URL:

https://www.mediafire.com/file/th0uespaf150lay/ZLauncher.rar/file

Full analysis: https://app.any.run/tasks/dc0a96cc-a922-48ec-8d31-f79e45b0f4e9
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: July 06, 2023, 12:12:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
evasion
ransomware
lumma
Indicators:
MD5:

F30473B08DC65E0BAEF12F5572791017

SHA1:

A2580723341726B6FDBD1F7BC58B010B9C686ACB

SHA256:

BA245372AB92F903F3D9BFCCCFF0C9A3B81BCF83C4DCD757BE6FBAAA9B3C0723

SSDEEP:

3:N8DSLw3eGUoBQIbK7hsUKA:2OLw3eG1xbqh8A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • InstallUtil.exe (PID: 1216)

    • Steals credentials from Web Browsers

      • InstallUtil.exe (PID: 1216)

    • LUMMA detected by memory dumps

      • InstallUtil.exe (PID: 1216)

    • Uses Task Scheduler to autorun other applications

      • powershell.exe (PID: 2808)
      • powershell.exe (PID: 1720)
      • powershell.exe (PID: 2552)
      • powershell.exe (PID: 2852)

    • Creates a writable file the system directory

      • powershell.exe (PID: 2616)

  • SUSPICIOUS

    • Reads the Internet Settings

      • InstallUtil.exe (PID: 1216)
      • powershell.exe (PID: 2592)
      • powershell.exe (PID: 2488)
      • powershell.exe (PID: 900)

    • Checks for external IP

      • InstallUtil.exe (PID: 1216)

    • Searches for installed software

      • InstallUtil.exe (PID: 1216)

    • Reads the BIOS version

      • Update.exe (PID: 2608)
      • Update.exe (PID: 1460)
      • Update.exe (PID: 1648)
      • Update.exe (PID: 2964)

    • Creates files like ransomware instruction

      • InstallUtil.exe (PID: 1216)

    • Loads DLL from Mozilla Firefox

      • InstallUtil.exe (PID: 1216)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2552)
      • cmd.exe (PID: 2844)
      • cmd.exe (PID: 2428)
      • cmd.exe (PID: 1664)

    • The process executes via Task Scheduler

      • Update.exe (PID: 1648)

    • Executable content was dropped or overwritten

      • Update.exe (PID: 1648)

    • Drops a system driver (possible attempt to evade defenses)

      • Update.exe (PID: 1648)

    • Unusual connection from system programs

      • powershell.exe (PID: 2616)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2616)

    • Connects to unusual port

      • conhost.exe (PID: 1756)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 2412)

    • Manual execution by a user

      • ZLauncher.exe (PID: 796)
      • ZLauncher.exe (PID: 2684)
      • ZLauncher.exe (PID: 892)
      • ZLauncher.exe (PID: 2112)
      • powershell.exe (PID: 2592)
      • ZLauncher.exe (PID: 2140)
      • cmd.exe (PID: 2552)
      • powershell.exe (PID: 2808)
      • cmd.exe (PID: 2720)
      • schtasks.exe (PID: 2956)
      • powershell.exe (PID: 2488)
      • cmd.exe (PID: 2844)
      • schtasks.exe (PID: 2140)
      • powershell.exe (PID: 900)
      • cmd.exe (PID: 912)
      • powershell.exe (PID: 1720)
      • cmd.exe (PID: 2428)
      • powershell.exe (PID: 2552)
      • schtasks.exe (PID: 2920)
      • cmd.exe (PID: 616)
      • powershell.exe (PID: 2616)
      • cmd.exe (PID: 1664)
      • powershell.exe (PID: 2852)
      • conhost.exe (PID: 2484)
      • conhost.exe (PID: 1756)

    • Checks supported languages

      • ZLauncher.exe (PID: 796)
      • InstallUtil.exe (PID: 1216)
      • Zlaunch.exe (PID: 2804)
      • Update.exe (PID: 2608)
      • ZLauncher.exe (PID: 2140)
      • ZLauncher.exe (PID: 2112)
      • Update.exe (PID: 1460)
      • Update.exe (PID: 2964)
      • Zlaunch.exe (PID: 2988)
      • InstallUtil.exe (PID: 1788)
      • Update.exe (PID: 1648)

    • Reads the computer name

      • ZLauncher.exe (PID: 796)
      • InstallUtil.exe (PID: 1216)
      • ZLauncher.exe (PID: 2140)
      • ZLauncher.exe (PID: 2112)
      • InstallUtil.exe (PID: 1788)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2888)
      • firefox.exe (PID: 2412)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 2412)

    • Creates files or folders in the user directory

      • ZLauncher.exe (PID: 796)
      • InstallUtil.exe (PID: 1216)

    • The process checks LSA protection

      • ZLauncher.exe (PID: 796)
      • InstallUtil.exe (PID: 1216)
      • ZLauncher.exe (PID: 2140)
      • ZLauncher.exe (PID: 2112)
      • InstallUtil.exe (PID: 1788)
      • conhost.exe (PID: 1756)

    • Reads the machine GUID from the registry

      • InstallUtil.exe (PID: 1216)
      • InstallUtil.exe (PID: 1788)

    • Reads Environment values

      • InstallUtil.exe (PID: 1216)
      • InstallUtil.exe (PID: 1788)

    • Create files in a temporary directory

      • InstallUtil.exe (PID: 1216)

    • Process checks are UAC notifies on

      • Update.exe (PID: 2608)
      • Update.exe (PID: 1460)
      • Update.exe (PID: 2964)
      • Update.exe (PID: 1648)

    • Reads CPU info

      • InstallUtil.exe (PID: 1216)

    • Creates files in the program directory

      • Update.exe (PID: 2608)
      • Update.exe (PID: 1648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
70
Malicious processes
8
Suspicious processes
3

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs winrar.exe no specs zlauncher.exe no specs zlauncher.exe zlaunch.exe no specs installutil.exe no specs installutil.exe no specs #LUMMA installutil.exe update.exe no specs zlauncher.exe no specs zlauncher.exe powershell.exe zlauncher.exe update.exe no specs cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe schtasks.exe no specs zlaunch.exe no specs update.exe no specs installutil.exe no specs installutil.exe no specs cmd.exe schtasks.exe choice.exe no specs update.exe powershell.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe schtasks.exe no specs schtasks.exe cmd.exe choice.exe no specs powershell.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe schtasks.exe no specs cmd.exe schtasks.exe choice.exe no specs powershell.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe schtasks.exe no specs conhost.exe conhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
116sc stop bits C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1062
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
504sc stop dosvcC:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sc.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
556"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe—Zlaunch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
.NET Framework installation utility
Exit code:
5
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
556"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn Update /tr "'C:\Program Files\WindowsAps\MicrosoftXboxGamingOverlay\Update.exe'"C:\Windows\System32\schtasks.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\schtasks.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
616C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\admin\AppData\Roaming\Update.exe"C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
636"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe—Zlaunch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
.NET Framework installation utility
Exit code:
5
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
764choice /C Y /N /D Y /T 3 C:\Windows\System32\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Offers the user a choice
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
796"C:\Users\admin\Desktop\ZLauncher.exe" C:\Users\admin\Desktop\ZLauncher.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64win.dll
892"C:\Users\admin\Desktop\ZLauncher.exe" C:\Users\admin\Desktop\ZLauncher.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\zlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
892sc stop UsoSvc C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
14 776
Read events
14 670
Write events
106
Delete events
0

Modification events

(PID) Process:(2412) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
0000000000000000
(PID) Process:(2412) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2412) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000008B000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2412) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2412) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2412) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2412) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2888) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2888) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2888) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
Executable files
10
Suspicious files
282
Text files
73
Unknown types
7

Dropped files

PID
Process
Filename
Type
2412firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
2412firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\startupCache\scriptCache-child-current.binbinary
MD5:2B6B5ABCA010270C502C5DD277CD9E7A
SHA256:99DF8717921F70577FCE3386BB7962A804E490C7157F764458001843A1EC606C
2412firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\prefs-1.jstext
MD5:1759FBCEFAC92AE1A7B8E457ACF71748
SHA256:5DA473B0E0C84BE5B289DC97C259B98F674E17AF49F4723B4A90F73AA972B739
2412firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\permissions.sqlite-journalbinary
MD5:D4EF9FAA51046C0E80F7CA3451F3AD60
SHA256:C9CFEDE5910462AE81E3BC0466467393D90E4FE21511D01AC58714D71F65B9B6
2412firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\startupCache\urlCache-current.binbinary
MD5:6BED2A248268034CA1F73B2925365DE2
SHA256:A45996AA907815E86366A17ED448F75A584D7B600AA9398E14DE21DFAD3D613A
2412firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\safebrowsing-updating\block-flash-digest256.psetbinary
MD5:076933FF9904D1110D896E2C525E39E5
SHA256:4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
2412firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2412firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\safebrowsing-updating\allow-flashallow-digest256.sbstorebinary
MD5:D886A47C89D9C49C795DA345BC236990
SHA256:A03C5E2656D2F292BF5794C8EEB8D223CD6BA4F4BFB2ED1F325460E879D0BCF7
2412firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2412firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
138
DNS requests
207
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2412
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
binary
471 b
whitelisted
2412
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
binary
472 b
whitelisted
2412
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
2412
firefox.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
US
binary
279 b
whitelisted
2412
firefox.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
US
binary
471 b
whitelisted
2412
firefox.exe
POST
200
104.18.14.101:80
http://ocsp.comodoca.com/
US
der
472 b
whitelisted
2412
firefox.exe
POST
200
184.24.77.79:80
http://r3.o.lencr.org/
US
binary
503 b
shared
2412
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt
US
text
8 b
whitelisted
2412
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
binary
471 b
whitelisted
2412
firefox.exe
POST
200
184.24.77.79:80
http://r3.o.lencr.org/
US
der
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2412
firefox.exe
104.16.53.48:443
www.mediafire.com
CLOUDFLARENET
—
suspicious
2412
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
2412
firefox.exe
34.160.46.54:443
search.services.mozilla.com
GOOGLE
US
suspicious
2412
firefox.exe
34.117.65.55:443
push.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
suspicious
2412
firefox.exe
52.11.233.163:443
shavar.services.mozilla.com
AMAZON-02
US
unknown
2412
firefox.exe
142.250.186.136:443
www.googletagmanager.com
GOOGLE
US
suspicious
2412
firefox.exe
104.26.6.139:443
btloader.com
CLOUDFLARENET
US
suspicious
2412
firefox.exe
104.18.14.101:80
ocsp.comodoca.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
www.mediafire.com
  • 104.16.53.48
  • 104.16.54.48
shared
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
search.services.mozilla.com
  • 34.160.46.54
whitelisted
search.r53-2.services.mozilla.com
  • 34.160.46.54
whitelisted
push.services.mozilla.com
  • 34.117.65.55
whitelisted
autopush.prod.mozaws.net
  • 34.117.65.55
whitelisted
tiles.services.mozilla.com
  • —
whitelisted
snippets.cdn.mozilla.net
  • 13.32.121.112
  • 13.32.121.15
  • 13.32.121.49
  • 13.32.121.85
whitelisted
d228z91au11ukj.cloudfront.net
  • 13.32.121.85
  • 13.32.121.49
  • 13.32.121.15
  • 13.32.121.112
whitelisted

Threats

PID
Process
Class
Message
328
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
328
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
328
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
328
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
328
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
328
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
328
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
328
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
328
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
328
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.mediafire.com/file/th0uespaf150lay/ZLauncher.rar/file