URL:

www.mediafire.com/file/0j3c5o213uvt6of/XWorm.zip/file

Full analysis: https://app.any.run/tasks/7d33e230-e9d0-4e4b-852b-f9816d4bf82f
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: April 26, 2025, 00:23:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
miner
winring0x64-sys
vuln-driver
Indicators:
MD5:

9F358711F7CDF06593F45B5B7CA91825

SHA1:

C7378F3EDC7386490B5EBB56243C647757C846CC

SHA256:

512162BC91020AF79B46CBEE553728FF74D50E4469A0B945A0A1EE595BC9E190

SSDEEP:

3:ER63eGUoVuFBc:h3eGxUG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • msedge.exe (PID: 7324)

    • Connects to the CnC server

      • msedge.exe (PID: 7324)
      • svchost.exe (PID: 2196)
      • svchost.exe (PID: 2240)

    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 2240)

    • Vulnerable driver has been detected

      • updater.exe (PID: 8172)

  • SUSPICIOUS

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 8360)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 8360)

    • Application launched itself

      • WinRAR.exe (PID: 8360)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 4268)

    • Executable content was dropped or overwritten

      • svc.exe (PID: 8096)
      • updater.exe (PID: 8172)

    • Executes application which crashes

      • Xworm V5.6.exe (PID: 5136)
      • svc.exe (PID: 7376)
      • Xworm V5.6.exe (PID: 4284)
      • Xworm V5.6.exe (PID: 8280)
      • svc.exe (PID: 3992)
      • Xworm V5.6.exe (PID: 8140)
      • svc.exe (PID: 7392)
      • Xworm V5.6.exe (PID: 6068)
      • svc.exe (PID: 6660)
      • Xworm V5.6.exe (PID: 8460)
      • Xworm V5.6.exe (PID: 536)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • msedge.exe (PID: 7324)

    • Uses REG/REGEDIT.EXE to modify registry

      • powershell.exe (PID: 8792)
      • powershell.exe (PID: 6436)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 3096)
      • cmd.exe (PID: 8000)

    • The process checks if current user has admin rights

      • updater.exe (PID: 8172)

    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 8172)

    • Starts POWERSHELL.EXE for commands execution

      • updater.exe (PID: 8172)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 6960)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2240)

    • Connects to unusual port

      • svchost.exe (PID: 2240)

  • INFO

    • Reads Environment values

      • identity_helper.exe (PID: 9172)

    • Reads the computer name

      • identity_helper.exe (PID: 9172)

    • Application launched itself

      • msedge.exe (PID: 6620)

    • Checks supported languages

      • identity_helper.exe (PID: 9172)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 8360)
      • msedge.exe (PID: 6620)

    • Manual execution by a user

      • WinRAR.exe (PID: 7896)
      • WinRAR.exe (PID: 4268)
      • Xworm V5.6.exe (PID: 5136)
      • XwormLoader.exe (PID: 8364)
      • Xworm V5.6.exe (PID: 4284)
      • cmd.exe (PID: 8000)
      • cmd.exe (PID: 3096)
      • powershell.exe (PID: 8792)
      • powershell.exe (PID: 8040)
      • XwormLoader.exe (PID: 1660)
      • XwormLoader.exe (PID: 8620)
      • Xworm V5.6.exe (PID: 8280)
      • Xworm V5.6.exe (PID: 8140)
      • XwormLoader.exe (PID: 8460)
      • conhost.exe (PID: 8792)
      • cmd.exe (PID: 6960)
      • cmd.exe (PID: 4012)
      • svchost.exe (PID: 2240)
      • XwormLoader.exe (PID: 5084)
      • XwormLoader.exe (PID: 8568)
      • XwormLoader.exe (PID: 7592)
      • Xworm V5.6.exe (PID: 6068)
      • XwormLoader.exe (PID: 2340)
      • XwormLoader.exe (PID: 8288)
      • XwormLoader.exe (PID: 2776)
      • XwormLoader.exe (PID: 3796)
      • XwormLoader.exe (PID: 9004)
      • XwormLoader.exe (PID: 8728)
      • XwormLoader.exe (PID: 8892)
      • Xworm V5.6.exe (PID: 8460)
      • Xworm V5.6.exe (PID: 536)
      • XwormLoader.exe (PID: 4268)
      • XwormLoader.exe (PID: 7736)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 8060)

    • Reads the software policy settings

      • slui.exe (PID: 3140)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4268)

    • The sample compiled with japanese language support

      • updater.exe (PID: 8172)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
301
Monitored processes
155
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs #LUMMA msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs notepad.exe no specs winrar.exe no specs winrar.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe msedge.exe no specs slui.exe rundll32.exe no specs xworm v5.6.exe svc.exe checker.exe no specs werfault.exe no specs gist.exe no specs msedge.exe no specs xwormloader.exe no specs conhost.exe no specs #LUMMA svchost.exe cmd.exe no specs powershell.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs reg.exe no specs powershell.exe no specs conhost.exe no specs THREAT updater.exe xworm v5.6.exe openwith.exe no specs svc.exe werfault.exe no specs werfault.exe no specs xwormloader.exe no specs conhost.exe no specs xwormloader.exe no specs conhost.exe no specs xworm v5.6.exe msedge.exe no specs svc.exe werfault.exe no specs werfault.exe no specs msedge.exe no specs xworm v5.6.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs svc.exe werfault.exe no specs werfault.exe no specs xwormloader.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs wmic.exe no specs msedge.exe no specs #MINER svchost.exe xwormloader.exe no specs conhost.exe no specs xwormloader.exe no specs conhost.exe no specs msedge.exe no specs xwormloader.exe no specs conhost.exe no specs xwormloader.exe no specs conhost.exe no specs xwormloader.exe no specs conhost.exe no specs xwormloader.exe no specs conhost.exe no specs xwormloader.exe no specs conhost.exe no specs msedge.exe no specs xwormloader.exe no specs conhost.exe no specs xwormloader.exe no specs conhost.exe no specs xwormloader.exe no specs conhost.exe no specs xwormloader.exe no specs conhost.exe no specs xwormloader.exe no specs conhost.exe no specs xworm v5.6.exe xworm v5.6.exe svc.exe xworm v5.6.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Users\admin\Desktop\XWorm 5.6\Xworm V5.6.exe" C:\Users\admin\Desktop\XWorm 5.6\Xworm V5.6.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\xworm 5.6\xworm v5.6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
720C:\WINDOWS\system32\WerFault.exe -u -p 8460 -s 1540C:\Windows\System32\WerFault.exe—Xworm V5.6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
960"C:\WINDOWS\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v GoogleUpdateTaskMachineQC /t REG_SZ /f /d C:\Users\admin\AppData\Roaming\Google\Chrome\updater.exeC:\Windows\System32\reg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1348"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1576 --field-trial-handle=2376,i,9347849691955947164,14397997739992110932,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1660"C:\Users\admin\Desktop\XWorm 5.6\XwormLoader.exe" C:\Users\admin\Desktop\XWorm 5.6\XwormLoader.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\xworm 5.6\xwormloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1676"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5828 --field-trial-handle=2376,i,9347849691955947164,14397997739992110932,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—XwormLoader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2240C:\WINDOWS\System32\svchost.exe rdivktoinsbrqenp 6E3sjfZq2rJQaxvLPmXgsFbIFjbxmk9QBL7MU6NBupT4bFjOM5ljkjva9Wuwf0mKrI0a+E9AE4BrmmhamSqTGuFa4LTaCOVDVXMuFOwqXoCUKfP0M8Y6F7ry6LjlwpABqWFUXMzKNovRG6R0WU637t4oLVi7FzpX9g6uTKPr7FY1pFteKvpv26DBzJE5n4ElFy2SlYXulLSXhuopVWKuAkYp6c4e79CIqF2IeTTCFjsq/LVqKudM064ZUYJvS1hJ78o2RHoMPfbjyQFCM+O5Xkzab/C+dW5F5FlUkrqynnPQnmXczTXGCgnyMFbhO8Ll1ls0wUgDsXB4Iiy8ixddCvcxu3Hd4J12th6ZFFxBJcihDR/s7PJcBR/Nfo70v4eqKbvCdM19m9/vR1xTvoYZ0IUG0FiqPvAlTVZUWobcPm4jRFqfW0ea+c4Z1KEkkx6g1YA8LXN0PlRxlpfR3yUvL2CHLQYitGQl2UMZZw04MET0qduwX2YwKSTzJ1Qmy1vEMvWqvzSlzX3kjR9c9DB8KQ==C:\Windows\System32\svchost.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\shjjdazu.tmp
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
58 418
Read events
58 332
Write events
86
Delete events
0

Modification events

(PID) Process:(6620) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
85A0FEBF39922F00
(PID) Process:(6620) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\656106
Operation:writeName:WindowTabManagerFileMappingId
Value:
{66FC88ED-34FF-4C81-9C1D-5426E7306997}
(PID) Process:(6620) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6620) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6620) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6620) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6620) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
F983F1BF39922F00
(PID) Process:(6620) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\656106
Operation:writeName:WindowTabManagerFileMappingId
Value:
{C01CDFA9-4C52-44D2-B2DB-C231ACDAE478}
(PID) Process:(6620) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\656106
Operation:writeName:WindowTabManagerFileMappingId
Value:
{E360943E-4C2C-4938-ADDA-808B84696D7C}
(PID) Process:(6620) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\656106
Operation:writeName:WindowTabManagerFileMappingId
Value:
{C189D8BD-B440-45A3-B41A-0D6DBDC2388B}
Executable files
65
Suspicious files
483
Text files
98
Unknown types
0

Dropped files

PID
Process
Filename
Type
6620msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b519.TMP —
MD5:—
SHA256:—
6620msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6620msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b529.TMP —
MD5:—
SHA256:—
6620msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
6620msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b538.TMP —
MD5:—
SHA256:—
6620msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6620msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b538.TMP —
MD5:—
SHA256:—
6620msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6620msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b538.TMP —
MD5:—
SHA256:—
6620msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
246
DNS requests
347
Threats
56

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8512
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8512
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8668
svchost.exe
HEAD
200
2.22.242.227:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/23e5dd61-e224-4d56-858f-6ee086574ada?P1=1746054429&P2=404&P3=2&P4=I7L7c3QUw9LxiAwnBDwbaNML7D6BTG7aY%2fPvZWzvnbOWaXRkyEYYNcE2mtyMAEn%2frHaigCWkew1dKW650iIQWg%3d%3d
unknown
—
—
whitelisted
8668
svchost.exe
GET
206
2.22.242.227:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/23e5dd61-e224-4d56-858f-6ee086574ada?P1=1746054429&P2=404&P3=2&P4=I7L7c3QUw9LxiAwnBDwbaNML7D6BTG7aY%2fPvZWzvnbOWaXRkyEYYNcE2mtyMAEn%2frHaigCWkew1dKW650iIQWg%3d%3d
unknown
—
—
whitelisted
8668
svchost.exe
GET
206
2.22.242.227:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/23e5dd61-e224-4d56-858f-6ee086574ada?P1=1746054429&P2=404&P3=2&P4=I7L7c3QUw9LxiAwnBDwbaNML7D6BTG7aY%2fPvZWzvnbOWaXRkyEYYNcE2mtyMAEn%2frHaigCWkew1dKW650iIQWg%3d%3d
unknown
—
—
whitelisted
8668
svchost.exe
GET
206
2.22.242.227:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/23e5dd61-e224-4d56-858f-6ee086574ada?P1=1746054429&P2=404&P3=2&P4=I7L7c3QUw9LxiAwnBDwbaNML7D6BTG7aY%2fPvZWzvnbOWaXRkyEYYNcE2mtyMAEn%2frHaigCWkew1dKW650iIQWg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6620
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
7324
msedge.exe
104.21.42.32:443
the.gatekeeperconsent.com
—
—
unknown
7324
msedge.exe
104.17.151.117:443
www.mediafire.com
—
—
whitelisted
7324
msedge.exe
172.67.199.186:443
the.gatekeeperconsent.com
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
google.com
  • 216.58.212.142
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.mediafire.com
  • 104.17.150.117
  • 104.17.151.117
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
business.bing.com
  • 150.171.27.20
  • 150.171.28.20
whitelisted
bzib.nelreports.net
  • 2.16.168.219
  • 2.16.168.201
whitelisted

Threats

PID
Process
Class
Message
7324
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
7324
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
7324
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
7324
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
7324
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
7324
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
7324
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7324
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7324
msedge.exe
Potentially Bad Traffic
ET FILE_SHARING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
7324
msedge.exe
Potentially Bad Traffic
ET FILE_SHARING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
www.mediafire.com/file/0j3c5o213uvt6of/XWorm.zip/file