File name:

Setup.exe.zip

Full analysis: https://app.any.run/tasks/9f4e7ac4-7bb0-4cc9-8c81-cece18bacc27
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 00:09:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
delphi
inno
installer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

1B44D6BDB341D0E4441D1EF4D7C7058C

SHA1:

6C913BF5DCAF0BF252BFEA02A538611EB6503CF5

SHA256:

7F35F29CD541E856E0B04E792D7819C87888DA8D03AA4D9F4222F3A6038B5DFE

SSDEEP:

98304:cxBV980+BXgiA/KyZmzxGoBQO0Ly43xHbkdwpnYF4jB54zgw2ZhwFEHPRYg4+Wt2:2H9BxL0M9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • Setup.exe (PID: 7832)

    • Executing a file with an untrusted certificate

      • Setup.exe (PID: 7832)
      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)
      • DN7N5W7KYSCVRJPJLUNALV9XIAP.exe (PID: 8136)
      • Safari.exe (PID: 6308)
      • asus_framework.exe (PID: 6332)

    • Actions looks like stealing of personal data

      • Setup.exe (PID: 7832)

    • Changes the autorun value in the registry

      • DN7N5W7KYSCVRJPJLUNALV9XIAP.exe (PID: 8136)
      • reg.exe (PID: 7304)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • DN7N5W7KYSCVRJPJLUNALV9XIAP.exe (PID: 8136)
      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)
      • Setup.exe (PID: 7832)

    • Executes application which crashes

      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)

    • Starts CMD.EXE for commands execution

      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6272)

    • Connects to unusual port

      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 1108)

    • Adds/modifies Windows certificates

      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)

    • Searches for installed software

      • Setup.exe (PID: 7832)

  • INFO

    • Detects InnoSetup installer (YARA)

      • Setup.exe (PID: 7832)

    • Compiled with Borland Delphi (YARA)

      • Setup.exe (PID: 7832)
      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)

    • Reads the software policy settings

      • Setup.exe (PID: 7832)
      • slui.exe (PID: 7348)
      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)
      • slui.exe (PID: 896)

    • Checks supported languages

      • Setup.exe (PID: 7832)
      • DN7N5W7KYSCVRJPJLUNALV9XIAP.exe (PID: 8136)
      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)

    • Manual execution by a user

      • Setup.exe (PID: 7832)
      • Safari.exe (PID: 6308)
      • asus_framework.exe (PID: 6332)

    • Create files in a temporary directory

      • Setup.exe (PID: 7832)

    • Reads the computer name

      • Setup.exe (PID: 7832)
      • DN7N5W7KYSCVRJPJLUNALV9XIAP.exe (PID: 8136)
      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)

    • Creates files in the program directory

      • DN7N5W7KYSCVRJPJLUNALV9XIAP.exe (PID: 8136)
      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)

    • The sample compiled with english language support

      • Setup.exe (PID: 7832)
      • DN7N5W7KYSCVRJPJLUNALV9XIAP.exe (PID: 8136)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)

    • Reads the machine GUID from the registry

      • QZDI4YY7FMIR0ZB2.exe (PID: 8112)

    • Checks proxy server information

      • slui.exe (PID: 896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:04:26 06:05:12
ZipCRC: 0x9d344969
ZipCompressedSize: 3623513
ZipUncompressedSize: 714673537
ZipFileName: Setup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
258
Monitored processes
22
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe #LUMMA setup.exe qzdi4yy7fmir0zb2.exe dn7n5w7kyscvrjpjlunalv9xiap.exe slui.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs reg.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs plugscheduler.exe no specs safari.exe no specs asus_framework.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
896C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1108"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\clbcatq.dll
c:\windows\system32\taskschd.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\xmllite.dll
3272C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8112 -s 580C:\Windows\SysWOW64\WerFault.exe—QZDI4YY7FMIR0ZB2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4108"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Setup.exe.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5204C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8112 -s 616C:\Windows\SysWOW64\WerFault.exe—QZDI4YY7FMIR0ZB2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5256C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8112 -s 476C:\Windows\SysWOW64\WerFault.exe—QZDI4YY7FMIR0ZB2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5332C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8112 -s 564C:\Windows\SysWOW64\WerFault.exe—QZDI4YY7FMIR0ZB2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6108C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8112 -s 1476C:\Windows\SysWOW64\WerFault.exe—QZDI4YY7FMIR0ZB2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6272cmd /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v asus_framework /t REG_SZ /d C:\ProgramData\asus_framework.exe /f"C:\Windows\SysWOW64\cmd.exe—QZDI4YY7FMIR0ZB2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6308"C:\ProgramData\Safari\Safari.exe" C:\ProgramData\Safari\Safari.exe—explorer.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Autostart program viewer
Version:
14.09
Modules
Images
c:\programdata\safari\safari.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
10 311
Read events
10 265
Write events
34
Delete events
12

Modification events

(PID) Process:(4108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Setup.exe.zip
(PID) Process:(4108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(8136) DN7N5W7KYSCVRJPJLUNALV9XIAP.exeKey:HKEY_CURRENT_USER\SOFTWARE\Sysinternals\Autoruns
Operation:writeName:EulaAccepted
Value:
1
(PID) Process:(4108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5E0100002D0000001E05000016020000
Executable files
4
Suspicious files
44
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4108.21144\Setup.exe —
MD5:—
SHA256:—
7832Setup.exeC:\Users\admin\AppData\Local\Temp\DN7N5W7KYSCVRJPJLUNALV9XIAP.exeexecutable
MD5:7AFD388B65B41E842D7FF34FDE825CCE
SHA256:96C666F2AFE4D60BB18412B675416CFA9FA10C113C8185BC2CA55F7396C3EFC6
8136DN7N5W7KYSCVRJPJLUNALV9XIAP.exeC:\ProgramData\Safari\Safari.exeexecutable
MD5:7AFD388B65B41E842D7FF34FDE825CCE
SHA256:96C666F2AFE4D60BB18412B675416CFA9FA10C113C8185BC2CA55F7396C3EFC6
1108PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.048.etlbinary
MD5:A23907B6FDD47DCABFDFD7CF2FCD7671
SHA256:0C9C33FE9E984A2E5A70EBA51F36B9929A86199E424AF2F8080E1267B87DC970
1108PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.049.etlbinary
MD5:5EA68411BF8E9EAF4621BAF73F61449E
SHA256:9D4CA5A1D871F819C139A498BB910A63576C2FE6367853544F8D172D8B6EBFF7
1108PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.047.etlbinary
MD5:FED961067F664B5381B65A534B7AB728
SHA256:652F31A8284AE812D1D9D24192BC800976BF74C240591C6AC443A28C4709FB7C
1108PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.044.etlbinary
MD5:B53B2070E686FFB1FBC8B06994E7C8D7
SHA256:A3ABD06F4E40CB700B1908AB6BCD2E27455E13EF076E0BF2345BB2FA369EF802
1108PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.050.etlbinary
MD5:C8834D365FAE073DEDE1F1620454CE71
SHA256:C6DD793EEE1D5551CA507A3C5BFFECA82DD3E29C63C2C6DD218A7D4BFB37046B
1108PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.045.etlbinary
MD5:89BD161BF7B46C9078937CF832786737
SHA256:2B83DF5532E9F54ED301C8F82E2CDD489799C8D5222A2D44C97DCB151A96FAA9
1108PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.043.etlbinary
MD5:8A2BDE0EAFA7E946196A1B114AB636E9
SHA256:1C338CBDD9316D7FD8F208341466FEDC554A04D489B3A86C736EC3831A2F2BA2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
62
DNS requests
29
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7908
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7908
SIHClient.exe
23.38.73.129:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.38.73.129
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.4
  • 40.126.31.3
  • 20.190.159.71
  • 40.126.31.73
  • 40.126.31.128
  • 20.190.159.23
  • 20.190.159.73
  • 40.126.31.69
  • 20.190.159.130
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
nodepathr.run
  • 104.21.61.7
  • 172.67.204.131
unknown
h1.startingshabby.world
  • 104.21.88.117
  • 172.67.178.177
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-2-s1 .binance .org)
8112
QZDI4YY7FMIR0ZB2.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-2-s1 .binance .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.exe.zip