File name:

random.exe

Full analysis: https://app.any.run/tasks/3eea135a-245a-44e7-a388-44d4f3587603
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 17:44:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

749D7CB216D152FF5D786B8AA1BC244F

SHA1:

8F4C44D0F46C67AB950E686DDECC8B592730E7E0

SHA256:

41A7204A95C79A5B29E63BE8F787BD308E73E36E5000A7469B726C660019BF9A

SSDEEP:

98304:g+ujmkKm93gfWrL0YemNIS0uMIC32d9+MZfnc/leyeIM4ol+jj/qOy9xpITg0sGN:sP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

    • LUMMA has been detected (SURICATA)

      • random.exe (PID: 4776)
      • svchost.exe (PID: 2196)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 976)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7512)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7504)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 4728)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8184)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7176)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 6820)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7272)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 2268)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8164)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 6384)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 5588)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8260)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 9236)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10064)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10720)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10232)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10440)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10580)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11156)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11456)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11292)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11848)

    • LUMMA has been detected (YARA)

      • random.exe (PID: 4776)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 976)

  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 4776)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7504)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 976)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7512)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 4728)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7176)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 6820)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8184)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7272)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 5588)

    • Contacting a server suspected of hosting an CnC

      • random.exe (PID: 4776)
      • svchost.exe (PID: 2196)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 976)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7504)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7512)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 4728)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8184)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7272)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7176)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 5588)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 6820)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 2268)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8164)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 6384)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8260)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 9236)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10720)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10580)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10232)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10440)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11456)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11156)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11292)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10064)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11848)

  • INFO

    • Reads the computer name

      • random.exe (PID: 4776)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 976)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7504)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7512)

    • Checks supported languages

      • random.exe (PID: 4776)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 6820)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 976)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7512)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8184)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7272)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 4728)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7176)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 2268)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7524)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8164)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7432)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 736)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 5588)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7504)

    • Manual execution by a user

      • firefox.exe (PID: 6540)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 976)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7504)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8184)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7272)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7176)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 5588)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 4728)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7512)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 6820)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 2268)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 736)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7524)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7432)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8164)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 3896)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7356)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 3268)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 632)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 7736)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 2284)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 6384)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8260)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8628)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8376)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8512)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 8888)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 9120)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 9136)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 9236)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 9996)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10064)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10124)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10232)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10440)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10560)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10580)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 10720)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11016)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11156)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11176)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11292)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11456)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11580)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11712)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11996)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 11848)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 12404)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 12116)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 12160)

    • Reads the software policy settings

      • random.exe (PID: 4776)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 976)
      • slui.exe (PID: 5528)

    • Application launched itself

      • firefox.exe (PID: 6540)
      • firefox.exe (PID: 6244)

    • Themida protector has been detected

      • random.exe (PID: 4776)
      • Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe (PID: 976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:11 18:58:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 315392
InitializedDataSize: 37888
UninitializedDataSize: -
EntryPoint: 0x4a1000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
199
Monitored processes
70
Malicious processes
25
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LUMMA random.exe #LUMMA svchost.exe sppextcomobj.exe no specs slui.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs slui.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe #LUMMA sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe" C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
736"C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe" C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
920"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2152 -parentBuildID 20240213221259 -prefsHandle 2144 -prefMapHandle 2132 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {756a9d01-5f9f-4bf0-89ba-39c8d549954b} 6244 "\\.\pipe\gecko-crash-server-pipe.6244" 27611681b10 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
976"C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe" C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2240"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2756 -childID 1 -isForBrowser -prefsHandle 2320 -prefMapHandle 2168 -prefsLen 31447 -prefMapSize 244583 -jsInitHandle 1544 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d479f4ed-a7ee-48f1-87ae-9c178433d0e5} 6244 "\\.\pipe\gecko-crash-server-pipe.6244" 27623142d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
2268"C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe" C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2284"C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe" C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3268"C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe" C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3896"C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe" C:\Users\admin\Desktop\Sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\sigmanly_41a7204a95c79a5b29e63be8f787bd308e73e36e5000a7469b726c660019bf9a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
41 172
Read events
41 133
Write events
38
Delete events
1

Modification events

(PID) Process:(6244) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(6244) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(6244) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
04000000030000000E00000000000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(6244) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4
Operation:writeName:MRUListEx
Value:
010000000000000004000000050000000200000003000000FFFFFFFF
(PID) Process:(6244) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\34\Shell
Operation:writeName:SniffedFolderType
Value:
Generic
(PID) Process:(6244) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
114
(PID) Process:(6244) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\exe
Operation:writeName:2
Value:
14001F50E04FD020EA3A6910A2D808002B30309D14002E803ACCBFB42CDB4C42B0297FE99A87C6416000320000CE1C00AF5A868D200072616E646F6D2E6578650000460009000400EFBEAF5A868DAF5A868D2E00000076260000000011000000000000000000000000000000EFC61300720061006E0064006F006D002E0065007800650000001A000000
(PID) Process:(6244) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\exe
Operation:writeName:MRUListEx
Value:
020000000100000000000000FFFFFFFF
(PID) Process:(6244) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*
Operation:writeName:8
Value:
14001F50E04FD020EA3A6910A2D808002B30309D14002E803ACCBFB42CDB4C42B0297FE99A87C6416000320000CE1C00AF5A868D200072616E646F6D2E6578650000460009000400EFBEAF5A868DAF5A868D2E00000076260000000011000000000000000000000000000000EFC61300720061006E0064006F006D002E0065007800650000001A000000
(PID) Process:(6244) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*
Operation:writeName:MRUListEx
Value:
080000000700000006000000050000000400000003000000020000000100000000000000FFFFFFFF
Executable files
0
Suspicious files
200
Text files
20
Unknown types
1

Dropped files

PID
Process
Filename
Type
6244firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
6244firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6244firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cert9.dbbinary
MD5:1192DB58F178D8D3513AB3FA2117877E
SHA256:9AE549EE627CD4D4866400CA442F5EB34B16C201E4D43F98937185E29CD6A3A4
6244firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
6244firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
6244firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
6244firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:EA5973F214AF4E66684C4B83BE20E0C9
SHA256:2876AE720B0C7AD0564C89778057F210C4AE206331EA37544E67699F5132F293
6244firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6244firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6244firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cert9.db-journalbinary
MD5:1AF662D043C71E0B9BBC0AE212059950
SHA256:B7652880C08583690D00C52C45BF9D793A6AFC7A397626925C3FE3BF8FEFC9F2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
412
DNS requests
218
Threats
73

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6244
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
6244
firefox.exe
POST
200
184.24.77.46:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
6244
firefox.exe
POST
200
142.250.186.99:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
6244
firefox.exe
POST
200
184.24.77.46:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
6244
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
6244
firefox.exe
POST
200
142.250.186.99:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
6244
firefox.exe
POST
200
184.24.77.46:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4776
random.exe
104.21.112.1:443
cornerdurv.top
CLOUDFLARENET
—
unknown
4776
random.exe
172.67.198.73:443
emphatakpn.bet
CLOUDFLARENET
US
unknown
4776
random.exe
188.114.96.3:443
laminaflbx.shop
CLOUDFLARENET
NL
malicious
4776
random.exe
104.21.40.104:443
overcovtcg.top
CLOUDFLARENET
—
malicious
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
cornerdurv.top
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.64.1
  • 104.21.32.1
  • 104.21.80.1
  • 104.21.96.1
  • 104.21.48.1
unknown
saxecocnak.live
  • 104.21.112.1
  • 104.21.32.1
  • 104.21.80.1
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.48.1
  • 104.21.64.1
unknown
testcawepr.run
  • —
unknown
emphatakpn.bet
  • 172.67.198.73
  • 104.21.21.111
unknown
laminaflbx.shop
  • 188.114.96.3
  • 188.114.97.3
unknown
overcovtcg.top
  • 104.21.40.104
  • 172.67.150.184
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (overcovtcg .top)
4776
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
4776
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (blackswmxc .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (blackswmxc .top)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloud-Hosted Matomo Analytics (matomo .cloud)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe