URL:

https://www.mediafire.com/folder/hm0b7x2593fh1/TronexCheats

Full analysis: https://app.any.run/tasks/9517a3f4-5dfa-45ae-9eb6-5ad2a93b7eca
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: February 24, 2025, 14:04:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
lumma
stealer
Indicators:
MD5:

951DA6C5E622C9E2158D00512296372D

SHA1:

612536FD838E956DBBFE7561E19CD80C231FD2D1

SHA256:

7A902C4FCECA0F972D59F8777061C01E3ABC791258E94F4FE21777159C55654D

SSDEEP:

3:N8DSLw3eGUbKeHYuJd6Ab:2OLw3eG+t4BAb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • svchosts64.exe (PID: 1868)
      • svchosts64.exe (PID: 6088)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2192)

    • Connects to the CnC server

      • svchost.exe (PID: 2192)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 5548)
      • RegSvcs.exe (PID: 4400)

    • LUMMA mutex has been found

      • RegSvcs.exe (PID: 5548)
      • RegSvcs.exe (PID: 4400)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 5548)
      • RegSvcs.exe (PID: 4400)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7992)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 7992)

    • Executable content was dropped or overwritten

      • Tronex Laungh.exe (PID: 4976)
      • 7z.exe (PID: 3568)
      • cmd.exe (PID: 7396)
      • Tronex Laungh.exe (PID: 3656)
      • 7z.exe (PID: 2612)

    • Drops 7-zip archiver for unpacking

      • Tronex Laungh.exe (PID: 4976)
      • Tronex Laungh.exe (PID: 3656)

    • Executing commands from a ".bat" file

      • Tronex Laungh.exe (PID: 4976)
      • Tronex Laungh.exe (PID: 3656)

    • Reads security settings of Internet Explorer

      • Tronex Laungh.exe (PID: 4976)
      • WinRAR.exe (PID: 7992)
      • Tronex Laungh.exe (PID: 3656)
      • svchosts64.exe (PID: 1868)
      • svchosts64.exe (PID: 6088)

    • Starts CMD.EXE for commands execution

      • Tronex Laungh.exe (PID: 4976)
      • Tronex Laungh.exe (PID: 3656)

    • The executable file from the user directory is run by the CMD process

      • 7z.exe (PID: 7912)
      • 7z.exe (PID: 7888)
      • 7z.exe (PID: 8064)
      • 7z.exe (PID: 7032)
      • 7z.exe (PID: 3568)
      • svchosts64.exe (PID: 1868)
      • 7z.exe (PID: 2152)
      • 7z.exe (PID: 2804)
      • 7z.exe (PID: 7372)
      • 7z.exe (PID: 5444)
      • svchosts64.exe (PID: 6088)
      • 7z.exe (PID: 2612)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 7396)
      • cmd.exe (PID: 7208)

    • There is functionality for taking screenshot (YARA)

      • Tronex Laungh.exe (PID: 4976)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2192)

    • Searches for installed software

      • RegSvcs.exe (PID: 5548)
      • RegSvcs.exe (PID: 4400)

  • INFO

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 6192)

    • Application launched itself

      • msedge.exe (PID: 6192)

    • Checks supported languages

      • identity_helper.exe (PID: 4624)
      • Tronex Laungh.exe (PID: 4976)
      • mode.com (PID: 8080)
      • 7z.exe (PID: 7912)
      • 7z.exe (PID: 7888)
      • 7z.exe (PID: 8064)
      • 7z.exe (PID: 7032)
      • 7z.exe (PID: 3568)
      • Tronex Laungh.exe (PID: 3656)
      • svchosts64.exe (PID: 1868)
      • mode.com (PID: 7008)
      • 7z.exe (PID: 2152)
      • 7z.exe (PID: 2804)
      • 7z.exe (PID: 7372)
      • 7z.exe (PID: 5444)
      • svchosts64.exe (PID: 6088)
      • 7z.exe (PID: 2612)
      • RegSvcs.exe (PID: 5548)
      • RegSvcs.exe (PID: 4400)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7992)
      • Tronex Laungh.exe (PID: 4976)
      • Tronex Laungh.exe (PID: 3656)
      • msedge.exe (PID: 8120)

    • Reads the computer name

      • identity_helper.exe (PID: 4624)
      • Tronex Laungh.exe (PID: 4976)
      • 7z.exe (PID: 8064)
      • 7z.exe (PID: 7032)
      • 7z.exe (PID: 7888)
      • 7z.exe (PID: 7912)
      • Tronex Laungh.exe (PID: 3656)
      • 7z.exe (PID: 3568)
      • 7z.exe (PID: 2152)
      • 7z.exe (PID: 2804)
      • 7z.exe (PID: 7372)
      • 7z.exe (PID: 5444)
      • 7z.exe (PID: 2612)
      • svchosts64.exe (PID: 1868)
      • RegSvcs.exe (PID: 5548)
      • svchosts64.exe (PID: 6088)
      • RegSvcs.exe (PID: 4400)

    • Reads Environment values

      • identity_helper.exe (PID: 4624)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7992)
      • msedge.exe (PID: 8120)

    • The sample compiled with russian language support

      • WinRAR.exe (PID: 7992)

    • Create files in a temporary directory

      • Tronex Laungh.exe (PID: 4976)
      • 7z.exe (PID: 7912)
      • 7z.exe (PID: 8064)
      • 7z.exe (PID: 7032)
      • 7z.exe (PID: 7888)
      • Tronex Laungh.exe (PID: 3656)
      • 7z.exe (PID: 3568)
      • 7z.exe (PID: 2152)
      • 7z.exe (PID: 2804)
      • 7z.exe (PID: 5444)
      • 7z.exe (PID: 7372)
      • 7z.exe (PID: 2612)

    • Process checks computer location settings

      • Tronex Laungh.exe (PID: 4976)
      • Tronex Laungh.exe (PID: 3656)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 8080)
      • mode.com (PID: 7008)

    • Checks proxy server information

      • svchosts64.exe (PID: 1868)
      • svchosts64.exe (PID: 6088)

    • Reads the software policy settings

      • RegSvcs.exe (PID: 5548)
      • RegSvcs.exe (PID: 4400)

    • Creates files in the program directory

      • RegSvcs.exe (PID: 5548)
      • RegSvcs.exe (PID: 4400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
213
Monitored processes
81
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs tronex laungh.exe msedge.exe no specs cmd.exe conhost.exe no specs mode.com no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe attrib.exe no specs svchosts64.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs tronex laungh.exe cmd.exe no specs conhost.exe no specs mode.com no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe attrib.exe no specs svchosts64.exe #LUMMA regsvcs.exe #LUMMA svchost.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs #LUMMA regsvcs.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe

Process information

PID
CMD
Path
Indicators
Parent process
732"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5712 --field-trial-handle=2292,i,14199526981293995043,10840450245670740555,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
848\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1540"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=2292,i,14199526981293995043,10840450245670740555,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1868"svchosts64.exe" C:\Users\admin\AppData\Local\Temp\main\svchosts64.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\main\svchosts64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=7280 --field-trial-handle=2292,i,14199526981293995043,10840450245670740555,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
21527z.exe e file.zip -p18817178172040716667237807193 -oextracted C:\Users\admin\AppData\Local\Temp\main\7z.exe—cmd.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Console
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\local\temp\main\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
26127z.exe e extracted/file_1.zip -oextractedC:\Users\admin\AppData\Local\Temp\main\7z.exe
cmd.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Console
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\local\temp\main\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
28047z.exe e extracted/file_4.zip -oextractedC:\Users\admin\AppData\Local\Temp\main\7z.exe—cmd.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Console
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\local\temp\main\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2996"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=7644 --field-trial-handle=2292,i,14199526981293995043,10840450245670740555,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
12 033
Read events
11 953
Write events
67
Delete events
13

Modification events

(PID) Process:(6192) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6192) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6192) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6192) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6192) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
5DBD301B7A8D2F00
(PID) Process:(6192) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
0E7B501B7A8D2F00
(PID) Process:(6192) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\393922
Operation:writeName:WindowTabManagerFileMappingId
Value:
{D701BC90-9A9C-4788-AF5E-3834E64A3107}
(PID) Process:(6192) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\393922
Operation:writeName:WindowTabManagerFileMappingId
Value:
{ECF232B7-EF2D-4B63-818A-9464381ADE01}
(PID) Process:(6192) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\393922
Operation:writeName:WindowTabManagerFileMappingId
Value:
{C01D0E1A-F515-4A5F-BCFF-C172AC13717E}
(PID) Process:(6192) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\393922
Operation:writeName:WindowTabManagerFileMappingId
Value:
{6C13DCCD-1CFD-4F9D-90C0-19FD743D2DC5}
Executable files
64
Suspicious files
367
Text files
79
Unknown types
0

Dropped files

PID
Process
Filename
Type
6192msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1393d7.TMP —
MD5:—
SHA256:—
6192msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6192msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF1393d7.TMP —
MD5:—
SHA256:—
6192msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6192msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF1393d7.TMP —
MD5:—
SHA256:—
6192msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
6192msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF1393e6.TMP —
MD5:—
SHA256:—
6192msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6192msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF1393f6.TMP —
MD5:—
SHA256:—
6192msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
51
TCP/UDP connections
206
DNS requests
213
Threats
32

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
104.124.11.17:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4864
svchost.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7740
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7740
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5592
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7108
svchost.exe
HEAD
200
217.20.57.20:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1740583286&P2=404&P3=2&P4=E9heswMttT8g325RzZGWTIUljfvqeO5HVF51BqbSneKL1fKzH8HTkxCKXoPy0HXL4eAQWR9gLKXL4tug1Wlisg%3d%3d
unknown
—
—
whitelisted
7108
svchost.exe
GET
206
217.20.57.20:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1740583286&P2=404&P3=2&P4=E9heswMttT8g325RzZGWTIUljfvqeO5HVF51BqbSneKL1fKzH8HTkxCKXoPy0HXL4eAQWR9gLKXL4tug1Wlisg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.23.227.221:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
104.124.11.17:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
104.119.109.218:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4864
svchost.exe
104.119.109.218:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6536
msedge.exe
104.17.151.117:443
www.mediafire.com
—
—
whitelisted
6536
msedge.exe
13.107.253.72:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.23.227.221
  • 2.23.227.215
  • 2.23.227.208
whitelisted
google.com
  • 142.250.74.206
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
crl.microsoft.com
  • 104.124.11.17
  • 104.124.11.58
whitelisted
www.microsoft.com
  • 104.119.109.218
  • 95.101.149.131
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.72
whitelisted
www.mediafire.com
  • 104.17.151.117
  • 104.17.150.117
whitelisted

Threats

PID
Process
Class
Message
6536
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
6536
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
6536
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6536
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6536
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
6536
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
6536
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6536
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6536
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6536
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.mediafire.com/folder/hm0b7x2593fh1/TronexCheats