File name:

good.exe

Full analysis: https://app.any.run/tasks/72f0d072-968d-4e6a-81df-09855c1bb2d2
Verdict: Malicious activity
Threats:

Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes.

Malware Trends Tracker     >>>
Analysis date: January 25, 2025, 18:35:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rhadamanthys
stealer
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

CA32AD67A6290904A3679439B574D759

SHA1:

7E4F3B8D5D777432C7F89635A48C15A298F0A1E9

SHA256:

05C29D1506F7601BB014F8C94186DFEB73C23A58E2A8397221BA25D17CD290FA

SSDEEP:

24576:fvLnTKqndIs2YSVDuFcJ6vUCDhG/BZcv5v3ag+6HRfZksAT5vhpHcDID6iylToXn:fvLnemIs2YSVDuFcJ6vUKhG/BZi5v3aU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • crypted.exe (PID: 5464)
      • crypted.exe (PID: 6196)

    • Known privilege escalation attack

      • dllhost.exe (PID: 2436)

    • Steals credentials from Web Browsers

      • BUILD0~1.EXE (PID: 4444)

    • RHADAMANTHYS mutex has been found

      • crypted.exe (PID: 6196)
      • svchost.exe (PID: 6436)

    • Actions looks like stealing of personal data

      • BUILD0~1.EXE (PID: 4444)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • good.exe (PID: 3612)

    • Starts a Microsoft application from unusual location

      • good.exe (PID: 3612)

    • Process drops legitimate windows executable

      • good.exe (PID: 3612)

    • Executes application which crashes

      • crypted.exe (PID: 5464)
      • crypted.exe (PID: 6196)

    • The process checks if it is being run in the virtual environment

      • svchost.exe (PID: 6436)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • BUILD0~1.EXE (PID: 4444)

    • Application launched itself

      • crypted.exe (PID: 5464)

    • Connects to unusual port

      • svchost.exe (PID: 6436)
      • BUILD0~1.EXE (PID: 4444)

  • INFO

    • Reads the computer name

      • BUILD0~1.EXE (PID: 904)
      • crypted.exe (PID: 5464)
      • BUILD0~1.EXE (PID: 4444)

    • Checks supported languages

      • BUILD0~1.EXE (PID: 904)
      • good.exe (PID: 3612)
      • BUILD0~1.EXE (PID: 4444)
      • crypted.exe (PID: 5464)
      • crypted.exe (PID: 6196)

    • Create files in a temporary directory

      • good.exe (PID: 3612)

    • The sample compiled with english language support

      • good.exe (PID: 3612)

    • Checks transactions between databases Windows and Oracle

      • BUILD0~1.EXE (PID: 904)

    • Reads the machine GUID from the registry

      • BUILD0~1.EXE (PID: 904)
      • BUILD0~1.EXE (PID: 4444)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 2436)

    • Manual execution by a user

      • svchost.exe (PID: 6436)

    • Disables trace logs

      • BUILD0~1.EXE (PID: 4444)

    • Checks proxy server information

      • BUILD0~1.EXE (PID: 4444)
      • WerFault.exe (PID: 6368)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6368)

    • Reads the software policy settings

      • WerFault.exe (PID: 6368)

    • Reads CPU info

      • BUILD0~1.EXE (PID: 4444)

    • Reads Environment values

      • BUILD0~1.EXE (PID: 4444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2064:11:15 23:53:33+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.38
CodeSize: 40960
InitializedDataSize: 790528
UninitializedDataSize: -
EntryPoint: 0x1140
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.26100.1150
ProductVersionNumber: 11.0.26100.1150
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.26100.1150 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE
ProductName: Internet Explorer
ProductVersion: 11.00.26100.1150
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
10
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start good.exe build0~1.exe no specs CMSTPLUA build0~1.exe crypted.exe #RHADAMANTHYS crypted.exe werfault.exe #RHADAMANTHYS svchost.exe werfault.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
904C:\Users\admin\AppData\Local\Temp\IXP000.TMP\BUILD0~1.EXEC:\Users\admin\AppData\Local\Temp\IXP000.TMP\BUILD0~1.EXE—good.exe
User:
admin
Integrity Level:
MEDIUM
Description:
csrss
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\build0~1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2436C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
3612"C:\Users\admin\AppData\Local\Temp\good.exe" C:\Users\admin\AppData\Local\Temp\good.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.26100.1150 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\good.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4444"C:\Users\admin\AppData\Local\Temp\IXP000.TMP\BUILD0~1.EXE" C:\Users\admin\AppData\Local\Temp\IXP000.TMP\BUILD0~1.EXE
dllhost.exe
User:
admin
Integrity Level:
HIGH
Description:
csrss
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\build0~1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5464C:\Users\admin\AppData\Local\Temp\IXP000.TMP\crypted.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
good.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226505
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\crypted.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6196"C:\Users\admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
crypted.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\crypted.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6368C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5464 -s 832C:\Windows\SysWOW64\WerFault.exe
crypted.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6436"C:\Windows\System32\svchost.exe"C:\Windows\SysWOW64\svchost.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
6520C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6196 -s 420C:\Windows\SysWOW64\WerFault.exe—crypted.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
5 668
Read events
5 651
Write events
17
Delete events
0

Modification events

(PID) Process:(2436) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(4444) BUILD0~1.EXEKey:HKEY_CURRENT_USER\SOFTWARE\xLoFEsKzKCHVVzW
Operation:writeName:xLoFEsKzKCHVVzW
Value:
xLoFEsKzKCHVVzW
(PID) Process:(4444) BUILD0~1.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BUILD0~1_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4444) BUILD0~1.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BUILD0~1_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4444) BUILD0~1.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BUILD0~1_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4444) BUILD0~1.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BUILD0~1_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4444) BUILD0~1.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BUILD0~1_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4444) BUILD0~1.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BUILD0~1_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4444) BUILD0~1.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BUILD0~1_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4444) BUILD0~1.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BUILD0~1_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
2
Suspicious files
6
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6368WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_crypted.exe_45d71ead97041e67d726dbd8a62babc7783ae75_5f5087f9_2dc9cb03-759c-4297-8729-dada70f76399\Report.wer —
MD5:—
SHA256:—
6368WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\crypted.exe.5464.dmp —
MD5:—
SHA256:—
6368WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
6368WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER762D.tmp.dmpbinary
MD5:8AA17AE30DC1D304E39C2EC94E214BF7
SHA256:7D9994342E466984807915FE0F757DFE1084E8C87E678EEB60680A67D0CBAECD
6368WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:680B0331A3CC8FCCE16367586EC7A721
SHA256:19F1B5D2C7F62663C14D97578411DC610E5F33E6CE4165977314442435F15305
6368WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:19842266A87FE478A1A44D3999900D9F
SHA256:6DE71CCB061F17F9BDF93E9164C8EF1E25CAAD1DA4975B0C98B0FE3D30CF2406
3612good.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\BUILD0~1.EXEexecutable
MD5:F836EA67D0FAF046654D4BF352E96D1C
SHA256:1E0C2F1CC5904D8669B358BCF1F4E83FF2C592CD9AF083BBF6404AFB583445D7
6368WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:5F2FB26FEC53CBB7549766F3143665AA
SHA256:69D2AE7020229CF4FF4D01ACE88EAC2E5349A1C8D73CDAAC5A2704A119BA0272
3612good.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\crypted.exeexecutable
MD5:94EF322B5B3133BA222FCA7FDCBFA5D8
SHA256:6FF983EF0D20E0513E26C45C2D58484B8C58057D7E4C4465CEBF9B06E4184640
6368WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7823.tmp.xmlxml
MD5:8732A423701C10B390B6072AB1B65C15
SHA256:79406631E37D8FE41B299C7C63863816B164F8E4CB65EEC287B21A9E1007DFE4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
29
DNS requests
12
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4444
BUILD0~1.EXE
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
shared
—
—
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.21.65.154:443
—
Akamai International B.V.
NL
unknown
—
—
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4444
BUILD0~1.EXE
208.95.112.1:80
ip-api.com
TUT-AS
US
shared
6368
WerFault.exe
20.42.65.92:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2992
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6368
WerFault.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.174
whitelisted
ip-api.com
  • 208.95.112.1
shared
watson.events.data.microsoft.com
  • 20.42.65.92
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.74
  • 40.126.32.72
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted

Threats

PID
Process
Class
Message
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
good.exe