URL:

https://arch2.cloud8323v2.sbs/g/zip/NcYfzzXtHM7vcK4kkjyM5gQI/Detroit_Become_Human_--_fitgirl-repacks.site_--....zip

Full analysis: https://app.any.run/tasks/f6fadbe3-4184-4921-890f-64e9c26de306
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: July 05, 2025, 22:06:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
lumma
stealer
Indicators:
MD5:

89EAB686EBB3B155FCFAF1DAC9E71E7A

SHA1:

CE6555F7F56AC64F37DF52F61DCA8144FE556674

SHA256:

91890C337A86490304CF55F42974383E833254E1319169D8D3A49BF4695BD876

SSDEEP:

3:N8ox6nP7tr5ROgchsFaQlZnIyMXlJOXMmyQV:2oozt5oZhKaAZI/sVjV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • Telephone.com (PID: 7156)

    • Actions looks like stealing of personal data

      • Telephone.com (PID: 7156)

    • Steals credentials from Web Browsers

      • Telephone.com (PID: 7156)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • appFile.exe (PID: 8072)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7632)

    • Starts CMD.EXE for commands execution

      • appFile.exe (PID: 8072)

    • Reads security settings of Internet Explorer

      • appFile.exe (PID: 8072)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 7632)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7632)

    • The executable file from the user directory is run by the CMD process

      • Telephone.com (PID: 7156)

    • There is functionality for taking screenshot (YARA)

      • Telephone.com (PID: 7156)

    • Get information on the list of running processes

      • cmd.exe (PID: 7632)

    • Searches for installed software

      • Telephone.com (PID: 7156)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 2976)
      • msedge.exe (PID: 8088)
      • chrome.exe (PID: 5960)
      • chrome.exe (PID: 5884)
      • chrome.exe (PID: 6892)
      • msedge.exe (PID: 7576)
      • msedge.exe (PID: 8128)
      • msedge.exe (PID: 2648)
      • msedge.exe (PID: 6320)
      • msedge.exe (PID: 728)
      • msedge.exe (PID: 8152)
      • msedge.exe (PID: 2428)
      • chrome.exe (PID: 2140)
      • msedge.exe (PID: 7164)

    • Reads Environment values

      • identity_helper.exe (PID: 7564)
      • identity_helper.exe (PID: 2512)

    • Reads the computer name

      • identity_helper.exe (PID: 7564)
      • identity_helper.exe (PID: 2512)
      • appFile.exe (PID: 8072)
      • Telephone.com (PID: 7156)
      • extrac32.exe (PID: 2716)

    • Checks supported languages

      • identity_helper.exe (PID: 7564)
      • identity_helper.exe (PID: 2512)
      • extrac32.exe (PID: 2716)
      • Telephone.com (PID: 7156)
      • appFile.exe (PID: 8072)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 2976)

    • Manual execution by a user

      • appFile.exe (PID: 8072)
      • Taskmgr.exe (PID: 6256)
      • Taskmgr.exe (PID: 7320)

    • Process checks computer location settings

      • appFile.exe (PID: 8072)

    • Create files in a temporary directory

      • extrac32.exe (PID: 2716)
      • appFile.exe (PID: 8072)

    • Reads the software policy settings

      • Telephone.com (PID: 7156)
      • slui.exe (PID: 6164)

    • Reads mouse settings

      • Telephone.com (PID: 7156)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 7320)

    • Checks proxy server information

      • slui.exe (PID: 6164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
264
Monitored processes
121
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs appfile.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs extrac32.exe no specs findstr.exe no specs #LUMMA telephone.com choice.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs taskmgr.exe no specs taskmgr.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
320"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2476,i,2194903268380860424,1689394948942852970,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—Telephone.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
1204"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2788,i,9708938781374473980,15844834227270598598,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
1480tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1520"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4088,i,14722552308227093435,14003622130057580273,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
1632"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=4924,i,11483237793935759685,10589179664055462864,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4884 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
1632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2248,i,9708938781374473980,15844834227270598598,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
1740findstr "nsWscSvc ekrn bdservicehost SophosHealth AvastUI AVGUI & if not errorlevel 1 Set rXPERneQsPoWqJTVAOXCZamD=AutoIt3.exe & Set GVmVuAERSAMNgPzesRmwUbJvhZZba=.a3x & Set WbuPJWqHgCtFcz=300C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1944"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=2404,i,12953881371493472149,3595661537096104590,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=2412 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
2032"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3596,i,13697024182472523247,1806285095537186518,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
56
Suspicious files
608
Text files
381
Unknown types
0

Dropped files

PID
Process
Filename
Type
2976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF1757b5.TMP —
MD5:—
SHA256:—
2976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
2976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF1757b5.TMP —
MD5:—
SHA256:—
2976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
2976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF1757a5.TMP —
MD5:—
SHA256:—
2976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
2976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1757b5.TMP —
MD5:—
SHA256:—
2976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
2976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1757e4.TMP —
MD5:—
SHA256:—
2976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
258
DNS requests
252
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4676
chrome.exe
GET
200
142.250.185.174:80
http://clients2.google.com/time/1/current?cup2key=8:NkAR3ABxt2V-rI1-1Ftcyo8wE6cnZSFnFYz277LyUAM&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
6900
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:jTVguNR6mcB1f_EnbjcuMDy10XPcjOmtxoTfVC7Dxjg&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
8044
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4984
chrome.exe
GET
200
142.250.185.174:80
http://clients2.google.com/time/1/current?cup2key=8:EDk4KxRAeJg65nZdNp9H-6pHOMrMtvJls1jOxjNJyeQ&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
7564
chrome.exe
GET
200
142.250.185.174:80
http://clients2.google.com/time/1/current?cup2key=8:BLVhPTu-tDDeG7SAdQCzN5viWBPQF8KYSpwyuuHfSKk&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8044
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7556
chrome.exe
GET
200
142.250.185.174:80
http://clients2.google.com/time/1/current?cup2key=8:kLBR4q5vUz9a_0y8VyvJoybE233w4MZYPDScFEbolEc&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
1232
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1752269267&P2=404&P3=2&P4=aSADpRgEsQbRczyG1wT7mVJBoKP%2bnbTwt8e%2fkvP7SwtoQByfiFrdD6z4lbn5iaeMygvZ2EE7MLazjRvc1RQP9A%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1352
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6900
msedge.exe
150.171.27.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6900
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6900
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6900
msedge.exe
104.126.37.136:443
copilot.microsoft.com
Akamai International B.V.
DE
whitelisted
6900
msedge.exe
188.114.97.3:443
arch2.cloud8323v2.sbs
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.78
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
arch2.cloud8323v2.sbs
  • 188.114.97.3
  • 188.114.96.3
unknown
copilot.microsoft.com
  • 104.126.37.136
  • 104.126.37.169
whitelisted
update.googleapis.com
  • 142.250.184.195
whitelisted
www.bing.com
  • 104.126.37.185
  • 104.126.37.130
  • 104.126.37.129
  • 104.126.37.144
  • 104.126.37.171
  • 104.126.37.136
  • 104.126.37.153
  • 104.126.37.162
  • 104.126.37.163
  • 104.126.37.128
  • 104.126.37.123
  • 104.126.37.139
  • 104.126.37.176
whitelisted
clients2.googleusercontent.com
  • 142.250.185.65
whitelisted
edgeassetservice.azureedge.net
  • 13.107.253.45
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://arch2.cloud8323v2.sbs/g/zip/NcYfzzXtHM7vcK4kkjyM5gQI/Detroit_Become_Human_--_fitgirl-repacks.site_--....zip