File name:

vochlea dubler 2 crack.7z

Full analysis: https://app.any.run/tasks/8469f7c0-0bee-4728-9307-7b6de288b90a
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 15:35:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
lumma
stealer
autoit-loader
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

C7C7B34A4D2E8708DBACC2C5E585BBE8

SHA1:

E57D6AFEA7B08E0554354D9958E45CDADF0B0C79

SHA256:

EFF0EBA32DCA58B7828F36AB0B62F725CE1EB52F393DA8415EFD81CFBC2A9F9A

SSDEEP:

98304:oMSArjdjN8nT6mUpdRWX+zrXOkHV7QDnexZhHxb+1W92uyBW4TbythOAIGd+sbF6:rl8pr7zX7esPxuXdHwu2wSOxE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Moscow.com (PID: 6368)

    • LUMMA mutex has been found

      • Moscow.com (PID: 6368)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6652)
      • vochlea dubler 2 crack.exe (PID: 5556)

    • Executing commands from a ".bat" file

      • vochlea dubler 2 crack.exe (PID: 5556)

    • Starts CMD.EXE for commands execution

      • vochlea dubler 2 crack.exe (PID: 5556)

    • Get information on the list of running processes

      • cmd.exe (PID: 7132)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7132)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 7132)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7132)

    • The executable file from the user directory is run by the CMD process

      • Moscow.com (PID: 6368)

    • There is functionality for taking screenshot (YARA)

      • vochlea dubler 2 crack.exe (PID: 5556)
      • Moscow.com (PID: 6368)

    • Searches for installed software

      • Moscow.com (PID: 6368)

  • INFO

    • Reads the computer name

      • vochlea dubler 2 crack.exe (PID: 5556)
      • extrac32.exe (PID: 6408)
      • Moscow.com (PID: 6368)

    • Checks supported languages

      • vochlea dubler 2 crack.exe (PID: 5556)
      • extrac32.exe (PID: 6408)
      • Moscow.com (PID: 6368)

    • Create files in a temporary directory

      • vochlea dubler 2 crack.exe (PID: 5556)
      • extrac32.exe (PID: 6408)

    • Process checks computer location settings

      • vochlea dubler 2 crack.exe (PID: 5556)

    • Reads mouse settings

      • Moscow.com (PID: 6368)

    • Reads the machine GUID from the registry

      • Moscow.com (PID: 6368)

    • Reads the software policy settings

      • Moscow.com (PID: 6368)
      • slui.exe (PID: 6732)

    • Checks proxy server information

      • slui.exe (PID: 6732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
13
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs vochlea dubler 2 crack.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs extrac32.exe no specs findstr.exe no specs #LUMMA moscow.com choice.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1212findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
2160\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2216tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2716choice /d n /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
3672tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3740findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
5556"C:\Users\admin\AppData\Local\Temp\Rar$EXb6652.46531\vochlea dubler 2 crack.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb6652.46531\vochlea dubler 2 crack.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb6652.46531\vochlea dubler 2 crack.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6368Moscow.com K C:\Users\admin\AppData\Local\Temp\448887\Moscow.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\448887\moscow.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
6408extrac32 /Y Play.wp5 *.*C:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
6652"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\vochlea dubler 2 crack.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
5 950
Read events
5 941
Write events
9
Delete events
0

Modification events

(PID) Process:(6652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\vochlea dubler 2 crack.7z
(PID) Process:(6652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
0
Suspicious files
20
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6652.46531\vochlea dubler 2 crack.exe —
MD5:—
SHA256:—
5556vochlea dubler 2 crack.exeC:\Users\admin\AppData\Local\Temp\Romania.wp5binary
MD5:1C989744272C401FBE8468D529100519
SHA256:AEA644F6996780EF8D50228BD65222E0030034863401A204569A4277426BA411
5556vochlea dubler 2 crack.exeC:\Users\admin\AppData\Local\Temp\Authorization.wp5binary
MD5:DFDA57CEBDC25778F4B1E5317797009C
SHA256:8CCCD4C1FDB91FC1E16156191C52CDF9173B5722AF57AA3DB4A9063303E27615
5556vochlea dubler 2 crack.exeC:\Users\admin\AppData\Local\Temp\Mysql.wp5text
MD5:D700E104BB88001FEA6F66ECAD07BFA0
SHA256:CE9911C4A639B88BB349F2E1E94D6A426F185BBA641B93EF93922D74E2ED387B
5556vochlea dubler 2 crack.exeC:\Users\admin\AppData\Local\Temp\Art.wp5binary
MD5:49333FEBDA23CF5AE18D48D4C7CBBEB2
SHA256:32A8DF04BC6F0F9655963BCA0C454F6BFDA1E8EF28CDF34DABD385D59F16D626
5556vochlea dubler 2 crack.exeC:\Users\admin\AppData\Local\Temp\Play.wp5compressed
MD5:4CCD8111EB03D462E4FA5C5D63CC8320
SHA256:35EFC15A41CF54A51703711E0B117B1899E4698BED1A4FDAE638EBB7A3A190E0
5556vochlea dubler 2 crack.exeC:\Users\admin\AppData\Local\Temp\Refugees.wp5binary
MD5:556D357A1968C2F81D306CE845B48D0B
SHA256:084F6F9ECD901874560DF9661EE5A02656C8B224EEEEA06D79705ECE4B23251E
7132cmd.exeC:\Users\admin\AppData\Local\Temp\Mysql.wp5.battext
MD5:D700E104BB88001FEA6F66ECAD07BFA0
SHA256:CE9911C4A639B88BB349F2E1E94D6A426F185BBA641B93EF93922D74E2ED387B
5556vochlea dubler 2 crack.exeC:\Users\admin\AppData\Local\Temp\Gba.wp5binary
MD5:3FB3A28D955F0366BEB2E1E20FA6736A
SHA256:BC65384575B058FA68F5872CCD17E5B6DB282181197EBB3ADE7CC6AF430E1DED
5556vochlea dubler 2 crack.exeC:\Users\admin\AppData\Local\Temp\Lock.wp5binary
MD5:660F010E32A964AAB16B3603BB304728
SHA256:B317BC29236CDB3E16BF83425840C9006397C7FC5BD0D47F21F0F1294E73FA2E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4520
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.25.50.8:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4520
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5012
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3876
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
184.25.50.8:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4520
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 184.25.50.8
  • 184.25.50.10
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.140
  • 40.126.32.136
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.74
  • 20.190.160.5
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
wbVyRvhbyvEZbMqYihltOWNp.wbVyRvhbyvEZbMqYihltOWNp
  • —
unknown
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vochlea dubler 2 crack.7z