URL:

https://www.mediafire.com/file/5g2f4scatg4vz4l/CheatLoad.rar/file

Full analysis: https://app.any.run/tasks/f94e7e14-a22d-4969-a7ef-12eca8031b54
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 08:24:46
OS: Windows 11 Professional (build: 22000, 64 bit)
Tags:
rhadamanthys
shellcode
loader
pastebin
winring0x64-sys
vuln-driver
themida
miner
Indicators:
MD5:

591D7CC8636ED17F17D7902D5C6FDAAC

SHA1:

E8EBE9C8DF7E5C180B7B121CDC0677CC7D6CE5A8

SHA256:

A7769CB3A0DF225BD0E240C7BBA2EFC9D62073A8DE447A29F9D8F66A19508E77

SSDEEP:

3:N8DSLw3eGUoQdGPRL9hTjKA:2OLw3eGLpLfKA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RHADAMANTHYS has been detected (YARA)

      • OpenWith.exe (PID: 4124)

    • Vulnerable driver has been detected

      • WmiPrvSE.exe (PID: 8116)

    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 1692)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • OpenWith.exe (PID: 4124)

    • Executes application which crashes

      • OpenWith.exe (PID: 4124)

    • Starts CMD.EXE for commands execution

      • WmiPrvSE.exe (PID: 8116)

    • Potential Corporate Privacy Violation

      • OpenWith.exe (PID: 4124)
      • svchost.exe (PID: 1692)

    • Process requests binary or script from the Internet

      • OpenWith.exe (PID: 4124)

    • Connects to unusual port

      • dllhost.exe (PID: 4848)
      • OpenWith.exe (PID: 4124)
      • OpenWith.exe (PID: 8020)

    • Process drops legitimate windows executable

      • msedge.exe (PID: 4116)

    • Connects to the server without a host name

      • OpenWith.exe (PID: 4124)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 4120)
      • msedge.exe (PID: 1124)
      • msedge.exe (PID: 5124)
      • msedge.exe (PID: 4528)

    • The sample compiled with japanese language support

      • WmiPrvSE.exe (PID: 8116)

    • The sample compiled with english language support

      • WmiPrvSE.exe (PID: 8116)
      • msedge.exe (PID: 4116)
      • OpenWith.exe (PID: 4124)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 4116)

    • Checks supported languages

      • identity_helper.exe (PID: 4448)

    • Reads Environment values

      • identity_helper.exe (PID: 4448)

    • Reads the computer name

      • identity_helper.exe (PID: 4448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
338
Monitored processes
115
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe no specs msedge.exe #MINER svchost.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe chrome.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs chrome.exe msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe chrome.exe #RHADAMANTHYS openwith.exe msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs werfault.exe no specs dllhost.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs wmprph.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs openwith.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs THREAT wmiprvse.exe msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
716"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1932,i,6744613792956966701,976632088221996768,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:9C:\Program Files (x86)\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
134.0.6998.36
Modules
Images
c:\program files (x86)\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\google\chrome\application\134.0.6998.36\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1028"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4940,i,11467140969152778347,16900773765465350996,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1032"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3728,i,8945672665333076008,3909316999459163139,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1032"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6316,i,11467140969152778347,16900773765465350996,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1068"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe—OpenWith.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
27768
Version:
134.0.6998.36
Modules
Images
c:\program files (x86)\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\program files (x86)\google\chrome\application\134.0.6998.36\chrome_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1124 --user-data-dir="C:\Users\admin\AppData\Local\Temp\chr5241.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/64a75571/5fdaec0d"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
OpenWith.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1932,i,6744613792956966701,976632088221996768,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1C:\Program Files (x86)\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
134.0.6998.36
Modules
Images
c:\program files (x86)\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\google\chrome\application\134.0.6998.36\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1292"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6612,i,8945672665333076008,3909316999459163139,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:14C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1344"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1912,i,11467140969152778347,16900773765465350996,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1400"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3988,i,678539955678221016,16383207332872487544,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 111
Read events
9 996
Write events
112
Delete events
3

Modification events

(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
Executable files
22
Suspicious files
718
Text files
165
Unknown types
18

Dropped files

PID
Process
Filename
Type
2248msedge.exeC:\Users\admin\AppData\Local\Temp\chrome_Unpacker_BeginUnzipping4528_535380702\protocols.json —
MD5:—
SHA256:—
4528msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bb644066-2026-4992-b5e4-241457bc32ae.tmpbinary
MD5:AA509A73DA1BF09849BC753AF002B719
SHA256:B51285DB02D98B4C4EB667875B65574EDB5F9A98EC7727A4E7750659F184C1F8
4528msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RF140d3d.TMPbinary
MD5:69B49293CADB716EA674F1376722C9D4
SHA256:70BBC705C4E06559D0BD37D613C21E36C8BBC8AFDF3A3D384A55FBB361A7BCEE
4528msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4b7e12d4-5a48-484e-8e00-37625df73331.tmpbinary
MD5:69B49293CADB716EA674F1376722C9D4
SHA256:70BBC705C4E06559D0BD37D613C21E36C8BBC8AFDF3A3D384A55FBB361A7BCEE
4528msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RF140d1e.TMPbinary
MD5:9AD0B6796B336C23767FC5A8E66A2A3E
SHA256:FE3E6BF854401FFDAAD7291D82DD868FFACE216404C118CDB512FF858321B6F3
4528msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfigbinary
MD5:41C1930548D8B99FF1DBB64BA7FECB3D
SHA256:16CEE17A989167242DD7EE2755721E357DD23BCFCB61F5789CC19DEAFE7CA502
4528msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLogbinary
MD5:69B49293CADB716EA674F1376722C9D4
SHA256:70BBC705C4E06559D0BD37D613C21E36C8BBC8AFDF3A3D384A55FBB361A7BCEE
4528msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RF140daa.TMPbinary
MD5:AA509A73DA1BF09849BC753AF002B719
SHA256:B51285DB02D98B4C4EB667875B65574EDB5F9A98EC7727A4E7750659F184C1F8
2248msedge.exeC:\Users\admin\AppData\Local\Temp\chrome_Unpacker_BeginUnzipping4528_535380702\manifest.jsonbinary
MD5:049C307F30407DA557545D34DB8CED16
SHA256:C36944790C4A1FA2F2ACEC5F7809A4D6689ECB7FB3B2F19C831C9ADB4E17FC54
4528msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RF140d9b.TMPbinary
MD5:41C1930548D8B99FF1DBB64BA7FECB3D
SHA256:16CEE17A989167242DD7EE2755721E357DD23BCFCB61F5789CC19DEAFE7CA502
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
339
DNS requests
415
Threats
33

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2860
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2020
MoUsoCoreWorker.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?06e605f6b16354a2
unknown
—
—
whitelisted
2840
svchost.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?45659ff28ebcce25
unknown
—
—
whitelisted
2840
svchost.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?d63623b56c84aab7
unknown
—
—
whitelisted
2840
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6e89692cca504d0f
unknown
—
—
whitelisted
4132
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3648
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:4yBFoG4JlY0KBT9ddm8hkeCIygsRC05krdnEX9iO6c4&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
5268
svchost.exe
HEAD
200
208.89.74.19:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1750789079&P2=404&P3=2&P4=OuJKyU3tW8U0NCYshwUAXnk%2bzJ1HrZ66SkEmdBYf4CJDOvDqaVYveXhpvCcR%2fgAa%2bHi2%2f7pMR4tbL2lACoiIeQ%3d%3d
unknown
—
—
whitelisted
5268
svchost.exe
GET
206
208.89.74.19:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1750789079&P2=404&P3=2&P4=OuJKyU3tW8U0NCYshwUAXnk%2bzJ1HrZ66SkEmdBYf4CJDOvDqaVYveXhpvCcR%2fgAa%2bHi2%2f7pMR4tbL2lACoiIeQ%3d%3d
unknown
—
—
whitelisted
5268
svchost.exe
GET
206
208.89.74.19:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1750789079&P2=404&P3=2&P4=OuJKyU3tW8U0NCYshwUAXnk%2bzJ1HrZ66SkEmdBYf4CJDOvDqaVYveXhpvCcR%2fgAa%2bHi2%2f7pMR4tbL2lACoiIeQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6440
rundll32.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3696
OfficeC2RClient.exe
52.109.89.18:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
52.109.89.18:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3620
firefox.exe
34.120.208.123:443
incoming.telemetry.mozilla.org
GOOGLE-CLOUD-PLATFORM
US
whitelisted
4596
pingsender.exe
34.120.208.123:443
incoming.telemetry.mozilla.org
GOOGLE-CLOUD-PLATFORM
US
whitelisted
1524
svchost.exe
2.18.64.200:80
—
Administracion Nacional de Telecomunicaciones
UY
unknown
2860
svchost.exe
104.208.16.89:443
v10.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2020
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2860
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
incoming.telemetry.mozilla.org
  • 34.120.208.123
whitelisted
telemetry-incoming.r53-2.services.mozilla.com
  • 34.120.208.123
whitelisted
google.com
  • 142.250.185.110
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
www.mediafire.com
  • 104.17.150.117
  • 104.17.151.117
whitelisted
v10.events.data.microsoft.com
  • 104.208.16.89
  • 20.189.173.23
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
  • 2.19.11.136
  • 2.19.11.178
whitelisted

Threats

PID
Process
Class
Message
1692
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
3648
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
3648
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
3648
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3648
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3648
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3648
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3648
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
3648
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
3648
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\chr3DFD.tmp directory exists )
msedge.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\chr5241.tmp directory exists )
msedge.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\chr5E48.tmp directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.mediafire.com/file/5g2f4scatg4vz4l/CheatLoad.rar/file