File name:

e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.zip

Full analysis: https://app.any.run/tasks/a356940c-06f0-42b8-b317-a9e38658a8eb
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: April 05, 2025, 04:54:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
stealer
lumma
golang
delphi
crypto-regex
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

CABDD9E70811B2BDDAC3677227E0C2B5

SHA1:

301643F9C8704E64D5F5894243731BC32AB6A421

SHA256:

88999DDDD1F462BA23650EC7B6A9263D014F601425837EB0986133A0F3D78FC0

SSDEEP:

98304:GxcokoNhK2FKg+3sK8svHwODaQHHCoKOyJNcygPOdcaiYhJGGaU2C7EABIZweq32:cN4pR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been found (auto)

      • WinRAR.exe (PID: 496)
      • chrome.exe (PID: 7936)

    • Stealers network behavior

      • svchost.exe (PID: 2196)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)

    • LUMMA mutex has been found

      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)

    • Steals credentials from Web Browsers

      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)

    • Actions looks like stealing of personal data

      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)

    • Changes the autorun value in the registry

      • BGATHPXLFUYYN2ZYT.exe (PID: 7636)
      • reg.exe (PID: 7844)

    • Executing a file with an untrusted certificate

      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)
      • BGATHPXLFUYYN2ZYT.exe (PID: 7636)
      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)

    • Searches for installed software

      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)

    • Executable content was dropped or overwritten

      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)
      • BGATHPXLFUYYN2ZYT.exe (PID: 7636)
      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • Connects to unusual port

      • BGATHPXLFUYYN2ZYT.exe (PID: 7636)
      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • Found regular expressions for crypto-addresses (YARA)

      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • There is functionality for communication over UDP network (YARA)

      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • Starts CMD.EXE for commands execution

      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6660)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 496)
      • chrome.exe (PID: 7936)
      • BGATHPXLFUYYN2ZYT.exe (PID: 7636)
      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)
      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)
      • chrome.exe (PID: 2656)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 496)
      • chrome.exe (PID: 7936)
      • chrome.exe (PID: 2656)

    • Manual execution by a user

      • chrome.exe (PID: 7936)

    • Reads the software policy settings

      • slui.exe (PID: 7268)
      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)
      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)
      • slui.exe (PID: 2420)

    • Reads the computer name

      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)
      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • Checks supported languages

      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)
      • BGATHPXLFUYYN2ZYT.exe (PID: 7636)
      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • Autorun file from Downloads

      • chrome.exe (PID: 7936)

    • Application launched itself

      • chrome.exe (PID: 7936)

    • Create files in a temporary directory

      • e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe (PID: 7656)
      • BGATHPXLFUYYN2ZYT.exe (PID: 7636)

    • Creates files or folders in the user directory

      • BGATHPXLFUYYN2ZYT.exe (PID: 7636)

    • Application based on Golang

      • BGATHPXLFUYYN2ZYT.exe (PID: 7636)

    • Compiled with Borland Delphi (YARA)

      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • Creates files in the program directory

      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • Reads the machine GUID from the registry

      • MZWRK0D3J2TINBIX7AW6TZWGC9Q1.exe (PID: 5244)

    • Detects GO elliptic curve encryption (YARA)

      • BGATHPXLFUYYN2ZYT.exe (PID: 7636)

    • Checks proxy server information

      • slui.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2025:04:01 22:23:58
ZipCRC: 0x2119b5b5
ZipCompressedSize: 1853842
ZipUncompressedSize: 4478976
ZipFileName: e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
35
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start #LUMMA winrar.exe sppextcomobj.exe no specs slui.exe #LUMMA chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs #LUMMA e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe slui.exe #LUMMA svchost.exe bgathpxlfuyyn2zyt.exe mzwrk0d3j2tinbix7aw6tzwgc9q1.exe cmd.exe no specs conhost.exe no specs reg.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
680"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3796 --field-trial-handle=1964,i,13917967562658338723,14889618717850258684,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2152"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3736 --field-trial-handle=1964,i,13917967562658338723,14889618717850258684,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5416 --field-trial-handle=1964,i,13917967562658338723,14889618717850258684,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2420C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2656"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5688 --field-trial-handle=1964,i,13917967562658338723,14889618717850258684,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3124"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3836 --field-trial-handle=1964,i,13917967562658338723,14889618717850258684,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4428"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3372 --field-trial-handle=1964,i,13917967562658338723,14889618717850258684,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4552 --field-trial-handle=1964,i,13917967562658338723,14889618717850258684,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
15 492
Read events
15 432
Write events
52
Delete events
8

Modification events

(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.zip
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7936) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
Executable files
15
Suspicious files
354
Text files
26
Unknown types
1

Dropped files

PID
Process
Filename
Type
7936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF112e60.TMP —
MD5:—
SHA256:—
7936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
7936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF112e60.TMP —
MD5:—
SHA256:—
7936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
7936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF112e70.TMP —
MD5:—
SHA256:—
7936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF112e70.TMP —
MD5:—
SHA256:—
7936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF112e70.TMP —
MD5:—
SHA256:—
7936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
47
DNS requests
42
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7812
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7812
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7708
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
7708
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
7708
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
7708
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
7708
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
7708
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.10.31.115:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
google.com
  • 142.250.186.142
whitelisted
client.wns.windows.com
  • 20.10.31.115
whitelisted
login.live.com
  • 40.126.31.2
  • 40.126.31.67
  • 40.126.31.129
  • 20.190.159.128
  • 20.190.159.71
  • 40.126.31.131
  • 20.190.159.4
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
clientservices.googleapis.com
  • 216.58.206.67
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (castmaxw .run)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (oreheatq .live)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (steelixr .live)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (advennture .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (weldorae .digital)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (castmaxw .run)
7656
e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (advennture .top in TLS SNI)
7656
e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (advennture .top in TLS SNI)
7656
e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (advennture .top in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
e71f1a3b5fa9efd9c6b2ef512902f852bf3b8e1cf9f395292f01d72753173062.zip