File name:

RAGEMP-CHEAT_[unknowncheats.me]_.zip

Full analysis: https://app.any.run/tasks/373531e7-1c3b-4b46-908e-57741b466250
Verdict: Malicious activity
Analysis date: August 02, 2024, 17:43:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

ADA95971CA1D7C520CF7351CD8614F80

SHA1:

410D49E5D556C0EFB26C32DE77BED7CD640B0730

SHA256:

766A1B7542BED041B68B7763ABB324FE0C20D93F41DE20E52EDA42C5166D42B0

SSDEEP:

12288:vWnJO1XkcCxKfD0Hccq0wF88JvlqxCpKLr3ht/P7OK/G1LSVoBXE:vWJO1XkcCxKfD0H5q0w+8J9aCperzDO6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • mapper.exe (PID: 1248)
      • WinRAR.exe (PID: 6408)
      • mapper.exe (PID: 1860)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 6628)

    • Executable content was dropped or overwritten

      • mapper.exe (PID: 1248)
      • mapper.exe (PID: 1860)

    • Creates or modifies Windows services

      • mapper.exe (PID: 1248)
      • mapper.exe (PID: 1860)

    • Reads security settings of Internet Explorer

      • GameBar.exe (PID: 4296)

    • Starts CMD.EXE for commands execution

      • RAGE.exe (PID: 6128)
      • RAGE.exe (PID: 2636)

  • INFO

    • Manual execution by a user

      • mapper.exe (PID: 1248)
      • mapper.exe (PID: 6044)
      • WinRAR.exe (PID: 6628)
      • mapper.exe (PID: 6252)
      • mapper.exe (PID: 5052)
      • mapper.exe (PID: 6628)
      • mapper.exe (PID: 1984)
      • mapper.exe (PID: 2508)
      • mapper.exe (PID: 1860)
      • RAGE.exe (PID: 6128)
      • RAGE.exe (PID: 2636)
      • mapper.exe (PID: 1120)
      • mapper.exe (PID: 2212)
      • mapper.exe (PID: 7104)
      • mapper.exe (PID: 7100)
      • control.exe (PID: 7004)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6628)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6628)
      • WinRAR.exe (PID: 6408)

    • Checks supported languages

      • mapper.exe (PID: 1248)
      • mapper.exe (PID: 6252)
      • mapper.exe (PID: 1984)
      • mapper.exe (PID: 1860)
      • RAGE.exe (PID: 6128)
      • GameBar.exe (PID: 4296)
      • RAGE.exe (PID: 2636)
      • drvinst.exe (PID: 7044)
      • drvinst.exe (PID: 4560)
      • mapper.exe (PID: 1120)
      • mapper.exe (PID: 7100)
      • TextInputHost.exe (PID: 964)

    • Create files in a temporary directory

      • mapper.exe (PID: 1248)
      • mapper.exe (PID: 1860)
      • mmc.exe (PID: 6680)

    • Reads the computer name

      • RAGE.exe (PID: 6128)
      • GameBar.exe (PID: 4296)
      • RAGE.exe (PID: 2636)
      • TextInputHost.exe (PID: 964)

    • Reads the software policy settings

      • mmc.exe (PID: 6680)

    • Reads security settings of Internet Explorer

      • mmc.exe (PID: 6680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:05:20 00:55:08
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: RAGEMP-CHEAT/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
191
Monitored processes
46
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs winrar.exe mapper.exe no specs mapper.exe conhost.exe no specs mapper.exe no specs mapper.exe conhost.exe no specs mapper.exe no specs mapper.exe conhost.exe no specs mapper.exe no specs mapper.exe conhost.exe no specs rage.exe no specs conhost.exe no specs gamebarpresencewriter.exe no specs gamebar.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs gamebarpresencewriter.exe no specs rage.exe no specs conhost.exe no specs gamebarpresencewriter.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs gamebarpresencewriter.exe no specs gamebarpresencewriter.exe no specs control.exe no specs COpenControlPanel no specs mmc.exe no specs mmc.exe textinputhost.exe no specs drvinst.exe no specs drvinst.exe no specs mapper.exe no specs mapper.exe conhost.exe no specs mapper.exe no specs mapper.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
964"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
1120"C:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\mapper.exe" C:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\mapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\ragemp-cheat\driver\mapper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1236C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—RAGE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1248"C:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\mapper.exe" C:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\RAGE.sysC:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\mapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\ragemp-cheat\driver\mapper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1356\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—RAGE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—mapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1860"C:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\mapper.exe" C:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\RAGE.sysC:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\mapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\ragemp-cheat\driver\mapper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1928"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServerC:\Windows\System32\GameBarPresenceWriter.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Gamebar Presence Writer
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\gamebarpresencewriter.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
1984"C:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\mapper.exe" C:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\mapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\ragemp-cheat\driver\mapper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2092C:\WINDOWS\system32\cmd.exe /c cd C:\Windows\System32\C:\Windows\System32\cmd.exe—RAGE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
22 568
Read events
22 389
Write events
170
Delete events
9

Modification events

(PID) Process:(6408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\RAGEMP-CHEAT_[unknowncheats.me]_.zip
(PID) Process:(6408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF280100005B000000E804000044020000
(PID) Process:(6408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
6
Suspicious files
18
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6408.40480\RAGEMP-CHEAT\HOW TO USE.txttext
MD5:821CAC2C5268FA7EBE64EFD1E745E35F
SHA256:517E00B369714BE8D3D42C17200CE0FBEEFD293D0C673C22C9D57C6FA8029981
6680mmc.exeC:\Windows\INF\dc1-controller.PNFbinary
MD5:D3B3FA14EE7DF65425241A14760FCAAD
SHA256:B8B502204D254E4210968D32E73A6AB88D885D29AABE0E391EE3BF6A6439551E
6408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6408.40480\RAGEMP-CHEAT\Driver.rarcompressed
MD5:8A859EAB27E005BBA7479F87862E3F66
SHA256:93975F197A32923051D1F4646D49F2AA2C9FD0657AE617C3795B8F043B736BA9
6628WinRAR.exeC:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\mapper.exeexecutable
MD5:1BD2AF361A5A39A49DF07EB420A4B0E5
SHA256:20FA65ABCAC3A62AE71850679C99CC92311182B46CE2A9816ABD2E066D5CD016
6680mmc.exeC:\Windows\INF\basicrender.PNFbinary
MD5:8567F128605CC616A38D0870D077D165
SHA256:7B2D28D317F49EED7BC242241E54EB3FFFB512C5FB6F719C4F5E9395E6B1F533
6680mmc.exeC:\Windows\INF\miradisp.PNFbinary
MD5:C4516D931D999F6A168ADC07F355256D
SHA256:2AD57323363B4182C4E668B20D099B141473ED7B1A661D07997DF3C8099181F5
6628WinRAR.exeC:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\RAGE.catcat
MD5:8A859EAB27E005BBA7479F87862E3F66
SHA256:93975F197A32923051D1F4646D49F2AA2C9FD0657AE617C3795B8F043B736BA9
6628WinRAR.exeC:\Users\admin\Desktop\RAGEMP-CHEAT\Driver\RAGE.infbinary
MD5:3509B92006A3F6E149D221752192F9C9
SHA256:9EB9EBC5E60F8C739184746E3A13481269D3AF471F3D8E7DFD3EBDDC6D8CDDDD
6680mmc.exeC:\Windows\INF\machine.PNFbinary
MD5:4C103190BC521FF032845C1B5FDADC4F
SHA256:28C1DEE803488C32BF5229B05FB3F6DA8959A436BB17D331E68AFA61A3BE932F
6680mmc.exeC:\Windows\INF\rdcameradriver.PNFbinary
MD5:6D1BF957B68044A44CB7D29C8198A377
SHA256:F2B6BE9B897B82323A5680962416D0F60C5C428D66830518ECF4E113BE851E3B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
45
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
313 b
whitelisted
6972
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
2608
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
2608
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
7020
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4060
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1536
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5336
SearchApp.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2608
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6972
backgroundTaskHost.exe
20.223.35.26:443
fd.api.iris.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.142
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.145
  • 104.126.37.128
  • 104.126.37.186
  • 104.126.37.144
  • 104.126.37.185
  • 104.126.37.153
  • 104.126.37.154
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.2
  • 20.190.159.23
  • 40.126.31.73
  • 20.190.159.4
  • 20.190.159.71
  • 40.126.31.69
  • 20.190.159.0
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 104.126.37.128
  • 104.126.37.186
  • 104.126.37.185
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.130
  • 104.126.37.144
  • 104.126.37.154
  • 104.126.37.153
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RAGEMP-CHEAT_[unknowncheats.me]_.zip