File name:

(Epicunitscan.info) virus.txt

Full analysis: https://app.any.run/tasks/f1a8ec8d-dae3-4941-a6bc-9093592e8641
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: October 06, 2024, 11:03:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
possible-phishing
lumma
stealer
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

7479D07C26090ADF27019F451B9ABD6D

SHA1:

2C82F237D3707BE94621098D53BF8C92656B0D8B

SHA256:

3ADEED993BEBC59A07C119B3B2315A4C3FBEFCADDAF7A41D2381A96A36A0E295

SSDEEP:

3:VKTg4z4zoLJNFgFX9RJFE18MIQqRRwXsBY6VSIJ5H52LOCTK952ll2a/kBIOwn:vI4KJXy9W1nqMu4IHH19Efdk+jn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5112)

    • LUMMA has been detected (YARA)

      • SearchIndexer.exe (PID: 2112)

    • Connects to the CnC server

      • svchost.exe (PID: 2256)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6332)

    • Changes powershell execution policy (Bypass)

      • SearchIndexer.exe (PID: 2816)

    • Uses Task Scheduler to run other applications

      • tmp4DEB.tmp.exe (PID: 6712)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2256)

  • SUSPICIOUS

    • Application launched itself

      • powershell.exe (PID: 7104)

    • BASE64 encoded PowerShell command has been detected

      • powershell.exe (PID: 7104)

    • Base64-obfuscated command line is found

      • powershell.exe (PID: 7104)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 7104)
      • SearchIndexer.exe (PID: 2816)

    • Checks for external IP

      • svchost.exe (PID: 2256)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 5112)
      • Setup.exe (PID: 4196)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 5112)
      • Setup.exe (PID: 4196)
      • powershell.exe (PID: 6332)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 5112)
      • Setup.exe (PID: 4196)
      • WinRAR.exe (PID: 4748)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2256)

    • Starts application with an unusual extension

      • Setup.exe (PID: 3316)
      • Setup.exe (PID: 4196)

    • The process executes Powershell scripts

      • SearchIndexer.exe (PID: 2816)

  • INFO

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 1116)

    • Manual execution by a user

      • powershell.exe (PID: 7104)
      • msedge.exe (PID: 6664)

    • Possible Social Engineering Attempted

      • svchost.exe (PID: 2256)
      • msedge.exe (PID: 884)

    • The executable file from the user directory is run by the Powershell process

      • Setup.exe (PID: 4196)
      • tmp4DEB.tmp.exe (PID: 6712)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4748)

    • Application launched itself

      • msedge.exe (PID: 6664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(2112) SearchIndexer.exe
C2 (9)mobbipenju.store
firghtenj.online
eaglepawnoy.store
bathdoomgaz.store
licendfilteo.site
studennotediw.store
dissapoiznw.store
spirittunek.store
clearancek.site
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
197
Monitored processes
63
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start notepad.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe #LUMMA svchost.exe setup.exe strcmp.exe no specs more.com no specs conhost.exe no specs #LUMMA searchindexer.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe setup.exe no specs strcmp.exe no specs more.com no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs searchindexer.exe msedge.exe no specs msedge.exe powershell.exe conhost.exe no specs msedge.exe no specs tmp4deb.tmp.exe no specs msedge.exe no specs service123.exe no specs schtasks.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
448"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6320 --field-trial-handle=2336,i,3711546864634098852,12055335248502484240,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
448\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
448"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7280 --field-trial-handle=2336,i,3711546864634098852,12055335248502484240,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
884"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2516 --field-trial-handle=2336,i,3711546864634098852,12055335248502484240,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1072"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3600 --field-trial-handle=2336,i,3711546864634098852,12055335248502484240,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1116"C:\WINDOWS\system32\NOTEPAD.EXE" "C:\Users\admin\AppData\Local\Temp\(Epicunitscan.info) virus.txt"C:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4860 --field-trial-handle=2336,i,3711546864634098852,12055335248502484240,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1328"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5332 --field-trial-handle=2336,i,3711546864634098852,12055335248502484240,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1432"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5652 --field-trial-handle=2336,i,3711546864634098852,12055335248502484240,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1480"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2320 --field-trial-handle=2336,i,3711546864634098852,12055335248502484240,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
27 401
Read events
27 361
Write events
40
Delete events
0

Modification events

(PID) Process:(6664) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6664) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6664) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6664) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6664) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
ACB8BC2D63822F00
(PID) Process:(6664) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
DE34C22D63822F00
(PID) Process:(6664) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\918346
Operation:writeName:WindowTabManagerFileMappingId
Value:
{3E384C37-E431-4911-A0E3-8CAE49173FA8}
(PID) Process:(6664) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\918346
Operation:writeName:WindowTabManagerFileMappingId
Value:
{D2B4AEB6-B15C-4A50-8250-CAB0A2E9FBF3}
(PID) Process:(6664) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\918346
Operation:writeName:WindowTabManagerFileMappingId
Value:
{7EE5E1F8-D2E0-41BC-BEA7-ACAE7006FB5A}
(PID) Process:(6664) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\918346
Operation:writeName:WindowTabManagerFileMappingId
Value:
{78606BCA-1A4A-4EC3-84CC-20A3578984EB}
Executable files
109
Suspicious files
622
Text files
358
Unknown types
3

Dropped files

PID
Process
Filename
Type
7104powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F7PP7CZ7E11JO2NCW418.tempbinary
MD5:BC1565690D84A2888F5E253CECA2E9AE
SHA256:047AE72B8AAB5E33ABE92A8BDBDF791DF8E7500CECE94EE9F56805551BCA9710
5112powershell.exeC:\Users\admin\AppData\Local\Temp\file\resources.pak —
MD5:—
SHA256:—
5112powershell.exeC:\Users\admin\AppData\Local\Temp\file\msvcr71.dllexecutable
MD5:86F1895AE8C5E8B17D99ECE768A70732
SHA256:8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
7104powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txttext
MD5:729116A1017C2CBD099DAA3D3B9E13CD
SHA256:AE89C92CEA77D44DF75B8F38FAACB0F5F25BDFD16A9B2B2D0CB213DE7AFCE85A
5112powershell.exeC:\Users\admin\AppData\Local\Temp\file\msvcp71.dllexecutable
MD5:561FA2ABB31DFA8FAB762145F81667C2
SHA256:DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
7104powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mdq0tc30.mye.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5112powershell.exeC:\Users\admin\AppData\Local\Temp\file\MUICoreLib.dllexecutable
MD5:60A5383BA17D8F519CB4356E28873A14
SHA256:80878E4543959B63CBD87E3EBB82F4988CBBDF9DA564370AA15410783C5F343F
5112powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lfd4bmmb.cw0.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5112powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hp5lnc0s.q3n.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5112powershell.exeC:\Users\admin\AppData\Local\Temp\file\cjgmdgsbinary
MD5:B2BA74D633935B9B1B4899E874DFDAF8
SHA256:EBD3AB1802FCF6C1AE76743584804A78B66D7D90C64021110C65C1E3C17D35BD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
157
DNS requests
123
Threats
27

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1308
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2088
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3784
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0c12dff9-696d-48d4-bbe8-7d8bdad98e65?P1=1728639197&P2=404&P3=2&P4=TOewn%2fh7HcfO10JqDhV5gJPl734sBjhh%2ffJiaE7j4qrOTFPLk7eKceEhFU2VjRghnZjQ%2f%2feun586wTdnZe6hrA%3d%3d
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3316
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3784
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0c12dff9-696d-48d4-bbe8-7d8bdad98e65?P1=1728639197&P2=404&P3=2&P4=TOewn%2fh7HcfO10JqDhV5gJPl734sBjhh%2ffJiaE7j4qrOTFPLk7eKceEhFU2VjRghnZjQ%2f%2feun586wTdnZe6hrA%3d%3d
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3784
svchost.exe
HEAD
200
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0c12dff9-696d-48d4-bbe8-7d8bdad98e65?P1=1728639197&P2=404&P3=2&P4=TOewn%2fh7HcfO10JqDhV5gJPl734sBjhh%2ffJiaE7j4qrOTFPLk7eKceEhFU2VjRghnZjQ%2f%2feun586wTdnZe6hrA%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4308
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4324
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
2.23.209.189:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5336
SearchApp.exe
13.89.179.9:443
browser.pipe.aria.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 88.221.169.152
  • 23.35.229.160
whitelisted
google.com
  • 142.250.186.110
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.23.209.189
  • 2.23.209.140
  • 2.23.209.187
  • 2.23.209.182
  • 2.23.209.176
  • 2.23.209.185
  • 2.23.209.161
  • 2.23.209.177
  • 2.23.209.179
  • 92.123.104.51
  • 92.123.104.52
  • 92.123.104.53
  • 92.123.104.33
  • 92.123.104.49
  • 92.123.104.34
  • 92.123.104.32
  • 92.123.104.40
  • 92.123.104.47
  • 2.23.209.158
  • 2.23.209.149
  • 2.23.209.150
  • 2.23.209.133
  • 2.23.209.130
whitelisted
browser.pipe.aria.microsoft.com
  • 13.89.179.9
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r.bing.com
  • 2.23.209.177
  • 2.23.209.133
  • 2.23.209.189
  • 2.23.209.148
  • 2.23.209.176
  • 2.23.209.187
  • 2.23.209.179
  • 2.23.209.130
  • 2.23.209.185
  • 2.23.209.149
  • 2.23.209.182
  • 2.23.209.140
  • 92.123.104.47
  • 92.123.104.51
  • 92.123.104.52
  • 92.123.104.53
  • 92.123.104.33
  • 92.123.104.49
  • 92.123.104.34
  • 92.123.104.32
  • 92.123.104.40
whitelisted
th.bing.com
  • 2.23.209.176
  • 2.23.209.189
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.187
  • 2.23.209.182
  • 2.23.209.140
  • 2.23.209.130
  • 2.23.209.185
  • 92.123.104.52
  • 92.123.104.53
  • 92.123.104.33
  • 92.123.104.49
  • 92.123.104.34
  • 92.123.104.32
  • 92.123.104.40
  • 92.123.104.47
  • 92.123.104.51
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.71
  • 20.190.159.23
  • 20.190.159.4
  • 40.126.31.67
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.75
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] CloudFlare Public R2.dev Bucket
2256
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Abuse Public R2.dev Bucket
2256
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)
2256
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)
2256
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)
2256
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)
2256
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)
2256
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)
2256
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)
2256
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
(Epicunitscan.info) virus.txt