File name:

Crack Ulead Photo Express 6 0.rar.7z

Full analysis: https://app.any.run/tasks/ec9e2dd3-698d-4f1e-86a0-36ec685f110d
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: February 15, 2025, 17:54:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
autoit-loader
lumma
stealer
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

3286D33D0E0DBBC0C409C55B1691165D

SHA1:

7A56352491D85F7AA1DC3E72C7042300ACFA6646

SHA256:

3BF72B2F0DC069944B93F20C5E86230CC6B4CC5B403A9F6610F8B70CA50C419A

SSDEEP:

196608:agkme5SEDsH0/ZH20ClVvDItsHMTIA8QIBmDO:agkme5FQU/ZWuoMUAowO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been detected (SURICATA)

      • Arabic.com (PID: 3772)
      • svchost.exe (PID: 2192)

    • Actions looks like stealing of personal data

      • Arabic.com (PID: 3772)

    • LUMMA mutex has been found

      • Arabic.com (PID: 3772)

    • AutoIt loader has been detected (YARA)

      • Arabic.com (PID: 3772)

    • Connects to the CnC server

      • svchost.exe (PID: 2192)

    • Steals credentials from Web Browsers

      • Arabic.com (PID: 3772)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5592)
      • crack ulead photo express 6 0.rar.exe (PID: 4140)

    • Starts CMD.EXE for commands execution

      • crack ulead photo express 6 0.rar.exe (PID: 4140)
      • cmd.exe (PID: 3532)

    • Executing commands from a ".bat" file

      • crack ulead photo express 6 0.rar.exe (PID: 4140)

    • Get information on the list of running processes

      • cmd.exe (PID: 3532)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3532)

    • The executable file from the user directory is run by the CMD process

      • Arabic.com (PID: 3772)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3532)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2192)
      • Arabic.com (PID: 3772)

    • Searches for installed software

      • Arabic.com (PID: 3772)

    • There is functionality for taking screenshot (YARA)

      • Arabic.com (PID: 3772)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 3532)

    • Application launched itself

      • cmd.exe (PID: 3532)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 5592)

    • Checks supported languages

      • crack ulead photo express 6 0.rar.exe (PID: 4140)
      • expand.exe (PID: 5748)
      • Arabic.com (PID: 3772)
      • extrac32.exe (PID: 5252)

    • Reads the computer name

      • crack ulead photo express 6 0.rar.exe (PID: 4140)
      • Arabic.com (PID: 3772)
      • extrac32.exe (PID: 5252)

    • Create files in a temporary directory

      • expand.exe (PID: 5748)
      • crack ulead photo express 6 0.rar.exe (PID: 4140)
      • extrac32.exe (PID: 5252)

    • Process checks computer location settings

      • crack ulead photo express 6 0.rar.exe (PID: 4140)

    • Reads mouse settings

      • Arabic.com (PID: 3772)

    • Reads the software policy settings

      • Arabic.com (PID: 3772)

    • Creates a new folder

      • cmd.exe (PID: 5628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
19
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs rundll32.exe no specs winrar.exe no specs crack ulead photo express 6 0.rar.exe no specs cmd.exe no specs conhost.exe no specs expand.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA arabic.com choice.exe no specs #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
540cmd /c copy /b ..\Namibia.xls + ..\Alan.xls + ..\Limitations.xls + ..\Computer.xls + ..\Men.xls + ..\Bryan.xls + ..\Certificates.xls + ..\Watts.xls H C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3532"C:\WINDOWS\system32\cmd.exe" /c expand Valves.xls Valves.xls.bat & Valves.xls.batC:\Windows\SysWOW64\cmd.exe—crack ulead photo express 6 0.rar.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3772Arabic.com H C:\Users\admin\AppData\Local\Temp\210993\Arabic.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\210993\arabic.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
3816\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3992choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
4140"C:\Users\admin\AppData\Local\Temp\Rar$EXb5592.45700\crack ulead photo express 6 0.rar.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb5592.45700\crack ulead photo express 6 0.rar.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb5592.45700\crack ulead photo express 6 0.rar.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4548tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4592findstr /V "pupils" Controls C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
4624cmd /c copy /b 210993\Arabic.com + Approval + Cholesterol + Plenty + Reaches + Benefit + Zope + Dale + Cp + Sensors + Oldest + Imagination 210993\Arabic.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
4 477
Read events
4 460
Write events
17
Delete events
0

Modification events

(PID) Process:(6484) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6484) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6484) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6484) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6484) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6484) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_0
Value:
4C000000730100000402000000000000F0F0F00000000000000000000000000000000000000000001603050000000000000000003B000000B402000000000000000000000000000001000000
(PID) Process:(6484) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_1
Value:
4C000000730100000500000000000000F0F0F0000000000000000000000000000000000000000000060305000000000000000000180000002A00000000000000000000000000000002000000
(PID) Process:(6484) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_2
Value:
4C000000730100000400000000000000F0F0F0000000000000000000000000000000000000000000C20206000000000000000000180000006400000000000000000000000000000003000000
(PID) Process:(5592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5592) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
0
Suspicious files
22
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5592WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb5592.45700\crack ulead photo express 6 0.rar.exe —
MD5:—
SHA256:—
4140crack ulead photo express 6 0.rar.exeC:\Users\admin\AppData\Local\Temp\Computer.xlsbinary
MD5:30400E574D4AB9712C19770FE995EF1F
SHA256:E1861FADEC05BF22DA8BAB0436990ACC35D68847D78BF140E7A0E7AF3F46D9A5
5252extrac32.exeC:\Users\admin\AppData\Local\Temp\Cpbinary
MD5:2B8A576A5176797713F708962E4EF4F9
SHA256:AC786EF1EE2EF00887B46AEEB308F118DA017F776E4A93D0593BE0A0F0D385D4
4140crack ulead photo express 6 0.rar.exeC:\Users\admin\AppData\Local\Temp\Valves.xlstext
MD5:8A88D483165EB766EABBD6D51B2D87A7
SHA256:8F476CF288A133A273B4246C79F2C3B10DA444E4A428E8597BF39B67EB08360C
4140crack ulead photo express 6 0.rar.exeC:\Users\admin\AppData\Local\Temp\Alan.xlsbinary
MD5:509D882D25965E8A823B670EB2A76238
SHA256:33376E37C471F169356BA7F9555560DCC4F063B3F5A8E76369D9B94E1047BA6E
4140crack ulead photo express 6 0.rar.exeC:\Users\admin\AppData\Local\Temp\Ii.xlscompressed
MD5:7FE41A83AB6AD006DB9A1C28B8CA3EC1
SHA256:F698159AB0BE5B50284D3FDBB903A2E77C814E9EDFAAE7BDA18AE34513A946F2
5252extrac32.exeC:\Users\admin\AppData\Local\Temp\Approvalbinary
MD5:91983E305A84719726F0ECAAF00FC4A3
SHA256:44040CDE9FAA895796644B346B67E9F39D113B97D464143537EC9669CAD24264
5252extrac32.exeC:\Users\admin\AppData\Local\Temp\Controlsbinary
MD5:C72236CAEEA8855E0B2BABF7E5F55BA7
SHA256:0C0C627756CD24BE429B5893E813A341D4941F966D657B974546E4CFBF7D4AC9
4140crack ulead photo express 6 0.rar.exeC:\Users\admin\AppData\Local\Temp\Certificates.xlsbinary
MD5:6D2DE9590B607EC4D0F9B6FCDFB06E13
SHA256:9A54E926AF101DDD5F34D4C48AFA21217983AF7BE75D88296B5D300ABF4A257F
5252extrac32.exeC:\Users\admin\AppData\Local\Temp\Dalebinary
MD5:F24BC2C05B161A38723BE86EDC26CB60
SHA256:D5395389454DDEE5BD5D8F44A07094FDFBA44206D5D7A3481BABD5E4F453AF3B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
39
DNS requests
24
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3508
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6176
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7036
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7036
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3508
svchost.exe
GET
200
23.48.23.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
92.123.104.12:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.141:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3508
svchost.exe
23.48.23.141:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3508
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.160.5:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
www.bing.com
  • 92.123.104.12
  • 92.123.104.8
  • 92.123.104.23
  • 92.123.104.29
  • 92.123.104.35
  • 92.123.104.20
  • 92.123.104.33
  • 92.123.104.13
  • 92.123.104.32
whitelisted
crl.microsoft.com
  • 23.48.23.141
  • 23.48.23.167
  • 23.48.23.173
  • 23.48.23.180
  • 23.48.23.169
  • 23.48.23.143
  • 23.48.23.194
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 216.58.206.46
whitelisted
login.live.com
  • 20.190.160.5
  • 20.190.160.66
  • 40.126.32.74
  • 20.190.160.128
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.136
  • 20.190.160.3
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shiningrstars .help)
3772
Arabic.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (shiningrstars .help in TLS SNI)
3772
Arabic.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (shiningrstars .help in TLS SNI)
3772
Arabic.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (shiningrstars .help in TLS SNI)
3772
Arabic.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (shiningrstars .help in TLS SNI)
3772
Arabic.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (shiningrstars .help in TLS SNI)
3772
Arabic.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (shiningrstars .help in TLS SNI)
2192
svchost.exe
Misc activity
ET FILE_SHARING Anonymous File Sharing Domain in DNS Lookup (qu .ax)
3772
Arabic.com
Misc activity
ET FILE_SHARING Observed Anonymous File Sharing Service Domain (qu .ax) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Crack Ulead Photo Express 6 0.rar.7z