: 2976)
      • chrome.exe (PID: 2792)
      • chrome.exe (PID: 3956)
      • msedge.exe (PID: 1440)
      • msedge.exe (PID: 1976)
      • msedge.exe (PID: 2804)
      • msedge.exe (PID: 3860)
      • msedge.exe (PID: 6812)
      • msedge.exe (PID: 3900)

    • Checks proxy server information

      • slui.exe (PID: 3836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 518656
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 8.9.7.4688
ProductVersionNumber: 8.9.7.4688
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Seamless data synchronization.
CompanyName: SyncInnovate Dynamics
FileDescription: Seamless data synchronization.
FileVersion: 8.09.7.4688
LegalCopyright: Copyright © SyncInnovate Dynamics 2010 All rights reserved.
LegalTrademarks: SwiftSync is a trademark of SyncInnovate Dynamics
ProductName: SwiftSync
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
210
Monitored processes
74
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rivalmods.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs extrac32.exe no specs findstr.exe no specs #LUMMA shepherd.com choice.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.127 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ffc455cfff8,0x7ffc455d0004,0x7ffc455d0010C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunchC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
868"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2000,i,11160831306186616481,8826467468257423311,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=1996 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1036"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=4860,i,2786145110835837740,7131265935251884773,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4876 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1136"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3620,i,7573984271558235874,12804392460481965053,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=2400,i,11160831306186616481,8826467468257423311,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=2488 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1440"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—Shepherd.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1932"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,11160831306186616481,8826467468257423311,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=3112 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1936"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2416,i,7573984271558235874,12804392460481965053,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1976"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—Shepherd.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
22 856
Read events
22 804
Write events
52
Delete events
0

Modification events

(PID) Process:(6376) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6376) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6376) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6376) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6376) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2976) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
10
Suspicious files
123
Text files
161
Unknown types
0

Dropped files

PID
Process
Filename
Type
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Have.pptmbinary
MD5:F79370414B4BAD977133115B9D147996
SHA256:E2079F00C336F0D29713B3E4DAD492EEF3BFC1E55F76C21FBA7EBE7698433121
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Nv.pptmbinary
MD5:E00E479B7A05F6C2075514CC449A2D60
SHA256:2E19C46579BB86A1B115B44EBBA3F0EDB204EF2BC70A52E9F19E356D92B338F4
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Trip.pptmbinary
MD5:FFC02349003F16270DF9561432CECA6F
SHA256:1E9020DFB12EAFF409847E717BF76F7D144862703FA2C205D2D44B9894DCB082
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Boxes.pptmtext
MD5:9F56F1C92FA96DE6010AA153FC2B6B34
SHA256:07EC1F4B2FA86A35FDE9FD7608556ABAC8C84E215184B1AEB1FD9625CB3AAC48
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Straight.pptmbinary
MD5:758D7020BDAD44A9C2FAA320142724CB
SHA256:09577725C00E7580A2BBDF23184AD206BC3FBB9B9EBBB0CF7F296CACF534336C
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Nasdaq.pptmbinary
MD5:31277C3F56607C182F8B8DDA39EAE8E2
SHA256:D0F7CB1BAEBC8516B34CB4D045B945D7BD55701C2C61CFA9879D5732C8F30DA5
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Mel.pptmbinary
MD5:A8312619CC510B48C2029A579E9D3DAC
SHA256:422EED1EF27B6AA6365BAD52585B30F19EE85589CDC427DFD016947DC01BCF2E
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Participate.pptmbinary
MD5:1C03A606BB36C5E97E38662E217ACC89
SHA256:406C4A2C091E30CDB84A799AD5B5BCAF04CB4A1B625908D279ABFFA5EA3D83BC
6240cmd.exeC:\Users\admin\AppData\Local\Temp\Boxes.pptm.battext
MD5:9F56F1C92FA96DE6010AA153FC2B6B34
SHA256:07EC1F4B2FA86A35FDE9FD7608556ABAC8C84E215184B1AEB1FD9625CB3AAC48
2076RivalMods.exeC:\Users\admin\AppData\Local\Temp\Vacancies.pptmbinary
MD5:A4C527C5CD22D569E9C6CC74AB4E859E
SHA256:93EEE4007A38A04E3EB8A00B0CA2F37B1F017F3F87F920DC0BA874BFA1255181
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
94
TCP/UDP connections
164
DNS requests
123
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2192
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2192
RUXIMICS.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
200
144.172.115.212:443
https://triobm.xyz/tapw
unknown
binary
32.8 Kb
—
—
—
GET
200
149.154.167.99:443
https://t.me/xfbeh45trehgs5y4
unknown
html
12.0 Kb
whitelisted
—
—
GET
200
142.250.184.227:443
https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=133
unknown
compressed
61.3 Kb
whitelisted
7160
chrome.exe
GET
200
172.217.17.110:80
http://clients2.google.com/time/1/current?cup2key=8:c8TtLsu1TmprXNRgIW06NqIQHOx70R1m2B0kuvWo3Q4&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2192
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5944
MoUsoCoreWorker.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
2192
RUXIMICS.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
eOQsYmwYeDJqeVNtIbGxQxU.eOQsYmwYeDJqeVNtIbGxQxU
  • —
unknown
t.me
  • 149.154.167.99
whitelisted
triobm.xyz
  • 144.172.115.212
unknown
clients2.google.com
  • 172.217.17.110
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 216.58.212.10
  • 216.58.212.42
  • 216.58.213.106
  • 142.251.140.10
  • 142.251.140.42
  • 142.251.140.74
  • 142.251.141.42
  • 172.217.169.170
  • 172.217.169.202
  • 142.250.184.138
  • 142.250.187.106
  • 142.250.187.138
  • 142.250.187.170
  • 172.217.17.106
  • 172.217.17.138
  • 172.217.20.74
whitelisted
clientservices.googleapis.com
  • 142.251.141.35
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
—
—
Malware Command and Control Activity Detected
MALWARE [ANY.RUN] Win32/Lumma CnC HTTP Activity observed
—
—
Malware Command and Control Activity Detected
MALWARE [ANY.RUN] Win32/Lumma CnC HTTP Activity observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RivalMods.exe