File name:

lnstaIIer_x86_patched.exe

Full analysis: https://app.any.run/tasks/ab56a85c-c485-4829-a369-0515bc2cb533
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 12:26:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
telegram
lumma
stealer
auto-startup
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

60B4E1B885190679650D67EE61C1001B

SHA1:

137ED46C6C6BF25749A9501DDBB9A5CB83FEAE6D

SHA256:

3C5B807F1F2662333D52AD59FD320624F8AB4D69D140F83015D938AB1A507847

SSDEEP:

98304:8voHQ5RXi4LThckz9llHYxYdripA3XIgFMPSB69rnMk2:UhCo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • cmd.exe (PID: 8148)

    • Actions looks like stealing of personal data

      • Mu.com (PID: 8092)

    • Steals credentials from Web Browsers

      • Mu.com (PID: 8092)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

    • LUMMA mutex has been found

      • Mu.com (PID: 8092)

    • AutoIt loader has been detected (YARA)

      • Mu.com (PID: 8092)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • lnstaIIer_x86_patched.exe (PID: 7680)

    • Starts CMD.EXE for commands execution

      • lnstaIIer_x86_patched.exe (PID: 7680)
      • cmd.exe (PID: 7744)

    • Executing commands from a ".bat" file

      • lnstaIIer_x86_patched.exe (PID: 7680)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7744)

    • Get information on the list of running processes

      • cmd.exe (PID: 7744)

    • Application launched itself

      • cmd.exe (PID: 7744)

    • The executable file from the user directory is run by the CMD process

      • Mu.com (PID: 8092)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 7744)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7744)

    • There is functionality for taking screenshot (YARA)

      • Mu.com (PID: 8092)

    • Executable content was dropped or overwritten

      • Mu.com (PID: 8092)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Mu.com (PID: 8092)

    • Searches for installed software

      • Mu.com (PID: 8092)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)

  • INFO

    • Reads the computer name

      • lnstaIIer_x86_patched.exe (PID: 7680)
      • extrac32.exe (PID: 8000)
      • Mu.com (PID: 8092)

    • The sample compiled with english language support

      • lnstaIIer_x86_patched.exe (PID: 7680)
      • Mu.com (PID: 8092)

    • Checks supported languages

      • lnstaIIer_x86_patched.exe (PID: 7680)
      • extrac32.exe (PID: 8000)
      • Mu.com (PID: 8092)

    • Process checks computer location settings

      • lnstaIIer_x86_patched.exe (PID: 7680)

    • Create files in a temporary directory

      • lnstaIIer_x86_patched.exe (PID: 7680)
      • extrac32.exe (PID: 8000)

    • Creates a new folder

      • cmd.exe (PID: 7980)

    • Reads mouse settings

      • Mu.com (PID: 8092)

    • Creates files or folders in the user directory

      • Mu.com (PID: 8092)

    • Auto-launch of the file from Startup directory

      • cmd.exe (PID: 8148)

    • Manual execution by a user

      • cmd.exe (PID: 8148)

    • Reads the machine GUID from the registry

      • Mu.com (PID: 8092)

    • Reads the software policy settings

      • Mu.com (PID: 8092)
      • slui.exe (PID: 5056)

    • Attempting to use instant messaging service

      • Mu.com (PID: 8092)

    • Checks proxy server information

      • slui.exe (PID: 5056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 432128
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 135.0.7049.85
ProductVersionNumber: 135.0.7049.85
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Google LLC
FileDescription: Google Chrome
FileVersion: 135.0.7049.85
InternalName: chrome_exe
LegalCopyright: Copyright 2025 Google LLC. All rights reserved.
OriginalFileName: chrome.exe
ProductName: Google Chrome
ProductVersion: 135.0.7049.85
CompanyShortName: Google
ProductShortName: Chrome
LastChange: 1e112499da812a1dde62101ed601dcb93024aaff-refs/branch-heads/7049@{#1779}
OfficialBuild: 1
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
18
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start lnstaiier_x86_patched.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA mu.com choice.exe no specs cmd.exe conhost.exe no specs slui.exe #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5056C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7680"C:\Users\admin\Desktop\lnstaIIer_x86_patched.exe" C:\Users\admin\Desktop\lnstaIIer_x86_patched.exe—explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
135.0.7049.85
Modules
Images
c:\users\admin\desktop\lnstaiier_x86_patched.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7744"C:\WINDOWS\System32\cmd.exe" /c copy Neural.tmp Neural.tmp.bat & Neural.tmp.batC:\Windows\SysWOW64\cmd.exe—lnstaIIer_x86_patched.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7800tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7808findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7920tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7928findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7980cmd /c md 255244C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
7 329
Read events
7 329
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
20
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
7680lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Guardian.tmpbinary
MD5:3CB24139B5414C03471E2FB4D4A922BD
SHA256:E09CE938DA670C3A0AD616B78806D9EA7CF18E8DC9E865171A54203A07336990
7680lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Cents.tmpbinary
MD5:F0A2E40F87DA9CEFCBF8821851697177
SHA256:A455225587A08FB58355D0C86E400F952CA9F423460040D3015A095F702DA614
7680lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Taxi.tmpbinary
MD5:2C73AD9657BB4351A56E27D789DA441D
SHA256:533E2513E0C67364E724C27B8429A03BE41A1F4A082BB67623659E1B8CF7D79A
7680lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Invitations.tmpbinary
MD5:B1F0AE657F0CFFAFF4905A2B89BE0063
SHA256:0E0AA6C8B70C090EACE0A914242834C5BB4EE9A9D41F9EC5E3309D5CD67870CE
7680lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Nature.tmpbinary
MD5:7BA6F0A4E3077CEF88BEA7655A68F42F
SHA256:D65696D18B24965AE30C486857CFBD60F263AC7BFDCA9BFB8597F5A98B457CFB
7680lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Dive.tmpbinary
MD5:FAB32BF32E35A329BF118CBA01B5F131
SHA256:906BC7436BA83D7B71D486B0868D1E3CC39B9D7257D4AF18FE9091BDBDE42310
7680lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Neural.tmptext
MD5:1E504DF6035018F01FB2671E63C833B0
SHA256:947EE3D8EBD9ED9D5EE7B07664771A5B1EB63079E53EB992A7D0F4DD7E3B8BB8
8000extrac32.exeC:\Users\admin\AppData\Local\Temp\Admitbinary
MD5:3AD30209DB6811B65E54662D9116E995
SHA256:4D881FCF820138D533352A88949F0EA85A9A1C6BDAA6F2BDA55AE990ACD15DBE
8000extrac32.exeC:\Users\admin\AppData\Local\Temp\Compilebinary
MD5:A45BC2C0ED130A1DC5016777D7BC4F75
SHA256:BD3038984F53531B5C3208E8C8C82F7A20AAF6F0EB1F1776E1EBB96E958AA5F1
8000extrac32.exeC:\Users\admin\AppData\Local\Temp\Cosmeticsbinary
MD5:CEAD9663776A8A31CA64418F0B43DA96
SHA256:9AF8504FF2B703B66956898447EB65A9778FE0C339355FC1CCABB28E175F695F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
47
DNS requests
24
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7248
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
200
4.175.87.197:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
—
—
—
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7248
SIHClient.exe
GET
200
23.48.23.144:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7248
SIHClient.exe
GET
200
23.48.23.144:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7248
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7248
SIHClient.exe
GET
200
23.48.23.144:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
—
—
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
POST
400
40.126.32.133:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
8092
Mu.com
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
whitelisted
8092
Mu.com
172.67.163.30:443
eplinko.us
CLOUDFLARENET
US
unknown
7248
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7248
SIHClient.exe
23.48.23.144:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7248
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7248
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.184.206
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.130
  • 20.190.160.64
  • 20.190.160.67
  • 20.190.160.17
  • 20.190.160.2
  • 40.126.32.74
  • 40.126.32.133
whitelisted
qyphIBaHSKl.qyphIBaHSKl
  • —
unknown
t.me
  • 149.154.167.99
whitelisted
eplinko.us
  • 172.67.163.30
  • 104.21.15.162
unknown
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
crl.microsoft.com
  • 23.48.23.144
  • 23.48.23.140
  • 23.48.23.156
  • 23.48.23.168
  • 23.48.23.141
  • 23.48.23.193
  • 23.48.23.173
  • 23.48.23.158
  • 23.48.23.174
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
8092
Mu.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (changeaie .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (piratetwrath .run)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nighetwhisper .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (quilltayle .live)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (salaccgfa .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (liftally .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zestmodp .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (starofliught .top)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
lnstaIIer_x86_patched.exe