File name:

Fluxus V7.exe

Full analysis: https://app.any.run/tasks/feca983b-f49b-4b7a-82c7-f84889a38456
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: February 02, 2025, 21:00:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections
MD5:

2D676C78134580C27793364767873644

SHA1:

8580910BC719A3EF4EAC5B39D68F51C959902D8B

SHA256:

88B9F5DE84ADE1958B5F499C6B42D55F2701A6019DD5A6330DAD9147A328D48F

SSDEEP:

12288:PeFTBikgOykfiMD/K2R1B1W7FQOxbUo1fVZCiiZFpdQbGNZfBM6hsWbT:PeF1ikgOXfi4K2R1B1W7FQOxbU4rCtZF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Fluxus V7.exe (PID: 6272)
      • Fluxus V7.exe (PID: 6424)

    • LUMMA mutex has been found

      • Fluxus V7.exe (PID: 6424)

    • Steals credentials from Web Browsers

      • Fluxus V7.exe (PID: 6424)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2192)

    • Connects to the CnC server

      • svchost.exe (PID: 2192)

    • Actions looks like stealing of personal data

      • Fluxus V7.exe (PID: 6424)

    • LUMMA has been detected (YARA)

      • Fluxus V7.exe (PID: 6424)

  • SUSPICIOUS

    • Application launched itself

      • Fluxus V7.exe (PID: 6272)

    • Executes application which crashes

      • Fluxus V7.exe (PID: 6272)

    • There is functionality for taking screenshot (YARA)

      • Fluxus V7.exe (PID: 6424)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2192)

    • Searches for installed software

      • Fluxus V7.exe (PID: 6424)

  • INFO

    • Checks supported languages

      • Fluxus V7.exe (PID: 6272)
      • Fluxus V7.exe (PID: 6424)

    • Reads the computer name

      • Fluxus V7.exe (PID: 6272)
      • Fluxus V7.exe (PID: 6424)

    • Reads the software policy settings

      • Fluxus V7.exe (PID: 6424)
      • WerFault.exe (PID: 6584)

    • .NET Reactor protector has been detected

      • Fluxus V7.exe (PID: 6424)
      • Fluxus V7.exe (PID: 6272)

    • Manual execution by a user

      • firefox.exe (PID: 3060)

    • Application launched itself

      • firefox.exe (PID: 3544)
      • firefox.exe (PID: 3060)

    • Checks proxy server information

      • WerFault.exe (PID: 6584)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (61.6)
.dll | Win32 Dynamic Link Library (generic) (14.6)
.exe | Win32 Executable (generic) (10)
.exe | Win16/32 Executable Delphi generic (4.6)
.exe | Generic Win/DOS Executable (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2092:03:28 02:52:36+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 56320
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xfb8e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Account
FileVersion: 1.0.0.0
InternalName: Account.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: Account.exe
ProductName: Account
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
166
Monitored processes
37
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start fluxus v7.exe #LUMMA fluxus v7.exe werfault.exe #LUMMA svchost.exe rundll32.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3056 -childID 8 -isForBrowser -prefsHandle 5644 -prefMapHandle 5640 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1548 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30e0f059-1ff1-4b5f-a21f-08e184398350} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 226caf884d0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
648"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5192 -childID 11 -isForBrowser -prefsHandle 5820 -prefMapHandle 5824 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1548 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35bf8eca-d07e-4783-bc9c-8035d53ff5fc} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 226caf88f50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
836"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1904 -parentBuildID 20240213221259 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f658459-4be1-414f-ac56-04133737fe0e} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 226c20ee810 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
1296"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5808 -childID 10 -isForBrowser -prefsHandle 5684 -prefMapHandle 5680 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1548 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59c607ee-8deb-4405-81b7-0237ee29d603} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 226caf88850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1380"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 9 -isForBrowser -prefsHandle 5468 -prefMapHandle 2672 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1548 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {742281aa-8dcd-44bd-b17b-47581c19c7a0} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 226caf88690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2132"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5116 -childID 5 -isForBrowser -prefsHandle 5108 -prefMapHandle 5104 -prefsLen 31144 -prefMapSize 244583 -jsInitHandle 1548 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c80996b9-c2a5-4f43-bdf5-64ca9bbe912d} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 226c46e7150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2548"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 6 -isForBrowser -prefsHandle 4388 -prefMapHandle 4632 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1548 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9030b28-cf65-4624-af2b-f77643597b50} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 226c8898690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
3060"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
3544"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
28 136
Read events
28 135
Write events
1
Delete events
0

Modification events

(PID) Process:(3544) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
Executable files
0
Suspicious files
64
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
6584WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Fluxus V7.exe_c9bcb5528fb7faa66ffdd764983c0a443ad9835_5a91d3e3_993db76d-923f-4412-b906-a4404180cee4\Report.wer —
MD5:—
SHA256:—
6584WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Fluxus V7.exe.6272.dmp —
MD5:—
SHA256:—
3544firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
6584WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER669D.tmp.dmpbinary
MD5:54B50A1FEC2D113151F634C7F3E8FFD5
SHA256:51CE0F39DC112F95AB2C2E1CAD00190C58BC0B06BA9CF11343102500FB368090
6584WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
3544firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-child-current.binbinary
MD5:C95DDC2B1A525D1A243E4C294DA2F326
SHA256:3A5919E086BFB31E36110CF636D2D5109EB51F2C410B107F126126AB25D67363
3544firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.jstext
MD5:2C99A16AED3906D92FFE3EF1808E2753
SHA256:08412578CC3BB4922388F8FF8C23962F616B69A1588DA720ADE429129C73C452
6584WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:680B0331A3CC8FCCE16367586EC7A721
SHA256:19F1B5D2C7F62663C14D97578411DC610E5F33E6CE4165977314442435F15305
6584WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:76C6AEF939DB3906E2148B08D4C48783
SHA256:1F516AD794B1CC186888932432BB5948CFDE173D8E8F0A68D15ADDC3C9ACC8C4
3544firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
60
DNS requests
76
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6584
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6584
WerFault.exe
GET
200
2.16.164.27:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3544
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
3544
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
95.101.54.211:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
95.101.54.211:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
216.58.206.67:80
http://o.pki.goog/s/wr3/jLM
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
95.101.54.211:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5064
SearchApp.exe
2.21.65.153:443
www.bing.com
Akamai International B.V.
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.160.65:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
6424
Fluxus V7.exe
104.21.112.1:443
clammypunero.com
CLOUDFLARENET
—
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted
6584
WerFault.exe
52.168.117.173:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.21.65.153
  • 2.21.65.157
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
login.live.com
  • 20.190.160.65
  • 20.190.160.4
  • 40.126.32.138
  • 40.126.32.72
  • 20.190.160.128
  • 20.190.160.20
  • 20.190.160.66
  • 20.190.160.132
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
thehealthylifesstop.top
  • —
unknown
clammypunero.com
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.80.1
  • 104.21.64.1
  • 104.21.32.1
  • 104.21.96.1
  • 104.21.48.1
malicious
watson.events.data.microsoft.com
  • 52.168.117.173
whitelisted
crl.microsoft.com
  • 2.16.164.27
  • 2.16.164.43
  • 2.16.164.74
  • 2.16.164.33
  • 2.16.164.58
  • 2.16.164.34
  • 2.16.164.96
  • 2.16.164.32
  • 2.16.164.73
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thehealthylifesstop .top)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fluxus V7.exe