File name:

2.bin

Full analysis: https://app.any.run/tasks/9603fb86-aea6-46b0-8fdb-29d54bff4a65
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: March 10, 2025, 05:04:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

3A7285D7C2345F513FF35C8DD2BE30E1

SHA1:

8B71E966B18B2CD5F437361AA8E89DD5F428B97F

SHA256:

3E975AC408D0A81C3C8664EBE69C0EC4422791E60603004AD730B0EFBDA25CB3

SSDEEP:

49152:cS8HiZmqiFVvmTUs6BcBcE49fdkMgeqrFLW9juhzz846OFvlU5CWnbBxQ/8mP0ke:KCZVijvhzt1vglrFapuf0Csa/9PrPCLb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • AppLaunch.exe (PID: 4776)

    • Actions looks like stealing of personal data

      • AppLaunch.exe (PID: 4776)

    • Steals credentials from Web Browsers

      • AppLaunch.exe (PID: 4776)

    • Executing a file with an untrusted certificate

      • TiVoDiag.exe (PID: 1240)
      • TiVoDiag.exe (PID: 6708)
      • TiVoDiag.exe (PID: 3140)

    • Known privilege escalation attack

      • dllhost.exe (PID: 6516)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • AppLaunch.exe (PID: 4776)

    • Searches for installed software

      • AppLaunch.exe (PID: 4776)

    • Executable content was dropped or overwritten

      • AppLaunch.exe (PID: 4776)
      • TiVoDiag.exe (PID: 1240)

    • Starts itself from another location

      • TiVoDiag.exe (PID: 1240)

    • Starts application with an unusual extension

      • TiVoDiag.exe (PID: 6708)
      • TiVoDiag.exe (PID: 3140)

  • INFO

    • Reads the machine GUID from the registry

      • 2.bin.exe (PID: 2516)
      • more.com (PID: 5544)

    • Reads the computer name

      • AppLaunch.exe (PID: 4776)
      • 2.bin.exe (PID: 2516)
      • more.com (PID: 5544)
      • TiVoDiag.exe (PID: 1240)
      • TiVoDiag.exe (PID: 6708)
      • TiVoDiag.exe (PID: 3140)
      • more.com (PID: 5436)

    • Checks supported languages

      • 2.bin.exe (PID: 2516)
      • AppLaunch.exe (PID: 4776)
      • TiVoDiag.exe (PID: 6708)
      • TiVoDiag.exe (PID: 1240)
      • TiVoDiag.exe (PID: 3140)
      • more.com (PID: 5436)
      • more.com (PID: 5544)

    • Reads the software policy settings

      • AppLaunch.exe (PID: 4776)
      • BackgroundTransferHost.exe (PID: 920)

    • Manual execution by a user

      • AppLaunch.exe (PID: 4776)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 920)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 5400)
      • BackgroundTransferHost.exe (PID: 920)
      • BackgroundTransferHost.exe (PID: 536)
      • BackgroundTransferHost.exe (PID: 2560)
      • BackgroundTransferHost.exe (PID: 4976)
      • dllhost.exe (PID: 6516)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 920)

    • Create files in a temporary directory

      • AppLaunch.exe (PID: 4776)
      • TiVoDiag.exe (PID: 6708)
      • TiVoDiag.exe (PID: 3140)
      • more.com (PID: 5436)

    • The sample compiled with english language support

      • AppLaunch.exe (PID: 4776)
      • TiVoDiag.exe (PID: 1240)

    • Creates files in the program directory

      • TiVoDiag.exe (PID: 1240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:09 06:50:05+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 1243136
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0x131796
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.1.8325.0
ProductVersionNumber: 8.1.8325.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Macrium Rescue Media Builder
CompanyName: Paramount Software UK Ltd
FileDescription: Macrium Rescue Media Builder
FileVersion: 8.1.8325.0
InternalName: Jhtcqtzft.exe
LegalCopyright: (c) Paramount Software. All rights reserved.
LegalTrademarks: -
OriginalFileName: Jhtcqtzft.exe
ProductName: Macrium Rescue Media Builder
ProductVersion: 8.1.8325.0
AssemblyVersion: 8.1.8325.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
19
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2.bin.exe no specs #LUMMA applaunch.exe sppextcomobj.exe no specs slui.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs svchost.exe backgroundtransferhost.exe no specs tivodiag.exe backgroundtransferhost.exe no specs tivodiag.exe no specs more.com no specs conhost.exe no specs CMSTPLUA tivodiag.exe no specs more.com no specs conhost.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
920"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1240"C:\Users\admin\AppData\Local\Temp\BIGO3FVH755QLGXOOMTV8\TiVoDiag.exe"C:\Users\admin\AppData\Local\Temp\BIGO3FVH755QLGXOOMTV8\TiVoDiag.exe
AppLaunch.exe
User:
admin
Company:
TiVo Inc.
Integrity Level:
MEDIUM
Description:
TiVo diagnostic tool
Exit code:
0
Version:
2.8.3
Modules
Images
c:\users\admin\appdata\local\temp\bigo3fvh755qlgxoomtv8\tivodiag.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1324C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2516"C:\Users\admin\Desktop\2.bin.exe" C:\Users\admin\Desktop\2.bin.exe—explorer.exe
User:
admin
Company:
Paramount Software UK Ltd
Integrity Level:
MEDIUM
Description:
Macrium Rescue Media Builder
Exit code:
4294967295
Version:
8.1.8325.0
Modules
Images
c:\users\admin\desktop\2.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2560"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3140"C:\ProgramData\WSHelper\TiVoDiag.exe" C:\ProgramData\WSHelper\TiVoDiag.exe—dllhost.exe
User:
admin
Company:
TiVo Inc.
Integrity Level:
HIGH
Description:
TiVo diagnostic tool
Exit code:
1
Version:
2.8.3
Modules
Images
c:\programdata\wshelper\tivodiag.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
4776"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4976"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
3 105
Read events
3 089
Write events
16
Delete events
0

Modification events

(PID) Process:(5400) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5400) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5400) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(920) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(920) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(920) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(536) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(536) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(536) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2560) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
6
Suspicious files
7
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
920BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0404b270-1880-4ec5-9553-67db8c7484f4.down_data —
MD5:—
SHA256:—
4776AppLaunch.exeC:\Users\admin\AppData\Local\Temp\BIGO3FVH755QLGXOOMTV8\pulque.vcf —
MD5:—
SHA256:—
1240TiVoDiag.exeC:\ProgramData\WSHelper\pulque.vcf —
MD5:—
SHA256:—
6708TiVoDiag.exeC:\Users\admin\AppData\Local\Temp\ef666c4f —
MD5:—
SHA256:—
3140TiVoDiag.exeC:\Users\admin\AppData\Local\Temp\f0c3bb2b —
MD5:—
SHA256:—
5436more.comC:\Users\admin\AppData\Local\Temp\rnmqqiy —
MD5:—
SHA256:—
920BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:AD65BBA990E9A146C8789184B44B3332
SHA256:C57BBFD31CE81C873E766C5DEEE854B02BFF08020DF9BE1A3B4562BD67CC932D
4776AppLaunch.exeC:\Users\admin\AppData\Local\Temp\BIGO3FVH755QLGXOOMTV8\MindClient.dllexecutable
MD5:9DA8AA00BEB0D68E8EE58687F22BF8FF
SHA256:58925C21B32F7690354222266E107617546CFD71C02ECD05D4294D35C472E697
920BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c470c629-51de-43e4-a305-b1f572547cc0.up_meta_securebinary
MD5:C453A385FEE128AB9AD57A1A3B0ED803
SHA256:FA25F89AAC89C07166409B9882810B87E7A509D32A17DFC01A1BDC45323EF109
920BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0404b270-1880-4ec5-9553-67db8c7484f4.65864eef-b2c1-40a8-9dea-2df99208c908.down_metabinary
MD5:C180E0E802CB863109A90233105FE259
SHA256:1966B3939B8CB5D08B75913DB1D5303F8CC5F14CE3E56C4E88325268BF1A0939
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
36
DNS requests
16
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5800
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
920
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4776
AppLaunch.exe
188.114.96.3:443
playrfulpals.digital
CLOUDFLARENET
NL
unknown
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5800
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5800
backgroundTaskHost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
playrfulpals.digital
  • 188.114.96.3
  • 188.114.97.3
unknown
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.71
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.131
  • 40.126.31.130
  • 20.190.159.129
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
farmagrupodw.com
  • 185.195.97.57
unknown
www.bing.com
  • 104.126.37.176
  • 104.126.37.163
  • 104.126.37.170
  • 104.126.37.123
  • 104.126.37.131
  • 104.126.37.184
  • 104.126.37.130
  • 104.126.37.179
  • 104.126.37.178
whitelisted
www.mediafire.com
  • 104.17.151.117
  • 104.17.150.117
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
No debug info