File name:

QV3_Install_FiveM.exe

Full analysis: https://app.any.run/tasks/1dec0ef9-b4b6-49a9-a267-24a22c347947
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 26, 2025, 23:09:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
lumma
stealer
pastebin
github
telegram
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 15 sections
MD5:

1C791F7A8249199461E8CBD1307304FC

SHA1:

806F3C1BC62BEAF53C540F30B1F82746D98079FB

SHA256:

775D25D0BC3125AE6DF9A2E84CD448E2108AE7EDF6D66916E39F97E9B5CB86E2

SSDEEP:

98304:kNwv1yaHSj4ELpbG00DaGZhhz2YaOhXysrJJ6NU+Mu0McPoXNfEVZSCdMIt/py0u:3dOvcP5YHZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been found (auto)

      • QV3_Install_FiveM.exe (PID: 7560)

    • LUMMA mutex has been found

      • MSBuild.exe (PID: 7764)

    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 7764)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 7764)

    • LUMMA has been detected (YARA)

      • MSBuild.exe (PID: 7764)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • QV3_Install_FiveM.exe (PID: 7560)
      • QV3_Install_FiveM.exe (PID: 7332)

    • Executable content was dropped or overwritten

      • QV3_Install_FiveM.exe (PID: 7560)
      • QV3_Install_FiveM.exe (PID: 7332)

    • Multiple wallet extension IDs have been found

      • MSBuild.exe (PID: 7764)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 7764)

    • Searches for installed software

      • MSBuild.exe (PID: 7764)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 7764)

  • INFO

    • Drops encrypted JS script (Microsoft Script Encoder)

      • QV3_Install_FiveM.exe (PID: 7560)
      • QV3_Install_FiveM.exe (PID: 7332)

    • Reads the computer name

      • QV3_Install_FiveM.exe (PID: 7560)
      • MSBuild.exe (PID: 7764)
      • QV3_Install_FiveM.exe (PID: 7332)
      • MSBuild.exe (PID: 1804)

    • Checks supported languages

      • QV3_Install_FiveM.exe (PID: 7560)
      • b1756fb4852dab830.exe (PID: 7732)
      • MSBuild.exe (PID: 7764)
      • QV3_Install_FiveM.exe (PID: 7332)
      • 3167afe87df78f980.exe (PID: 1188)
      • MSBuild.exe (PID: 1804)

    • Reads the software policy settings

      • QV3_Install_FiveM.exe (PID: 7560)
      • MSBuild.exe (PID: 7764)
      • QV3_Install_FiveM.exe (PID: 7332)
      • MSBuild.exe (PID: 1804)

    • Reads the machine GUID from the registry

      • QV3_Install_FiveM.exe (PID: 7560)
      • QV3_Install_FiveM.exe (PID: 7332)

    • Creates files or folders in the user directory

      • QV3_Install_FiveM.exe (PID: 7560)
      • QV3_Install_FiveM.exe (PID: 7332)

    • Manual execution by a user

      • QV3_Install_FiveM.exe (PID: 7332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 2626048
InitializedDataSize: 305152
UninitializedDataSize: -
EntryPoint: 0x775e0
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
12
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start qv3_install_fivem.exe conhost.exe no specs powershell.exe no specs b1756fb4852dab830.exe no specs #LUMMA msbuild.exe rundll32.exe no specs qv3_install_fivem.exe conhost.exe no specs powershell.exe no specs 3167afe87df78f980.exe no specs msbuild.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1188C:\Users\admin\AppData\Roaming\3167afe87df78f980.exeC:\Users\admin\AppData\Roaming\3167afe87df78f980.exe—QV3_Install_FiveM.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\3167afe87df78f980.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1804"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3167afe87df78f980.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll
2616C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5972powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—QV3_Install_FiveM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6108C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
7304\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—QV3_Install_FiveM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7332"C:\Users\admin\AppData\Local\Temp\QV3_Install_FiveM.exe" C:\Users\admin\AppData\Local\Temp\QV3_Install_FiveM.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\qv3_install_fivem.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
c:\windows\system32\ws2_32.dll
7560"C:\Users\admin\AppData\Local\Temp\QV3_Install_FiveM.exe" C:\Users\admin\AppData\Local\Temp\QV3_Install_FiveM.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\qv3_install_fivem.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
7568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—QV3_Install_FiveM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7636powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—QV3_Install_FiveM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
15 946
Read events
15 946
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
1
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
7636powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bie1ikfw.tcp.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7636powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ea3uuf1e.dmb.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7560QV3_Install_FiveM.exeC:\Users\admin\AppData\Roaming\b1756fb4852dab830.exeexecutable
MD5:FE24967C6D43D203F919EA480E624A62
SHA256:6301E3D7BE8CA5958DC510E6B6BA39BBA211693F2542C9A5F4C0E02C46215733
5972powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uwxsvgfd.uzh.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5972powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_5vflsfti.4rm.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7332QV3_Install_FiveM.exeC:\Users\admin\AppData\Roaming\3167afe87df78f980.exeexecutable
MD5:FE24967C6D43D203F919EA480E624A62
SHA256:6301E3D7BE8CA5958DC510E6B6BA39BBA211693F2542C9A5F4C0E02C46215733
7636powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:C090FAC0B7A3B801E427F8F085CF20E1
SHA256:0958D4C564CDC6CED470892A963C4E62012008A82AD7E20AEB8CB1771CABF5FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
33
DNS requests
19
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1660
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1660
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6384
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5796
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7560
QV3_Install_FiveM.exe
104.22.69.199:443
pastebin.com
CLOUDFLARENET
—
whitelisted
7560
QV3_Install_FiveM.exe
140.82.121.4:443
github.com
GITHUB
US
whitelisted
7560
QV3_Install_FiveM.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 216.58.206.46
whitelisted
pastebin.com
  • 104.22.69.199
  • 172.67.25.94
  • 104.22.68.199
whitelisted
github.com
  • 140.82.121.4
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.109.133
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
t.me
  • 149.154.167.99
whitelisted
medbnel.digital
  • 104.21.96.1
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.64.1
  • 104.21.32.1
  • 104.21.16.1
  • 104.21.80.1
unknown
login.live.com
  • 20.190.159.131
  • 40.126.31.1
  • 20.190.159.129
  • 20.190.159.64
  • 20.190.159.71
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.23
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
7764
MSBuild.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
1804
MSBuild.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
QV3_Install_FiveM.exe