File name:

jenny_mod_forge_1.12.2-v1.9.0.jar.7z

Full analysis: https://app.any.run/tasks/943cd5ff-4ff6-458a-b6f0-ec83bd130cfc
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 11:13:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
lumma
stealer
autoit-loader
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

90A9FF279CB5113608426C6715363031

SHA1:

785BEC8A9D06AFF93BFD96A11C570688A0BD4C55

SHA256:

7CB504B8C926EBA6EE8B9273826A4F9AED871880141AAB7FB51D9BD9E65147F8

SSDEEP:

98304:NkdFQGUAkE4Yf/YhrKdIl444lQs5VOVpFAWaEdvPHZXfXB2op4NXZTbTfbVCkBVK:Ehzy+m77hvphJYRQIsIb44rHS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Deployment.com (PID: 536)

    • LUMMA mutex has been found

      • Deployment.com (PID: 536)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

    • LUMMA has been detected (SURICATA)

      • Deployment.com (PID: 536)
      • svchost.exe (PID: 2196)

  • SUSPICIOUS

    • Application launched itself

      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 6424)

    • Executing commands from a ".bat" file

      • jenny_mod_forge_1.12.2-v1.9.0.jar.exe (PID: 4756)
      • jenny_mod_forge_1.12.2-v1.9.0.jar.exe (PID: 3268)

    • Get information on the list of running processes

      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 6424)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 6424)

    • Starts CMD.EXE for commands execution

      • jenny_mod_forge_1.12.2-v1.9.0.jar.exe (PID: 4756)
      • cmd.exe (PID: 2108)
      • jenny_mod_forge_1.12.2-v1.9.0.jar.exe (PID: 3268)
      • cmd.exe (PID: 6424)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 6424)

    • The executable file from the user directory is run by the CMD process

      • Deployment.com (PID: 536)
      • Deployment.com (PID: 5988)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 6424)

    • There is functionality for taking screenshot (YARA)

      • jenny_mod_forge_1.12.2-v1.9.0.jar.exe (PID: 4756)
      • Deployment.com (PID: 536)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • Deployment.com (PID: 536)

  • INFO

    • Reads the computer name

      • jenny_mod_forge_1.12.2-v1.9.0.jar.exe (PID: 4756)
      • extrac32.exe (PID: 6824)
      • Deployment.com (PID: 5988)

    • Checks supported languages

      • jenny_mod_forge_1.12.2-v1.9.0.jar.exe (PID: 4756)
      • Deployment.com (PID: 536)
      • jenny_mod_forge_1.12.2-v1.9.0.jar.exe (PID: 3268)

    • Manual execution by a user

      • jenny_mod_forge_1.12.2-v1.9.0.jar.exe (PID: 4756)
      • jenny_mod_forge_1.12.2-v1.9.0.jar.exe (PID: 3268)

    • Creates a new folder

      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 5116)

    • Create files in a temporary directory

      • jenny_mod_forge_1.12.2-v1.9.0.jar.exe (PID: 4756)
      • extrac32.exe (PID: 4244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
31
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs jenny_mod_forge_1.12.2-v1.9.0.jar.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA deployment.com choice.exe no specs #LUMMA svchost.exe slui.exe no specs jenny_mod_forge_1.12.2-v1.9.0.jar.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs deployment.com no specs choice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516cmd /c copy /b 303996\Deployment.com + Increasing + Accepted + Poultry + Approximate + Eu + Internal + Proceed + Respond + Sg + Lime 303996\Deployment.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
536Deployment.com p C:\Users\admin\AppData\Local\Temp\303996\Deployment.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\303996\deployment.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
632findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
872cmd /c copy /b 303996\Deployment.com + Increasing + Accepted + Poultry + Approximate + Eu + Internal + Proceed + Respond + Sg + Lime 303996\Deployment.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1128findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
1132tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1272"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\jenny_mod_forge_1.12.2-v1.9.0.jar.7zC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1532tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2108"C:\WINDOWS\system32\CMD.exe" /c copy Ancient.vssm Ancient.vssm.bat & Ancient.vssm.batC:\Windows\SysWOW64\cmd.exe—jenny_mod_forge_1.12.2-v1.9.0.jar.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
3 553
Read events
3 534
Write events
19
Delete events
0

Modification events

(PID) Process:(1272) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1272) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1272) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1272) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1272) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\jenny_mod_forge_1.12.2-v1.9.0.jar.7z
(PID) Process:(1272) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1272) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1272) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1272) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1272) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
0
Suspicious files
21
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1272.16021\jenny_mod_forge_1.12.2-v1.9.0.jar.exe —
MD5:—
SHA256:—
4756jenny_mod_forge_1.12.2-v1.9.0.jar.exeC:\Users\admin\AppData\Local\Temp\Contracting.vssmbinary
MD5:13968FF70669776D1BBA8C82FD287C24
SHA256:17075FBBC49DAA3B44A6C0B9D99988547FE4E33B9C36DBB014EC3FD72AD33A6E
4756jenny_mod_forge_1.12.2-v1.9.0.jar.exeC:\Users\admin\AppData\Local\Temp\Live.vssmbinary
MD5:34ACCF96BB4BAF82E3D2E745D85BEACF
SHA256:3324E3A02E864FA6264E9EE683BC3732A5570B1E5866AEB2D05E1AA391BC6B24
4756jenny_mod_forge_1.12.2-v1.9.0.jar.exeC:\Users\admin\AppData\Local\Temp\Wma.vssmbinary
MD5:B3B14CBEB12D2FB8E63893C83BA0B366
SHA256:6948DC453B5CFF1AC31042AA0C01CD797C49051FEAE8DA3D89D51B6933A30B2B
4756jenny_mod_forge_1.12.2-v1.9.0.jar.exeC:\Users\admin\AppData\Local\Temp\Worst.vssmbinary
MD5:4D20BA8A71B0D31E9952F13A8DBB6B25
SHA256:C0A6BB7CB957CDEC5E099DABF8350D5F17F1E156F010B077C2F561F39C7BA0E6
4756jenny_mod_forge_1.12.2-v1.9.0.jar.exeC:\Users\admin\AppData\Local\Temp\Lawsuit.vssmbinary
MD5:FAD5BA5A90EACEFD1E9E41825E53A2CE
SHA256:E37AF8BFFD4B76E2543F1A4E2808EB5D9FBECBC40D615348D1397B5C52DE1505
4756jenny_mod_forge_1.12.2-v1.9.0.jar.exeC:\Users\admin\AppData\Local\Temp\Urls.vssmcompressed
MD5:746FDC941A4CC28DDEB09E6D6CA3B967
SHA256:52A69082E64FF709BA6E9BA4450B31E624BD180EC2B8D3731416F9B591D7BE8B
4244extrac32.exeC:\Users\admin\AppData\Local\Temp\Eubinary
MD5:BC95CEED5397F5D34EA189D760563494
SHA256:A8880C11022A37C2F8D4A49D4E367400BF37385E2BD68A7CEC2B51674776BFC0
4756jenny_mod_forge_1.12.2-v1.9.0.jar.exeC:\Users\admin\AppData\Local\Temp\Ancient.vssmtext
MD5:1525F5A30D0A5223DE9A96701CBC820C
SHA256:40DFC0457F6927173CF3B3F2AD6C272E0E8DED1F52BF8822F1BA937F4699C138
4244extrac32.exeC:\Users\admin\AppData\Local\Temp\Internalbinary
MD5:A3B7F8A11DB20C85F8C377058F0E67D9
SHA256:5B791E96C6427167AF7F0C9816D8BFDEA902CF2C64CE7AD7C2A6269A6813021C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
26
DNS requests
19
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2392
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2392
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6988
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6988
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6988
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.72
  • 2.16.164.18
  • 2.16.164.120
  • 2.16.164.51
  • 2.16.164.9
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.68
  • 20.190.160.5
  • 40.126.32.138
  • 20.190.160.17
  • 40.126.32.74
  • 20.190.160.2
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
mMmjKMiIHEaaClnynaAFUsK.mMmjKMiIHEaaClnynaAFUsK
  • —
unknown
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sighbtseeing .shop)
536
Deployment.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (esccapewz .run in TLS SNI)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (esccapewz .run)
536
Deployment.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (esccapewz .run in TLS SNI)
536
Deployment.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (esccapewz .run in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
jenny_mod_forge_1.12.2-v1.9.0.jar.7z