File name:

faf551a93829a709a7174f6ae283cbde.exe

Full analysis: https://app.any.run/tasks/02dbe24a-ef33-422f-9206-479970d2df1b
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 06:27:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
phishing
putty
rmm-tool
lumma
stealer
pastebin
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

FAF551A93829A709A7174F6AE283CBDE

SHA1:

E7A1FE71A67F25F3E37EA4B78D1B07710ADFAB66

SHA256:

35D825988B4411C29DBF9360578872C722C58D63C8AE1967153C9A28DFE45375

SSDEEP:

196608:z/9YujRAOEOFucWMvz5zUqvHKmXpH9+JaiRgSff7q:2kAxOFZdTtFYvySX7q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • core.exe (PID: 7812)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • LUMMA mutex has been found

      • core.exe (PID: 7812)

    • Actions looks like stealing of personal data

      • core.exe (PID: 7812)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5504)

    • Changes powershell execution policy (Bypass)

      • core.exe (PID: 7812)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • faf551a93829a709a7174f6ae283cbde.exe (PID: 7716)
      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)

    • Reads the Windows owner or organization settings

      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)

    • Reads security settings of Internet Explorer

      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)

    • Reads the date of Windows installation

      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)

    • PUTTY has been detected

      • putty.exe (PID: 7784)

    • Starts POWERSHELL.EXE for commands execution

      • core.exe (PID: 7812)

    • Searches for installed software

      • core.exe (PID: 7812)

  • INFO

    • Reads Environment values

      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)
      • faf551a93829a709a7174f6ae283cbde.exe (PID: 7716)

    • Create files in a temporary directory

      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)
      • faf551a93829a709a7174f6ae283cbde.exe (PID: 7716)
      • powershell.exe (PID: 5504)

    • Checks supported languages

      • faf551a93829a709a7174f6ae283cbde.exe (PID: 7716)
      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)
      • putty.exe (PID: 7784)
      • core.exe (PID: 7812)
      • info.exe (PID: 7824)

    • Reads the computer name

      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)
      • putty.exe (PID: 7784)
      • info.exe (PID: 7824)
      • core.exe (PID: 7812)

    • Creates files or folders in the user directory

      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)

    • The sample compiled with english language support

      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)

    • Creates a software uninstall entry

      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)

    • Process checks computer location settings

      • faf551a93829a709a7174f6ae283cbde.tmp (PID: 7736)

    • Reads the software policy settings

      • core.exe (PID: 7812)
      • powershell.exe (PID: 5504)
      • slui.exe (PID: 3956)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 5504)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5504)

    • Checks proxy server information

      • slui.exe (PID: 3956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:01:08 15:36:35+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 684032
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0xa7f98
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: MyApp Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: MyApp
ProductVersion: 1.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start faf551a93829a709a7174f6ae283cbde.exe faf551a93829a709a7174f6ae283cbde.tmp THREAT putty.exe no specs #LUMMA core.exe info.exe conhost.exe no specs #PHISHING svchost.exe powershell.exe no specs conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3956C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5504powershell -exec bypass <!DOCTYPE html> <html lang="en"> <head> <meta name="viewport" content="width=device-width, initial-scale=0.75, maximum-scale=1.0, user-scalable=yes" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Pastebin.com - Not Found (#404)</title> </head> <body> <h1>Not Found (#404)</h1> <p>This page is no longer available. It has either expired, been removed by its creator, or removed by one of the Pastebin staff.</p> </body> </html>C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—core.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7716"C:\Users\admin\AppData\Local\Temp\faf551a93829a709a7174f6ae283cbde.exe" C:\Users\admin\AppData\Local\Temp\faf551a93829a709a7174f6ae283cbde.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
MyApp Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\faf551a93829a709a7174f6ae283cbde.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
7736"C:\Users\admin\AppData\Local\Temp\is-69HA8.tmp\faf551a93829a709a7174f6ae283cbde.tmp" /SL5="$6026A,19201947,844800,C:\Users\admin\AppData\Local\Temp\faf551a93829a709a7174f6ae283cbde.exe" C:\Users\admin\AppData\Local\Temp\is-69HA8.tmp\faf551a93829a709a7174f6ae283cbde.tmp
faf551a93829a709a7174f6ae283cbde.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-69ha8.tmp\faf551a93829a709a7174f6ae283cbde.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
7784"C:\Users\admin\AppData\Roaming\MyApp\data\putty.exe" C:\Users\admin\AppData\Roaming\MyApp\data\putty.exe
faf551a93829a709a7174f6ae283cbde.tmp
User:
admin
Company:
Simon Tatham
Integrity Level:
MEDIUM
Description:
SSH, Telnet, Rlogin, and SUPDUP client
Version:
Release 0.83 (with embedded help)
Modules
Images
c:\users\admin\appdata\roaming\myapp\data\putty.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7812"C:\Users\admin\AppData\Roaming\MyApp\core.exe"C:\Users\admin\AppData\Roaming\MyApp\core.exe
faf551a93829a709a7174f6ae283cbde.tmp
User:
admin
Company:
Node.js
Integrity Level:
MEDIUM
Description:
Stremio Server JavaScript Runtime
Version:
14.15.0
Modules
Images
c:\users\admin\appdata\roaming\myapp\core.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7824"C:\Users\admin\AppData\Roaming\MyApp\info.exe"C:\Users\admin\AppData\Roaming\MyApp\info.exe
faf551a93829a709a7174f6ae283cbde.tmp
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\roaming\myapp\info.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
7836\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—info.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
8 983
Read events
8 944
Write events
33
Delete events
6

Modification events

(PID) Process:(7736) faf551a93829a709a7174f6ae283cbde.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
381E0000AEDE4CC4CFB8DB01
(PID) Process:(7736) faf551a93829a709a7174f6ae283cbde.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
E2768F96E14542C683DA5580C800B90F79F8CF16A8952CC4887626FD1A70AAC3
(PID) Process:(7736) faf551a93829a709a7174f6ae283cbde.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(7736) faf551a93829a709a7174f6ae283cbde.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Users\admin\AppData\Roaming\MyApp\data\putty.exe
(PID) Process:(7736) faf551a93829a709a7174f6ae283cbde.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
60F7426104AC30125D52FB7406ADF779E6E90F433116534C3154BAA901A12A84
(PID) Process:(7736) faf551a93829a709a7174f6ae283cbde.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.4.0
(PID) Process:(7736) faf551a93829a709a7174f6ae283cbde.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Roaming\MyApp
(PID) Process:(7736) faf551a93829a709a7174f6ae283cbde.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Roaming\MyApp\
(PID) Process:(7736) faf551a93829a709a7174f6ae283cbde.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Icon Group
Value:
MyApp
(PID) Process:(7736) faf551a93829a709a7174f6ae283cbde.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
8
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7736faf551a93829a709a7174f6ae283cbde.tmpC:\Users\admin\AppData\Roaming\MyApp\is-CKPCS.tmp —
MD5:—
SHA256:—
7736faf551a93829a709a7174f6ae283cbde.tmpC:\Users\admin\AppData\Roaming\MyApp\core.exe —
MD5:—
SHA256:—
7736faf551a93829a709a7174f6ae283cbde.tmpC:\Users\admin\AppData\Roaming\MyApp\is-A0NQ1.tmpexecutable
MD5:4134EC81A9D645602B1FA265F98FBF35
SHA256:69966257CE41717F2121EA1F03F8BFA1486423ACECFCC977DD9F1E157C911AD4
7736faf551a93829a709a7174f6ae283cbde.tmpC:\Users\admin\AppData\Local\Temp\is-S3OMF.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
7716faf551a93829a709a7174f6ae283cbde.exeC:\Users\admin\AppData\Local\Temp\is-69HA8.tmp\faf551a93829a709a7174f6ae283cbde.tmpexecutable
MD5:E4C43138CCB8240276872FD1AEC369BE
SHA256:46BE5E3F28A5E4ED63D66B901D927C25944B4DA36EFFEA9C97FB05994360EDF5
7736faf551a93829a709a7174f6ae283cbde.tmpC:\Users\admin\AppData\Roaming\MyApp\data\is-8B0R4.tmpexecutable
MD5:36E31F610EEF3223154E6E8FD074190F
SHA256:16CBE40FB24CE2D422AFDDB5A90A5801CED32EF52C22C2FC77B25A90837F28AD
7736faf551a93829a709a7174f6ae283cbde.tmpC:\Users\admin\AppData\Roaming\MyApp\data\putty.exeexecutable
MD5:36E31F610EEF3223154E6E8FD074190F
SHA256:16CBE40FB24CE2D422AFDDB5A90A5801CED32EF52C22C2FC77B25A90837F28AD
7736faf551a93829a709a7174f6ae283cbde.tmpC:\Users\admin\AppData\Roaming\MyApp\is-T9L2Q.tmpexecutable
MD5:EE0334F3083FED56762CE148E23EFAAA
SHA256:5E57CD5C98F41A350D15D833494DDCF6E58D0616753D8F80E5949BB6B53E2D45
7736faf551a93829a709a7174f6ae283cbde.tmpC:\Users\admin\AppData\Roaming\MyApp\unins000.exeexecutable
MD5:4134EC81A9D645602B1FA265F98FBF35
SHA256:69966257CE41717F2121EA1F03F8BFA1486423ACECFCC977DD9F1E157C911AD4
5504powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:779C944E54F77C237DEA1CD7D4066E7F
SHA256:B189469B22035155058A7F6B0071401FE4046ECFD2F791F429CB9D162970BA60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
30
DNS requests
17
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7824
info.exe
GET
200
82.115.223.212:80
http://stats-1.crabdance.com/api/record?t=a6
unknown
—
—
malicious
6544
svchost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
976
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.38.73.129:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7824
info.exe
82.115.223.212:80
stats-1.crabdance.com
Partner LLC
RU
malicious
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.32.238.112
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 23.38.73.129
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
stats-1.crabdance.com
  • 82.115.223.212
malicious
login.live.com
  • 20.190.160.132
  • 40.126.32.68
  • 20.190.160.66
  • 40.126.32.133
  • 40.126.32.72
  • 20.190.160.2
  • 40.126.32.140
  • 20.190.160.67
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.crabdance .com Domain
7824
info.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 8
2196
svchost.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing Domain ( .crabdance .com)
7824
info.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.crabdance .com Domain
7824
info.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
7824
info.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
faf551a93829a709a7174f6ae283cbde.exe