File name:

Full_Setup_Use_2390_P͜@s$WⓞRÐ☑.rar

Full analysis: https://app.any.run/tasks/cf8f29e3-e61b-4335-bc62-8ce1450c6263
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: August 15, 2024, 18:05:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
netreactor
crypto-regex
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

DBB5E5B3259132440236505D78B23B3C

SHA1:

4A5A2D7FDB0519468BB123D96F3244D3C1EA90A4

SHA256:

426E304509D31F073BE374F3F33BB27E8B31981EC83275EFB5B069415EA22E6D

SSDEEP:

98304:OJRP/1MNupgVQ0m+PjIXzkURFQ/G/AwFPCzSTiGbs4sFu50q40d8RStxAg3z/gOb:I0DKvEebSXigwq7KPKlFeVnRqxLOwS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been detected (YARA)

      • SearchIndexer.exe (PID: 876)
      • SearchIndexer.exe (PID: 6452)
      • SearchIndexer.exe (PID: 6520)

    • Stealers network behavior

      • SearchIndexer.exe (PID: 876)
      • SearchIndexer.exe (PID: 6520)

    • LUMMA has been detected (SURICATA)

      • SearchIndexer.exe (PID: 876)
      • SearchIndexer.exe (PID: 6520)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2608)
      • powershell.exe (PID: 3292)

    • Probably downloads file via BitsAdmin (POWERSHELL)

      • powershell.exe (PID: 2608)
      • powershell.exe (PID: 3292)

    • Changes powershell execution policy (Bypass)

      • SearchIndexer.exe (PID: 876)
      • SearchIndexer.exe (PID: 6520)

    • Modifies registry (POWERSHELL)

      • powershell.exe (PID: 3292)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3068)
      • Setup.exe (PID: 6732)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1420)
      • WinRAR.exe (PID: 3068)

    • Application launched itself

      • WinRAR.exe (PID: 1420)

    • Drops the executable file immediately after the start

      • Setup.exe (PID: 6732)
      • WY0R1KZJLMAMR5W8C16.exe (PID: 7116)

    • The process drops C-runtime libraries

      • Setup.exe (PID: 6732)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 6732)
      • SearchIndexer.exe (PID: 876)
      • WY0R1KZJLMAMR5W8C16.exe (PID: 7116)
      • SearchIndexer.exe (PID: 6520)

    • Starts application with an unusual extension

      • Setup.exe (PID: 6732)
      • Setup.exe (PID: 6992)
      • Setup.exe (PID: 4280)

    • Searches for installed software

      • SearchIndexer.exe (PID: 876)
      • SearchIndexer.exe (PID: 6520)

    • Starts POWERSHELL.EXE for commands execution

      • SearchIndexer.exe (PID: 876)
      • SearchIndexer.exe (PID: 6520)

    • The process executes Powershell scripts

      • SearchIndexer.exe (PID: 876)
      • SearchIndexer.exe (PID: 6520)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 2608)
      • powershell.exe (PID: 3292)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 2608)
      • powershell.exe (PID: 3292)

    • Connects to unusual port

      • MSBuild.exe (PID: 840)

    • Found regular expressions for crypto-addresses (YARA)

      • MSBuild.exe (PID: 840)

    • Executes application which crashes

      • MSBuild.exe (PID: 1544)

    • The process executes via Task Scheduler

      • oakley.exe (PID: 532)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3068)

    • Checks supported languages

      • Setup.exe (PID: 6732)
      • StrCmp.exe (PID: 6956)
      • more.com (PID: 4060)
      • Setup.exe (PID: 6992)
      • Setup.exe (PID: 4280)
      • more.com (PID: 6924)
      • more.com (PID: 5980)
      • PE7BDERD3WE1VEAVUNKK9T.exe (PID: 2080)
      • WY0R1KZJLMAMR5W8C16.exe (PID: 7116)
      • K7RMS1UAOI9PAYDPVZKTBYNFHYNSUX.exe (PID: 2992)
      • MSBuild.exe (PID: 840)
      • TextInputHost.exe (PID: 6632)
      • CU92URRP6ZQE1KR4Q01V7D.exe (PID: 6884)
      • oakley.exe (PID: 532)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 6732)
      • WY0R1KZJLMAMR5W8C16.exe (PID: 7116)
      • WerFault.exe (PID: 7272)

    • Reads the computer name

      • Setup.exe (PID: 6732)
      • StrCmp.exe (PID: 6956)
      • more.com (PID: 4060)
      • more.com (PID: 6924)
      • Setup.exe (PID: 4280)
      • more.com (PID: 5980)
      • Setup.exe (PID: 6992)
      • PE7BDERD3WE1VEAVUNKK9T.exe (PID: 2080)
      • WY0R1KZJLMAMR5W8C16.exe (PID: 7116)
      • TextInputHost.exe (PID: 6632)
      • CU92URRP6ZQE1KR4Q01V7D.exe (PID: 6884)
      • K7RMS1UAOI9PAYDPVZKTBYNFHYNSUX.exe (PID: 2992)

    • Create files in a temporary directory

      • Setup.exe (PID: 6732)
      • more.com (PID: 4060)
      • Setup.exe (PID: 6992)
      • more.com (PID: 6924)
      • Setup.exe (PID: 4280)
      • more.com (PID: 5980)
      • SearchIndexer.exe (PID: 876)
      • PE7BDERD3WE1VEAVUNKK9T.exe (PID: 2080)
      • MSBuild.exe (PID: 840)
      • SearchIndexer.exe (PID: 6520)
      • CU92URRP6ZQE1KR4Q01V7D.exe (PID: 6884)
      • WerFault.exe (PID: 7272)

    • Reads the software policy settings

      • SearchIndexer.exe (PID: 876)
      • SearchIndexer.exe (PID: 6520)
      • WerFault.exe (PID: 7272)

    • Reads the machine GUID from the registry

      • WY0R1KZJLMAMR5W8C16.exe (PID: 7116)
      • K7RMS1UAOI9PAYDPVZKTBYNFHYNSUX.exe (PID: 2992)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2608)
      • powershell.exe (PID: 3292)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2608)
      • powershell.exe (PID: 3292)

    • .NET Reactor protector has been detected

      • WY0R1KZJLMAMR5W8C16.exe (PID: 7116)
      • K7RMS1UAOI9PAYDPVZKTBYNFHYNSUX.exe (PID: 2992)

    • Manual execution by a user

      • MSBuild.exe (PID: 840)
      • MSBuild.exe (PID: 1544)

    • Checks proxy server information

      • WerFault.exe (PID: 7272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(876) SearchIndexer.exe
C2 (9)consciousourwi.shop
southedhiscuso.shop
interactiedovspm.shop
weiggheticulop.shop
cagedwifedsozm.shop
charecteristicdxp.shop
deicedosmzj.shop
refrigaterpsm.shop
potentioallykeos.shop
(PID) Process(6452) SearchIndexer.exe
C2 (9)consciousourwi.shop
southedhiscuso.shop
interactiedovspm.shop
weiggheticulop.shop
cagedwifedsozm.shop
charecteristicdxp.shop
deicedosmzj.shop
refrigaterpsm.shop
potentioallykeos.shop
(PID) Process(6520) SearchIndexer.exe
C2 (9)consciousourwi.shop
southedhiscuso.shop
interactiedovspm.shop
weiggheticulop.shop
cagedwifedsozm.shop
charecteristicdxp.shop
deicedosmzj.shop
refrigaterpsm.shop
potentioallykeos.shop
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
210
Monitored processes
29
Malicious processes
14
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe setup.exe strcmp.exe no specs more.com no specs conhost.exe no specs setup.exe no specs more.com no specs conhost.exe no specs #LUMMA searchindexer.exe setup.exe no specs more.com no specs conhost.exe no specs #LUMMA searchindexer.exe no specs #LUMMA searchindexer.exe THREAT wy0r1kzjlmamr5w8c16.exe rundll32.exe no specs pe7bderd3we1veavunkk9t.exe no specs powershell.exe no specs conhost.exe no specs THREAT msbuild.exe THREAT k7rms1uaoi9paydpvzktbynfhynsux.exe no specs textinputhost.exe no specs cu92urrp6zqe1kr4q01v7d.exe no specs powershell.exe no specs conhost.exe no specs msbuild.exe werfault.exe oakley.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
532"C:\Users\admin\AppData\Local\oakley.exe"C:\Users\admin\AppData\Local\oakley.exe—svchost.exe
User:
admin
Company:
Argotronic GmbH
Integrity Level:
MEDIUM
Description:
ArgusMonitor Setup
Version:
7.0.4.2720
Modules
Images
c:\users\admin\appdata\local\oakley.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
840"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\bcryptprimitives.dll
c:\windows\syswow64\winmm.dll
876C:\WINDOWS\SysWOW64\SearchIndexer.exeC:\Windows\SysWOW64\SearchIndexer.exe
more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Indexer
Exit code:
0
Version:
7.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\jeiawpe
c:\windows\syswow64\searchindexer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
Lumma
(PID) Process(876) SearchIndexer.exe
C2 (9)consciousourwi.shop
southedhiscuso.shop
interactiedovspm.shop
weiggheticulop.shop
cagedwifedsozm.shop
charecteristicdxp.shop
deicedosmzj.shop
refrigaterpsm.shop
potentioallykeos.shop
1420"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Full_Setup_Use_2390_P͜@s$WⓞRÐ☑.rarC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1544"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
3221225477
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2080"C:\Users\admin\AppData\Local\Temp\PE7BDERD3WE1VEAVUNKK9T.exe"C:\Users\admin\AppData\Local\Temp\PE7BDERD3WE1VEAVUNKK9T.exe—SearchIndexer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR
Exit code:
0
Version:
7.1.0
Modules
Images
c:\users\admin\appdata\local\temp\pe7bderd3we1veavunkk9t.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2608powershell -exec bypass -f "C:\Users\admin\AppData\Local\Temp\APAKTV8FLY4KIKQA.ps1"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—SearchIndexer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
2992"C:\Users\admin\AppData\Local\Temp\K7RMS1UAOI9PAYDPVZKTBYNFHYNSUX.exe"C:\Users\admin\AppData\Local\Temp\K7RMS1UAOI9PAYDPVZKTBYNFHYNSUX.exe
SearchIndexer.exe
User:
admin
Company:
Argotronic GmbH
Integrity Level:
MEDIUM
Description:
ArgusMonitor Setup
Exit code:
4294967295
Version:
7.0.4.2720
Modules
Images
c:\users\admin\appdata\local\temp\k7rms1uaoi9paydpvzktbynfhynsux.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3068"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa1420.49047\✪OPEN✵FILE✪✓.rarC:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3292powershell -exec bypass -f "C:\Users\admin\AppData\Local\Temp\LXY4W4PKBOP3X38HL3JGB.ps1"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—SearchIndexer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
Total events
55 009
Read events
54 917
Write events
92
Delete events
0

Modification events

(PID) Process:(1420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(1420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Full_Setup_Use_2390_P͜@s$WⓞRÐ☑.rar
(PID) Process:(1420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Comment
Operation:writeName:LeftBorder
Value:
472
(PID) Process:(1420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
117
Suspicious files
13
Text files
23
Unknown types
1

Dropped files

PID
Process
Filename
Type
1420WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1420.49047\✪OPEN✵FILE✪✓.rar —
MD5:—
SHA256:—
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3068.078\✪OPEN✵FILE✪✓\x86\api-ms-win-core-rtlsupport-l1-1-0.dllexecutable
MD5:0069FD29263C0DD90314C48BBCE852EF
SHA256:D11093FDC1D5C9213B9B2886CE91DB3DED17EF8DAE1615A8C7FFBC55B8E3F79B
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3068.078\✪OPEN✵FILE✪✓\updater\manager\ks_tyres.initext
MD5:47F6571C7884DA6C743551AC724186D4
SHA256:894D3C57598ECB22C769CC3EA8219859A95E22740E72394A474012EA2119B3D9
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3068.078\✪OPEN✵FILE✪✓\x86\api-ms-win-core-synch-l1-2-0.dllexecutable
MD5:659E4FEBC208545A2E23C0C8B881A30D
SHA256:9AC63682E03D55A5D18405D336634AF080DD0003B565D12A39D6D71AAA989F48
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3068.078\✪OPEN✵FILE✪✓\Setup.exeexecutable
MD5:AD2735F096925010A53450CB4178C89E
SHA256:4E775B5FAFB4E6D89A4694F8694D2B8B540534BD4A52FF42F70095F1C929160E
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3068.078\✪OPEN✵FILE✪✓\x86\api-ms-win-core-util-l1-1-0.dllexecutable
MD5:C6553959AECD5BAC01C0673CFDF86B68
SHA256:68BD9C086D210EB14E78F00988BA88CEAF9056C8F10746AB024990F8512A2296
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3068.078\✪OPEN✵FILE✪✓\x86\api-ms-win-core-string-l1-1-0.dllexecutable
MD5:2E5C29FC652F432B89A1AFE187736C4D
SHA256:3807DB7ACF1B40C797E4D4C14A12C3806346AE56B25E205E600BE3E635C18D4F
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3068.078\✪OPEN✵FILE✪✓\x86\api-ms-win-core-sysinfo-l1-1-0.dllexecutable
MD5:CEF4B9F680FAAE322170B961A3421C5B
SHA256:1FE918979F1653D63BB713D4716910D192CD09F50017A6ECB4CE026ED6285DF9
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3068.078\✪OPEN✵FILE✪✓\x86\api-ms-win-core-profile-l1-1-0.dllexecutable
MD5:6EE66DCA31C5CCE57740D677C85B4CE7
SHA256:D00A0EDACE14715BF79DBD17B715D8A74A2300F0ADB1F3FC137EDFB7074C9B0A
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3068.078\✪OPEN✵FILE✪✓\x86\api-ms-win-crt-conio-l1-1-0.dllexecutable
MD5:7190CBFAD2D7773D3B88CCC25533A651
SHA256:4AEEAE0AC9F6C1B0B8835067EA3B7FC429F353565F18DE7858F4EA5D6F72072E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
114
DNS requests
73
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2272
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6672
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2272
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6720
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1028
SystemSettings.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1028
SystemSettings.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6340
svchost.exe
HEAD
200
217.20.57.24:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/062b65bc-b6a4-4f5a-8413-7218292237fe?P1=1724201909&P2=404&P3=2&P4=ZRCtZ91n4Pogxt44jI4Hr7DBiicFSth70nq8iSau03OzJuiCUfdFuYuuE80HnhMm3%2b13BKsuEZkCndqbaI5MmQ%3d%3d
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4208
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6012
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5336
SearchApp.exe
92.123.104.25:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2272
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 92.123.104.25
  • 92.123.104.30
  • 92.123.104.26
  • 92.123.104.19
  • 92.123.104.23
  • 92.123.104.22
  • 92.123.104.21
  • 92.123.104.28
  • 92.123.104.31
  • 2.23.209.168
  • 2.23.209.183
  • 2.23.209.176
  • 2.23.209.182
  • 2.23.209.167
  • 2.23.209.171
  • 2.23.209.181
  • 2.23.209.166
  • 2.23.209.175
  • 92.123.104.29
  • 92.123.104.15
  • 92.123.104.18
  • 92.123.104.16
  • 92.123.104.20
  • 92.123.104.32
  • 92.123.104.37
  • 92.123.104.33
  • 92.123.104.38
  • 92.123.104.35
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.64
  • 20.190.159.2
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.4
  • 20.190.159.68
whitelisted
client.wns.windows.com
  • 40.113.110.67
  • 40.113.103.199
whitelisted
th.bing.com
  • 92.123.104.31
  • 92.123.104.25
  • 92.123.104.30
  • 92.123.104.26
  • 92.123.104.19
  • 92.123.104.23
  • 92.123.104.22
  • 92.123.104.21
  • 92.123.104.28
  • 92.123.104.29
  • 92.123.104.32
  • 92.123.104.37
  • 92.123.104.33
  • 92.123.104.38
  • 92.123.104.35
whitelisted
arc.msn.com
  • 20.105.99.58
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted

Threats

PID
Process
Class
Message
876
SearchIndexer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
2256
svchost.exe
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
876
SearchIndexer.exe
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
6520
SearchIndexer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
6520
SearchIndexer.exe
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Full_Setup_Use_2390_P͜@s$WⓞRÐ☑.rar