File name:

32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip

Full analysis: https://app.any.run/tasks/6424db10-3ae9-497e-9def-8224330f1cd0
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 30, 2024, 05:40:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
lumma
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

998178BB2BE569E7A687D0B8B376F8F6

SHA1:

2C70C65FAFE88CEF60E7AA5C66072DB15A6F4CA9

SHA256:

32D6143840ACF1F5F095070FC6F6661D8A5F70D790A8149639C6976FB1700902

SSDEEP:

98304:5vANRpdr8ZxgQhmMNDizOyKCBFGk8U99YYBoqSYieepv/KMEmdxNhlep2+uGb27V:pS4vxn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe (PID: 1140)

    • Steals credentials from Web Browsers

      • 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe (PID: 1140)

    • LUMMA has been detected (YARA)

      • 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe (PID: 1140)

    • Actions looks like stealing of personal data

      • 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe (PID: 1140)

    • Executing a file with an untrusted certificate

      • I3JM6UVLQVEXSCGW3N47X.exe (PID: 4388)
      • I3JM6UVLQVEXSCGW3N47X.exe (PID: 5308)

    • Antivirus name has been found in the command line (generic signature)

      • cmd.exe (PID: 3608)
      • tasklist.exe (PID: 3664)
      • find.exe (PID: 1596)
      • tasklist.exe (PID: 536)
      • cmd.exe (PID: 3140)
      • cmd.exe (PID: 5872)
      • tasklist.exe (PID: 5036)
      • find.exe (PID: 4528)
      • cmd.exe (PID: 6032)
      • tasklist.exe (PID: 432)
      • find.exe (PID: 1916)
      • cmd.exe (PID: 2456)
      • find.exe (PID: 3912)
      • tasklist.exe (PID: 4556)
      • find.exe (PID: 1796)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe (PID: 1140)
      • I3JM6UVLQVEXSCGW3N47X.exe (PID: 4388)
      • I3JM6UVLQVEXSCGW3N47X.exe (PID: 5308)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 3420)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)

    • Reads the Windows owner or organization settings

      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 3420)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)

    • Reads security settings of Internet Explorer

      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 3420)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)

    • Starts CMD.EXE for commands execution

      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)

    • Uses TIMEOUT.EXE to delay execution

      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)

    • Get information on the list of running processes

      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)
      • cmd.exe (PID: 3608)
      • cmd.exe (PID: 3952)
      • cmd.exe (PID: 6032)
      • cmd.exe (PID: 5872)
      • cmd.exe (PID: 3140)
      • cmd.exe (PID: 2456)

  • INFO

    • Reads the machine GUID from the registry

      • 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe (PID: 1140)

    • Checks supported languages

      • 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe (PID: 1140)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 3420)
      • I3JM6UVLQVEXSCGW3N47X.exe (PID: 4388)
      • I3JM6UVLQVEXSCGW3N47X.exe (PID: 5308)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)
      • ColorStreamLib.exe (PID: 3052)

    • The sample compiled with english language support

      • 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe (PID: 1140)

    • Reads the computer name

      • 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe (PID: 1140)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 3420)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)
      • ColorStreamLib.exe (PID: 3052)

    • Create files in a temporary directory

      • 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe (PID: 1140)
      • I3JM6UVLQVEXSCGW3N47X.exe (PID: 4388)
      • I3JM6UVLQVEXSCGW3N47X.exe (PID: 5308)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 3420)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)
      • ColorStreamLib.exe (PID: 3052)

    • Process checks computer location settings

      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 3420)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)

    • The process uses the downloaded file

      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 3420)
      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)

    • Reads the software policy settings

      • 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe (PID: 1140)

    • Creates files or folders in the user directory

      • I3JM6UVLQVEXSCGW3N47X.tmp (PID: 848)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | WinRAR Self Extracting archive (87.9)
.exe | InstallShield setup (7.3)
.scr | Windows screen saver (2.2)
.dll | Win32 Dynamic Link Library (generic) (1.1)
.exe | Win32 Executable (generic) (0.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:17 11:44:35+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5
CodeSize: 3428352
InitializedDataSize: 229376
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.30.2024.1217
ProductVersionNumber: 9.30.2024.1217
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Greatis Software
FileDescription: BootRacer Premium
FileVersion: 9.30.2024.1217
InternalName: BootRacePremium.exe
LegalCopyright: Greatis Software
LegalTrademarks: BootRacer
OriginalFileName: BootRacePremium.exe
ProductName: BootRacer
ProductVersion: 9.3
Comments: www.bootracer.com
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
32
Malicious processes
5
Suspicious processes
5

Behavior graph

Click at the process to see the details
start #LUMMA 32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe i3jm6uvlqvexscgw3n47x.exe i3jm6uvlqvexscgw3n47x.tmp i3jm6uvlqvexscgw3n47x.exe i3jm6uvlqvexscgw3n47x.tmp timeout.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs colorstreamlib.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
432tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
536tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
736"timeout" 9 C:\Windows\System32\timeout.exe—I3JM6UVLQVEXSCGW3N47X.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
848"C:\Users\admin\AppData\Local\Temp\is-ENQF6.tmp\I3JM6UVLQVEXSCGW3N47X.tmp" /SL5="$602D2,7875736,845824,C:\Users\admin\AppData\Local\Temp\I3JM6UVLQVEXSCGW3N47X.exe" /VERYSILENTC:\Users\admin\AppData\Local\Temp\is-ENQF6.tmp\I3JM6UVLQVEXSCGW3N47X.tmp
I3JM6UVLQVEXSCGW3N47X.exe
User:
admin
Company:
ColorStream
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\is-enqf6.tmp\i3jm6uvlqvexscgw3n47x.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1140"C:\Users\admin\Desktop\32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe" C:\Users\admin\Desktop\32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe
explorer.exe
User:
admin
Company:
Greatis Software
Integrity Level:
MEDIUM
Description:
BootRacer Premium
Exit code:
0
Version:
9.30.2024.1217
Modules
Images
c:\users\admin\desktop\32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1596find /I "wrsa.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1796find /I "avgui.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1868\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1916find /I "sophoshealth.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
2456"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"C:\Windows\System32\cmd.exe—I3JM6UVLQVEXSCGW3N47X.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
4 973
Read events
4 973
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
848I3JM6UVLQVEXSCGW3N47X.tmpC:\Users\admin\AppData\Roaming\ColorStreamLib\is-P0PAV.tmp —
MD5:—
SHA256:—
848I3JM6UVLQVEXSCGW3N47X.tmpC:\Users\admin\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe —
MD5:—
SHA256:—
3052ColorStreamLib.exeC:\Users\admin\AppData\Local\Temp\1d9aae39 —
MD5:—
SHA256:—
4388I3JM6UVLQVEXSCGW3N47X.exeC:\Users\admin\AppData\Local\Temp\is-ENQF6.tmp\I3JM6UVLQVEXSCGW3N47X.tmpexecutable
MD5:F809F51E678B7F2E388F8C969EF902C8
SHA256:8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
5308I3JM6UVLQVEXSCGW3N47X.exeC:\Users\admin\AppData\Local\Temp\is-DPENP.tmp\I3JM6UVLQVEXSCGW3N47X.tmpexecutable
MD5:F809F51E678B7F2E388F8C969EF902C8
SHA256:8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
848I3JM6UVLQVEXSCGW3N47X.tmpC:\Users\admin\AppData\Local\Temp\is-QP0J3.tmp\_isetup\_isdecmp.dllexecutable
MD5:C6AE924AD02500284F7E4EFA11FA7CFC
SHA256:31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
848I3JM6UVLQVEXSCGW3N47X.tmpC:\Users\admin\AppData\Local\Temp\is-QP0J3.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
3420I3JM6UVLQVEXSCGW3N47X.tmpC:\Users\admin\AppData\Local\Temp\is-DSUFT.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
114032d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exeC:\Users\admin\AppData\Local\Temp\I3JM6UVLQVEXSCGW3N47X.exeexecutable
MD5:C89C55FE25372BFBF8B9264A647C144B
SHA256:C46D6103201008B96B237E10F2C6CA6874E6C0BEB507FE21F497578127AE8857
3420I3JM6UVLQVEXSCGW3N47X.tmpC:\Users\admin\AppData\Local\Temp\is-DSUFT.tmp\_isetup\_isdecmp.dllexecutable
MD5:C6AE924AD02500284F7E4EFA11FA7CFC
SHA256:31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
26
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
188.114.96.3:443
https://sniffdropy.click/api
unknown
text
18.3 Kb
—
—
—
POST
200
188.114.97.3:443
https://sniffdropy.click/api
unknown
text
14 b
—
—
—
POST
200
188.114.96.3:443
https://sniffdropy.click/api
unknown
text
14 b
—
—
—
POST
200
188.114.97.3:443
https://sniffdropy.click/api
unknown
text
14 b
—
—
—
POST
200
188.114.96.3:443
https://sniffdropy.click/api
unknown
text
14 b
—
—
—
POST
200
188.114.96.3:443
https://sniffdropy.click/api
unknown
text
132 b
—
—
—
GET
200
188.114.96.3:443
https://klipjarifaa.shop/int_clp_8888.txt
unknown
executable
8.45 Mb
—
—
—
POST
200
188.114.97.3:443
https://sniffdropy.click/api
unknown
text
14 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3976
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1140
32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip.exe
188.114.97.3:443
sniffdropy.click
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
sniffdropy.click
  • 188.114.97.3
  • 188.114.96.3
unknown
klipjarifaa.shop
  • 188.114.97.3
  • 188.114.96.3
unknown
self.events.data.microsoft.com
  • 20.50.201.201
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
32d6143840acf1f5f095070fc6f6661d8a5f70d790a8149639c6976fb1700902.zip