File name:

File-Set-up.exe

Full analysis: https://app.any.run/tasks/ec6d05da-30ce-4dfd-9bcd-5b4f99401e5c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 11:29:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
delphi
loader
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

64FAB1BE1E5DFCD2AB0D9F366FB8EA0F

SHA1:

CF44667E6FB35EE3AE0A0C60EC353CAA6F515E0F

SHA256:

962979644C763D3461E812C1EA2A2F02476EED1F87FD24E85304300F64F725BA

SSDEEP:

98304:p8mNQ/7rxcUoHcJj1QGYq9xyiS+kNjEChLoKyoGrumPaxZ36GPQn1NmIdpmZYeRa:i2I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • File-Set-up.exe (PID: 7652)

    • Executing a file with an untrusted certificate

      • File-Set-up.exe (PID: 7652)
      • 7E757I136I59H5XIO.exe (PID: 8100)
      • NLSvc.exe (PID: 6372)

    • LUMMA has been detected (YARA)

      • File-Set-up.exe (PID: 7652)

    • Steals credentials from Web Browsers

      • File-Set-up.exe (PID: 7652)

    • Actions looks like stealing of personal data

      • File-Set-up.exe (PID: 7652)

    • Changes the autorun value in the registry

      • reg.exe (PID: 1164)

  • SUSPICIOUS

    • Searches for installed software

      • File-Set-up.exe (PID: 7652)

    • Executable content was dropped or overwritten

      • File-Set-up.exe (PID: 7652)
      • 7E757I136I59H5XIO.exe (PID: 8100)

    • Executes application which crashes

      • 7E757I136I59H5XIO.exe (PID: 8100)
      • NLSvc.exe (PID: 6372)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4608)

    • Connects to unusual port

      • 7E757I136I59H5XIO.exe (PID: 8100)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 7E757I136I59H5XIO.exe (PID: 8100)

    • Starts CMD.EXE for commands execution

      • 7E757I136I59H5XIO.exe (PID: 8100)

  • INFO

    • Checks supported languages

      • File-Set-up.exe (PID: 7652)
      • 7E757I136I59H5XIO.exe (PID: 8100)
      • NLSvc.exe (PID: 6372)

    • Reads the computer name

      • File-Set-up.exe (PID: 7652)
      • 7E757I136I59H5XIO.exe (PID: 8100)

    • Reads the machine GUID from the registry

      • File-Set-up.exe (PID: 7652)
      • 7E757I136I59H5XIO.exe (PID: 8100)

    • Compiled with Borland Delphi (YARA)

      • File-Set-up.exe (PID: 7652)
      • 7E757I136I59H5XIO.exe (PID: 8100)
      • NLSvc.exe (PID: 6372)

    • Reads the software policy settings

      • File-Set-up.exe (PID: 7652)
      • 7E757I136I59H5XIO.exe (PID: 8100)
      • slui.exe (PID: 1812)

    • Create files in a temporary directory

      • File-Set-up.exe (PID: 7652)

    • Creates files in the program directory

      • 7E757I136I59H5XIO.exe (PID: 8100)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • 7E757I136I59H5XIO.exe (PID: 8100)

    • Manual execution by a user

      • NLSvc.exe (PID: 6372)

    • Auto-launch of the file from Registry key

      • reg.exe (PID: 1164)

    • Checks proxy server information

      • slui.exe (PID: 1812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (63.4)
.exe | Win32 Executable Delphi generic (20.9)
.exe | Win32 Executable (generic) (6.6)
.exe | Win16/32 Executable Delphi generic (3)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 3206656
InitializedDataSize: 2095616
UninitializedDataSize: -
EntryPoint: 0x30f670
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
23
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #LUMMA file-set-up.exe svchost.exe 7e757i136i59h5xio.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs slui.exe cmd.exe no specs conhost.exe no specs reg.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs nlsvc.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
864C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8100 -s 620C:\Windows\SysWOW64\WerFault.exe—7E757I136I59H5XIO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1020\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6372 -s 164C:\Windows\SysWOW64\WerFault.exe—NLSvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1164reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v NLSvc /t REG_SZ /d C:\ProgramData\NLSvc.exe /fC:\Windows\SysWOW64\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1812C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3768C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8100 -s 576C:\Windows\SysWOW64\WerFault.exe—7E757I136I59H5XIO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4408C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8100 -s 744C:\Windows\SysWOW64\WerFault.exe—7E757I136I59H5XIO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4608cmd /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v NLSvc /t REG_SZ /d C:\ProgramData\NLSvc.exe /f"C:\Windows\SysWOW64\cmd.exe—7E757I136I59H5XIO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4976C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8100 -s 968C:\Windows\SysWOW64\WerFault.exe—7E757I136I59H5XIO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
15 472
Read events
15 471
Write events
1
Delete events
0

Modification events

(PID) Process:(1164) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:NLSvc
Value:
C:\ProgramData\NLSvc.exe
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
81007E757I136I59H5XIO.exeC:\ProgramData\NLSvc.exeexecutable
MD5:2CC228157CAA492328164821DD66C8FA
SHA256:C9812F3985DE4F5182B74CD4AA0B5AEB6C44FCA2A6415CC37DD0147BD39CBF97
7652File-Set-up.exeC:\Users\admin\AppData\Local\Temp\7E757I136I59H5XIO.exeexecutable
MD5:2CC228157CAA492328164821DD66C8FA
SHA256:C9812F3985DE4F5182B74CD4AA0B5AEB6C44FCA2A6415CC37DD0147BD39CBF97
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
72
DNS requests
23
Threats
32

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7996
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
20.242.39.171:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
7996
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7996
SIHClient.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7996
SIHClient.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7996
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
2.16.164.72:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7652
File-Set-up.exe
104.21.32.131:443
swordandsr.digital
CLOUDFLARENET
—
unknown
7996
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 2.16.164.72
  • 2.16.164.9
  • 2.16.164.43
  • 2.16.164.51
  • 2.16.164.106
  • 23.48.23.169
  • 23.48.23.193
  • 23.48.23.173
  • 23.48.23.180
  • 23.48.23.158
  • 23.48.23.162
  • 23.48.23.166
  • 23.48.23.177
  • 23.48.23.183
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.73
  • 40.126.31.3
  • 40.126.31.73
  • 20.190.159.130
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.0
  • 40.126.31.69
  • 20.190.159.71
  • 40.126.31.2
  • 20.190.159.2
  • 20.190.159.75
whitelisted
swordandsr.digital
  • 104.21.32.131
  • 172.67.152.53
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
h1.postedtipped.top
  • 172.67.172.114
  • 104.21.47.201
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET HUNTING Possible EXE Download From Suspicious TLD
—
—
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
—
—
Potentially Bad Traffic
ET HUNTING Request to .TOP Domain with Minimal Headers
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-2-s1 .binance .org)
8100
7E757I136I59H5XIO.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-2-s1 .binance .org in TLS SNI)
—
—
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
File-Set-up.exe