File name:

VIRUSES.zip

Full analysis: https://app.any.run/tasks/bce03aca-bc87-4bf8-99fe-e7eddf3f1f47
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 19:47:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
lumma
stealer
telegram
vidar
enigma
delphi
antivm
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

45A71F5F24F1E1B3B0B717C1DE6D0167

SHA1:

4D9807BE2DD263C075D409C8E6246CCE23558D14

SHA256:

DA3E4EA2FF5C13C721B5B4A0FC20D52E528699146E1548E8765EE785FD22588A

SSDEEP:

98304:nrDNAD1S/zj72Ywgw/I1K2J9B+bQNHbMyCpodCQu2jdjZ2mhRgolBhKxsgA6nTmo:aVYMWIFWX+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7284)

    • LUMMA mutex has been found

      • chel.exe (PID: 7844)
      • chinainstal.exe (PID: 7188)
      • rad.exe (PID: 6184)
      • winf.exe (PID: 2692)
      • chiises.exe (PID: 8016)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • chiises.exe (PID: 8016)

    • Steals credentials from Web Browsers

      • chel.exe (PID: 7844)
      • chinainstal.exe (PID: 7188)
      • rad.exe (PID: 6184)
      • winf.exe (PID: 2692)
      • fir.exe (PID: 2384)
      • chiises.exe (PID: 8016)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

    • Actions looks like stealing of personal data

      • chel.exe (PID: 7844)
      • chinainstal.exe (PID: 7188)
      • rad.exe (PID: 6184)
      • fir.exe (PID: 2384)
      • winf.exe (PID: 2692)
      • chiises.exe (PID: 8016)

    • VIDAR mutex has been found

      • fir.exe (PID: 2384)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6644)
      • cmd.exe (PID: 2084)

    • LUMMA has been detected (YARA)

      • chiises.exe (PID: 8016)
      • chel.exe (PID: 7844)
      • chinainstal.exe (PID: 7188)

    • VIDAR has been detected (YARA)

      • fir.exe (PID: 2384)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7284)
      • fir.exe (PID: 2384)
      • sec.exe (PID: 6872)
      • service.exe (PID: 3024)

    • Contacting a server suspected of hosting an CnC

      • chiises.exe (PID: 8016)
      • svchost.exe (PID: 2196)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • fir.exe (PID: 2384)
      • winf.exe (PID: 2692)

    • Executable content was dropped or overwritten

      • sec.exe (PID: 6872)

    • There is functionality for taking screenshot (YARA)

      • chel.exe (PID: 7844)
      • chiises.exe (PID: 8016)
      • fir.exe (PID: 2384)
      • chinainstal.exe (PID: 7188)

    • Searches for installed software

      • chel.exe (PID: 7844)
      • chinainstal.exe (PID: 7188)
      • fir.exe (PID: 2384)
      • rad.exe (PID: 6184)
      • winf.exe (PID: 2692)
      • chiises.exe (PID: 8016)

    • There is functionality for VM detection VirtualBox (YARA)

      • chel.exe (PID: 7844)
      • chiises.exe (PID: 8016)
      • chinainstal.exe (PID: 7188)

    • Starts CMD.EXE for commands execution

      • sec.exe (PID: 6872)
      • service.exe (PID: 3024)

    • Multiple wallet extension IDs have been found

      • fir.exe (PID: 2384)

    • The process executes via Task Scheduler

      • service.exe (PID: 3024)

  • INFO

    • Checks supported languages

      • chel.exe (PID: 7844)
      • chiises.exe (PID: 8016)
      • chinainstal.exe (PID: 7188)
      • fir.exe (PID: 2384)
      • rad.exe (PID: 6184)
      • winf.exe (PID: 2692)
      • sec.exe (PID: 6872)
      • service.exe (PID: 3024)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7284)
      • chrome.exe (PID: 5200)

    • Reads the computer name

      • chel.exe (PID: 7844)
      • chiises.exe (PID: 8016)
      • chinainstal.exe (PID: 7188)
      • rad.exe (PID: 6184)
      • sec.exe (PID: 6872)
      • fir.exe (PID: 2384)
      • winf.exe (PID: 2692)
      • service.exe (PID: 3024)

    • Reads the software policy settings

      • chel.exe (PID: 7844)
      • chiises.exe (PID: 8016)
      • chinainstal.exe (PID: 7188)
      • fir.exe (PID: 2384)
      • rad.exe (PID: 6184)
      • winf.exe (PID: 2692)
      • slui.exe (PID: 7476)

    • Creates files in the program directory

      • fir.exe (PID: 2384)

    • Checks proxy server information

      • fir.exe (PID: 2384)

    • Reads the machine GUID from the registry

      • fir.exe (PID: 2384)

    • Process checks computer location settings

      • sec.exe (PID: 6872)
      • service.exe (PID: 3024)

    • Creates files or folders in the user directory

      • fir.exe (PID: 2384)
      • sec.exe (PID: 6872)

    • Compiled with Borland Delphi (YARA)

      • chel.exe (PID: 7844)
      • chiises.exe (PID: 8016)
      • chinainstal.exe (PID: 7188)

    • Reads product name

      • fir.exe (PID: 2384)

    • Reads Environment values

      • fir.exe (PID: 2384)

    • Reads CPU info

      • fir.exe (PID: 2384)

    • Enigma protector has been detected

      • chiises.exe (PID: 8016)
      • chel.exe (PID: 7844)
      • chinainstal.exe (PID: 7188)

    • Application launched itself

      • chrome.exe (PID: 7596)

    • Manual execution by a user

      • mmc.exe (PID: 7832)
      • mmc.exe (PID: 5608)
      • mmc.exe (PID: 6156)
      • mmc.exe (PID: 132)

    • The sample compiled with english language support

      • chrome.exe (PID: 5200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(7844) chel.exe
C2 (9)parakehjet.run/kewk
buzzarddf.live/ktnt
zenithcorde.top/auid
bearjk.live/benj
techguidet.digital/apdo
techsyncq.run/riid
netscoute.digital/quwe
btcgeared.live/lbak
fishgh.digital/tequ
(PID) Process(8016) chiises.exe
C2 (9)woodpeckersd.run/glsk
mobitront.run/dsiu
parakehjet.run/kewk
buzzarddf.live/ktnt
bearjk.live/benj
biosphxere.digital/tqoa
fishgh.digital/tequ
geographys.run/eirq
tropiscbs.live/iuwxx
(PID) Process(7188) chinainstal.exe
C2 (8)parakehjet.run/kewk
buzzarddf.live/ktnt
zenithcorde.top/auid
bearjk.live/benj
techguidet.digital/apdo
techsyncq.run/riid
btcgeared.live/lbak
fishgh.digital/tequ

Vidar

(PID) Process(2384) fir.exe
C2https://t.me/m00f3r
URLhttps://steamcommunity.com/profiles/76561199851454339
RC43333333333333333UUUUUUUUUUUUUUUU
Strings (1)
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:04:29 18:22:56
ZipCRC: 0xe93fea9d
ZipCompressedSize: 1293173
ZipUncompressedSize: 1297920
ZipFileName: chel.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
197
Monitored processes
55
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe #LUMMA chel.exe #LUMMA svchost.exe #LUMMA chiises.exe chinainstal.exe no specs #LUMMA chinainstal.exe #VIDAR fir.exe #LUMMA rad.exe sec.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs #LUMMA winf.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs service.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs slui.exe mmc.exe no specs mmc.exe chrome.exe chrome.exe no specs chrome.exe no specs mmc.exe no specs mmc.exe chrome.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\WINDOWS\system32\mmc.exe" "C:\WINDOWS\system32\taskschd.msc" /sC:\Windows\System32\mmc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mmc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
812"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5576 --field-trial-handle=1968,i,17492033410892573678,2320010835166066232,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1128"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3772 --field-trial-handle=1968,i,17492033410892573678,2320010835166066232,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1188C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1324"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5568 --field-trial-handle=1968,i,17492033410892573678,2320010835166066232,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1616"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4544 --field-trial-handle=1968,i,17492033410892573678,2320010835166066232,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1616"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5552 --field-trial-handle=1968,i,17492033410892573678,2320010835166066232,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2084"C:\Windows\System32\cmd.exe" /C schtasks /create /tn GoogleUpdaterex /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /fC:\Windows\SysWOW64\cmd.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2384"C:\Users\admin\AppData\Local\Temp\Rar$EXa7284.40222\fir.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7284.40222\fir.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7284.40222\fir.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Vidar
(PID) Process(2384) fir.exe
C2https://t.me/m00f3r
URLhttps://steamcommunity.com/profiles/76561199851454339
RC43333333333333333UUUUUUUUUUUUUUUU
Strings (1)
Total events
27 939
Read events
27 829
Write events
100
Delete events
10

Modification events

(PID) Process:(7284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\VIRUSES.zip
(PID) Process:(7284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2384) fir.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2384) fir.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
53
Suspicious files
175
Text files
44
Unknown types
1

Dropped files

PID
Process
Filename
Type
7284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7284.39743\fir.exeexecutable
MD5:CF2529889606402259675B9CB23D8B56
SHA256:387E2FA2E5BF8C93AEF6C1BAB3EE0B3D95255D9422DDDE9B6331E8395D51A176
7284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7284.39943\fir.exeexecutable
MD5:CF2529889606402259675B9CB23D8B56
SHA256:387E2FA2E5BF8C93AEF6C1BAB3EE0B3D95255D9422DDDE9B6331E8395D51A176
7284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7284.39943\chiises.exeexecutable
MD5:9E08A29371C64669E3518533BC49C603
SHA256:D58C734650C9F8ACD6A79A5EB27E608DA57F4A4DB4F9C6103E3E5F71FFF5C592
7284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7284.39743\sec.exeexecutable
MD5:2FF8E057084B5C180E9B447E08D2D747
SHA256:169154BD365801FC16A02C8C58E50450544E6FF6DB7480D9703D591042729538
7284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7284.39743\winf.exeexecutable
MD5:5260D66905E1DB31CAA1939CAA30F06D
SHA256:0AC7A20A33E86EAD614099518C119A3C80A5353CB39A5FE7C7300BA3555927F2
7284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7284.39943\rad.exeexecutable
MD5:0557DB2B75B348EA26C6EEE128A32FF1
SHA256:DAD5FAB34206B5D8F0391D5B54E85ADA40598BD2237A309EB1B682AF62458F96
7284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7284.39943\chel.exeexecutable
MD5:88474B8E10D4D666E3872EF4D87CFC77
SHA256:F9D64216D7102CA78450C45079D80CF74DE780CE07BD450CE852934A3B078365
7284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7284.39743\rad.exeexecutable
MD5:0557DB2B75B348EA26C6EEE128A32FF1
SHA256:DAD5FAB34206B5D8F0391D5B54E85ADA40598BD2237A309EB1B682AF62458F96
7284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7284.39943\chinainstal.exeexecutable
MD5:3A64EE01E74E78217EC32474E93061BB
SHA256:E7FE47FC827AEB1F77CA5460EED7730E39D1068AF8891E2A94B7655989BD56A9
7284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7284.40098\chinainstal.exeexecutable
MD5:3A64EE01E74E78217EC32474E93061BB
SHA256:E7FE47FC827AEB1F77CA5460EED7730E39D1068AF8891E2A94B7655989BD56A9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
117
DNS requests
74
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6572
RUXIMICS.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6572
RUXIMICS.exe
GET
200
23.200.189.225:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.200.189.225:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.200.189.225:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2384
fir.exe
GET
200
2.16.106.9:80
http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2ttjyD6VkMQQUDcXM%2FZvuFAWhTDCCpT5eisNYCdICEgaKc14QkOr%2FLKXh4Wlg%2FShyow%3D%3D
unknown
—
—
whitelisted
2384
fir.exe
GET
200
104.66.97.47:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7416
SIHClient.exe
GET
200
23.200.189.225:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6572
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
6572
RUXIMICS.exe
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
6572
RUXIMICS.exe
23.200.189.225:80
www.microsoft.com
Moratelindo Internet Exchange Point
ID
whitelisted
5496
MoUsoCoreWorker.exe
23.200.189.225:80
www.microsoft.com
Moratelindo Internet Exchange Point
ID
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.179.206
whitelisted
crl.microsoft.com
  • 2.18.121.147
whitelisted
www.microsoft.com
  • 23.200.189.225
whitelisted
login.live.com
  • 40.126.31.1
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
netscoute.digital
  • —
malicious
zenithcorde.top
  • 104.21.51.232
malicious
mobitront.run
  • 188.114.97.0
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (zenithcorde .top)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobitront .run)
8016
chiises.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (mobitront .run) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bearjk .live)
2384
fir.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
2692
winf.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (geographys .run)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (woodpeckersd .run)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (biosphxere .digital)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VIRUSES.zip