File name:

sedra_smith_microelectronic_circuits_8th_international_edition_s.7z

Full analysis: https://app.any.run/tasks/8c93bba5-6da8-4952-90df-c8ce5b86978d
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 00:12:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
lumma
stealer
autoit-loader
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

5DE3AC8D97A543F5F41F50A9DDB36814

SHA1:

CE9B0C3F1FF34C94052EEC59D28408507C428A11

SHA256:

32C7D588294A79BE6C2009289C7795B8189D386F34FDE3FBC56EF4DCE2F6D309

SSDEEP:

98304:jeuZSAw/6il3c3rwbrRx38SvD43Pr0t7CQkS9DQX/yowwCZuSc558b35Rqp5E4Zb:YqUqFyzS+cv0WuNsR829LJfZuFV6Br7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • Alter.com (PID: 8040)

    • LUMMA has been detected (SURICATA)

      • Alter.com (PID: 8040)
      • svchost.exe (PID: 2196)

    • Actions looks like stealing of personal data

      • Alter.com (PID: 8040)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

    • Steals credentials from Web Browsers

      • Alter.com (PID: 8040)

    • AutoIt loader has been detected (YARA)

      • Alter.com (PID: 8040)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • sedra_smith_microelectronic_circuits_8th_international_edition_s.exe (PID: 7552)

    • Starts CMD.EXE for commands execution

      • sedra_smith_microelectronic_circuits_8th_international_edition_s.exe (PID: 7552)
      • cmd.exe (PID: 7636)

    • Reads security settings of Internet Explorer

      • sedra_smith_microelectronic_circuits_8th_international_edition_s.exe (PID: 7552)

    • Get information on the list of running processes

      • cmd.exe (PID: 7636)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7636)

    • Application launched itself

      • cmd.exe (PID: 7636)

    • There is functionality for taking screenshot (YARA)

      • sedra_smith_microelectronic_circuits_8th_international_edition_s.exe (PID: 7552)
      • Alter.com (PID: 8040)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7636)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 7636)

    • The executable file from the user directory is run by the CMD process

      • Alter.com (PID: 8040)

    • Contacting a server suspected of hosting an CnC

      • Alter.com (PID: 8040)
      • svchost.exe (PID: 2196)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4136)

    • Searches for installed software

      • Alter.com (PID: 8040)

  • INFO

    • Manual execution by a user

      • sedra_smith_microelectronic_circuits_8th_international_edition_s.exe (PID: 7552)
      • msedge.exe (PID: 7180)

    • Reads the computer name

      • sedra_smith_microelectronic_circuits_8th_international_edition_s.exe (PID: 7552)
      • extrac32.exe (PID: 7928)
      • Alter.com (PID: 8040)
      • identity_helper.exe (PID: 7720)
      • PLUGScheduler.exe (PID: 4136)

    • Create files in a temporary directory

      • sedra_smith_microelectronic_circuits_8th_international_edition_s.exe (PID: 7552)
      • extrac32.exe (PID: 7928)

    • Checks supported languages

      • Alter.com (PID: 8040)
      • extrac32.exe (PID: 7928)
      • sedra_smith_microelectronic_circuits_8th_international_edition_s.exe (PID: 7552)
      • identity_helper.exe (PID: 7720)
      • PLUGScheduler.exe (PID: 4136)

    • Reads mouse settings

      • Alter.com (PID: 8040)

    • Creates a new folder

      • cmd.exe (PID: 7904)

    • Process checks computer location settings

      • sedra_smith_microelectronic_circuits_8th_international_edition_s.exe (PID: 7552)

    • Reads the software policy settings

      • Alter.com (PID: 8040)
      • slui.exe (PID: 7000)
      • slui.exe (PID: 1272)

    • Application launched itself

      • msedge.exe (PID: 7180)
      • msedge.exe (PID: 5972)

    • Reads Environment values

      • identity_helper.exe (PID: 7720)

    • Checks proxy server information

      • slui.exe (PID: 7000)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 5964)

    • The sample compiled with english language support

      • msedge.exe (PID: 5964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
313
Monitored processes
64
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe sedra_smith_microelectronic_circuits_8th_international_edition_s.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA alter.com choice.exe no specs #LUMMA svchost.exe slui.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe plugscheduler.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6056 --field-trial-handle=2292,i,7581730410044387150,10333487763352743235,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
236"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4180 --field-trial-handle=2292,i,7581730410044387150,10333487763352743235,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2624 --field-trial-handle=2360,i,2669191824799184291,13357396772631536175,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6116 --field-trial-handle=2292,i,7581730410044387150,10333487763352743235,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3476 --field-trial-handle=2360,i,2669191824799184291,13357396772631536175,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
968"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2292,i,7581730410044387150,10333487763352743235,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1272"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2088"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3560 --field-trial-handle=2360,i,2669191824799184291,13357396772631536175,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2776"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3772 --field-trial-handle=2292,i,7581730410044387150,10333487763352743235,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 730
Read events
10 684
Write events
46
Delete events
0

Modification events

(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\sedra_smith_microelectronic_circuits_8th_international_edition_s.7z
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
39
Suspicious files
621
Text files
150
Unknown types
0

Dropped files

PID
Process
Filename
Type
6620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6620.37876\sedra_smith_microelectronic_circuits_8th_international_edition_s.exe —
MD5:—
SHA256:—
7552sedra_smith_microelectronic_circuits_8th_international_edition_s.exeC:\Users\admin\AppData\Local\Temp\Politicians.xltmbinary
MD5:C2237CD5CE8E4BC57DC77EBCC7F3A414
SHA256:4425505A2462A73C8A18578FCE70D546730ECFC2FC08DF5A7968AD801BB5C0AB
7552sedra_smith_microelectronic_circuits_8th_international_edition_s.exeC:\Users\admin\AppData\Local\Temp\Tales.xltmtext
MD5:77FD0F7861D606A4AA93E3945C23C9B8
SHA256:B89487FCF123C688AB5C509116CD77018287451A053DE473B4D576385ACC0FA5
7552sedra_smith_microelectronic_circuits_8th_international_edition_s.exeC:\Users\admin\AppData\Local\Temp\Amplifier.xltmbinary
MD5:4F49C2A8DA55A35413662487191AAC42
SHA256:E1727A1FD79A4CDF2E3A6505484528E3C4B16FAF7DA52EB6E3D7E02FF70924A1
7928extrac32.exeC:\Users\admin\AppData\Local\Temp\Magazinebinary
MD5:6789F277D37FD128BA994EC581C2D5A6
SHA256:E932B6D893E9E979D5F0538D9C0C7B747F0A875101E18C404A2D6218C326843B
7552sedra_smith_microelectronic_circuits_8th_international_edition_s.exeC:\Users\admin\AppData\Local\Temp\Kerry.xltmbinary
MD5:5F7098D2FD423C0228537B90343AF5C1
SHA256:E3309EAE6BBDA699C3323D842B27ABD4CAA711183DA43A85626069F7C8B30B1B
7552sedra_smith_microelectronic_circuits_8th_international_edition_s.exeC:\Users\admin\AppData\Local\Temp\Household.xltmbinary
MD5:B6185682E6347D6357C134A3A88BBC65
SHA256:6E9F5A442F6E62CFA684B12423A1C89E74E55567B4118F23D4A8071CF682876D
7552sedra_smith_microelectronic_circuits_8th_international_edition_s.exeC:\Users\admin\AppData\Local\Temp\Yea.xltmcompressed
MD5:FC64D73B3C09DD9040E11A1B566791CA
SHA256:19570E853515FF94F943782713DC6F13CD9280AE204C21E8D0C32D3CEE31C570
7552sedra_smith_microelectronic_circuits_8th_international_edition_s.exeC:\Users\admin\AppData\Local\Temp\Enhancement.xltmbinary
MD5:321B7DEE2EF299DCC443E4EE59609E4B
SHA256:E05192FB4052DE63FFA5F1C536D20BA55A1BFF7BA0790E3AB68DC5AC9E22F60B
7552sedra_smith_microelectronic_circuits_8th_international_edition_s.exeC:\Users\admin\AppData\Local\Temp\Irs.xltmbinary
MD5:95CE1033095671BF98E30A8205A68A8F
SHA256:443ACB393325C44B1C809FFA2ECA951B5E97FB854DBFE66C4B61766CFC518AA6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
105
DNS requests
118
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7808
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3100
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7808
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7396
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1742973156&P2=404&P3=2&P4=DGh0vRyDDGiF%2buHmUBWfHFotlJo62%2f%2b8vm1GxNqu2v3%2fMa7oC2DFUpmStt4VAG79v4o1jD3BbDRGh%2bgOhPYCvQ%3d%3d
unknown
—
—
whitelisted
7396
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1742973156&P2=404&P3=2&P4=DGh0vRyDDGiF%2buHmUBWfHFotlJo62%2f%2b8vm1GxNqu2v3%2fMa7oC2DFUpmStt4VAG79v4o1jD3BbDRGh%2bgOhPYCvQ%3d%3d
unknown
—
—
whitelisted
7396
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1742973156&P2=404&P3=2&P4=DGh0vRyDDGiF%2buHmUBWfHFotlJo62%2f%2b8vm1GxNqu2v3%2fMa7oC2DFUpmStt4VAG79v4o1jD3BbDRGh%2bgOhPYCvQ%3d%3d
unknown
—
—
whitelisted
7396
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1742973156&P2=404&P3=2&P4=DGh0vRyDDGiF%2buHmUBWfHFotlJo62%2f%2b8vm1GxNqu2v3%2fMa7oC2DFUpmStt4VAG79v4o1jD3BbDRGh%2bgOhPYCvQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3100
backgroundTaskHost.exe
20.223.36.55:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.72
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.65
  • 20.190.160.131
  • 40.126.32.140
  • 20.190.160.132
  • 20.190.160.14
  • 40.126.32.136
  • 40.126.32.72
  • 20.190.160.17
  • 20.190.160.2
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (travewlio .shop)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (esccapewz .run)
8040
Alter.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
8040
Alter.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
8040
Alter.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
8040
Alter.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
8040
Alter.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
8040
Alter.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
8040
Alter.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sedra_smith_microelectronic_circuits_8th_international_edition_s.7z