File name:

2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe

Full analysis: https://app.any.run/tasks/0a014bd4-6ab8-4470-8b2c-30ad8d716a48
Verdict: Malicious activity
Threats:

TrickBot is an advanced banking trojan that attackers can use to steal payment credentials from the victims. It can redirect the victim to a fake banking cabinet and retrieve credentials typed in on the webpage.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 07:43:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
trickbot
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

493CD7FD5F19600CC6768A6069DFA7EE

SHA1:

126E3134114F274E55E180CF23C2ACDCC668B6EF

SHA256:

36C7EFCCC9247002025FFB46BCABAB7342A0D47463398379CB9BC0025B8D7D29

SSDEEP:

24576:QgIGB0LQXEtN8lR4IckFkIF4N6r+FDDyLKYZNBcAOr5mjXMjhVcxOsrF2bA8oqJM:QgIGB00XEtNcR4IckFkIF4NE+FDDyLK8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 6652)

    • TRICKBOT mutex has been found

      • svchost.exe (PID: 6148)
      • svchost.exe (PID: 736)

    • TRICKBOT has been detected (YARA)

      • svchost.exe (PID: 736)

  • SUSPICIOUS

    • Executes application which crashes

      • 2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe (PID: 6040)
      • 2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe (PID: 6676)
      • 2019-09-19-Vticmbqt-gtag-neq18-tettieved-by-Wtupif-ipfected-hqut.exe (PID: 4112)

    • Executable content was dropped or overwritten

      • svchost.exe (PID: 6148)

    • The process executes via Task Scheduler

      • 2019-09-19-Vticmbqt-gtag-neq18-tettieved-by-Wtupif-ipfected-hqut.exe (PID: 4112)

    • Connects to unusual port

      • svchost.exe (PID: 736)

  • INFO

    • Checks supported languages

      • 2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe (PID: 6040)
      • 2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe (PID: 6676)
      • 2019-09-19-Vticmbqt-gtag-neq18-tettieved-by-Wtupif-ipfected-hqut.exe (PID: 4112)

    • The sample compiled with english language support

      • 2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe (PID: 6040)
      • svchost.exe (PID: 6148)

    • Reads the computer name

      • 2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe (PID: 6040)

    • Reads the machine GUID from the registry

      • 2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe (PID: 6040)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 6652)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6592)
      • WerFault.exe (PID: 6208)

    • Reads the software policy settings

      • slui.exe (PID: 6944)
      • slui.exe (PID: 5512)

    • Checks proxy server information

      • slui.exe (PID: 5512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:09:19 14:08:01+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 719360
InitializedDataSize: 203776
UninitializedDataSize: -
EntryPoint: 0x28d0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 9.2.30.76
ProductVersionNumber: 9.2.30.76
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0x4004)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Flat
CompanyName: Observecrease
FileDescription: WellLove
FileVersion: 9.2.30.76
LegalCopyright: Fairmolecule ABIS
ProductName: WellLove
ProductVersion: 9.2.30.76
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
12
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2019-09-19-trickbot-gtag-leo16-retrieved-by-ursnif-infected-host.exe sppextcomobj.exe no specs slui.exe CMSTPLUA 2019-09-19-trickbot-gtag-leo16-retrieved-by-ursnif-infected-host.exe werfault.exe no specs slui.exe #TRICKBOT svchost.exe werfault.exe no specs 2019-09-19-vticmbqt-gtag-neq18-tettieved-by-wtupif-ipfected-hqut.exe #TRICKBOT svchost.exe werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736C:\WINDOWS\system32\svchost.exeC:\Windows\System32\svchost.exe
2019-09-19-Vticmbqt-gtag-neq18-tettieved-by-Wtupif-ipfected-hqut.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
2384C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4112"C:\Users\admin\AppData\Roaming\MyCloud\2019-09-19-Vticmbqt-gtag-neq18-tettieved-by-Wtupif-ipfected-hqut.exe"C:\Users\admin\AppData\Roaming\MyCloud\2019-09-19-Vticmbqt-gtag-neq18-tettieved-by-Wtupif-ipfected-hqut.exe
svchost.exe
User:
SYSTEM
Company:
Observecrease
Integrity Level:
SYSTEM
Description:
WellLove
Exit code:
255
Version:
9.2.30.76
Modules
Images
c:\users\admin\appdata\roaming\mycloud\2019-09-19-vticmbqt-gtag-neq18-tettieved-by-wtupif-ipfected-hqut.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
5044C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4112 -s 544C:\Windows\SysWOW64\WerFault.exe—2019-09-19-Vticmbqt-gtag-neq18-tettieved-by-Wtupif-ipfected-hqut.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5512C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6040"C:\Users\admin\AppData\Local\Temp\2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe" C:\Users\admin\AppData\Local\Temp\2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe
explorer.exe
User:
admin
Company:
Observecrease
Integrity Level:
MEDIUM
Description:
WellLove
Exit code:
3221225477
Version:
9.2.30.76
Modules
Images
c:\users\admin\appdata\local\temp\2019-09-19-trickbot-gtag-leo16-retrieved-by-ursnif-infected-host.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
6148C:\WINDOWS\system32\svchost.exeC:\Windows\System32\svchost.exe
2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
6208C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6676 -s 540C:\Windows\SysWOW64\WerFault.exe—2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6592C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6040 -s 796C:\Windows\SysWOW64\WerFault.exe—2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6652C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
Total events
19 055
Read events
19 023
Write events
26
Delete events
6

Modification events

(PID) Process:(6652) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6208) WerFault.exeKey:\REGISTRY\A\{d37696e2-5656-e3fe-df89-c41ac62d33d9}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(6208) WerFault.exeKey:\REGISTRY\A\{d37696e2-5656-e3fe-df89-c41ac62d33d9}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(5044) WerFault.exeKey:\REGISTRY\A\{5780f863-52d4-1c01-de40-a4c9a47da764}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(5044) WerFault.exeKey:\REGISTRY\A\{5780f863-52d4-1c01-de40-a4c9a47da764}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(5044) WerFault.exeKey:\REGISTRY\A\{5780f863-52d4-1c01-de40-a4c9a47da764}\Root\InventoryApplicationFile\2019-09-19-vticm|e9cd6928a1683bda
Operation:writeName:ProgramId
Value:
0006720a9f9f3ef0506a3c8596dc0257282e00000904
(PID) Process:(5044) WerFault.exeKey:\REGISTRY\A\{5780f863-52d4-1c01-de40-a4c9a47da764}\Root\InventoryApplicationFile\2019-09-19-vticm|e9cd6928a1683bda
Operation:writeName:FileId
Value:
0000126e3134114f274e55e180cf23c2acdcc668b6ef
(PID) Process:(5044) WerFault.exeKey:\REGISTRY\A\{5780f863-52d4-1c01-de40-a4c9a47da764}\Root\InventoryApplicationFile\2019-09-19-vticm|e9cd6928a1683bda
Operation:writeName:LowerCaseLongPath
Value:
c:\users\admin\appdata\roaming\mycloud\2019-09-19-vticmbqt-gtag-neq18-tettieved-by-wtupif-ipfected-hqut.exe
(PID) Process:(5044) WerFault.exeKey:\REGISTRY\A\{5780f863-52d4-1c01-de40-a4c9a47da764}\Root\InventoryApplicationFile\2019-09-19-vticm|e9cd6928a1683bda
Operation:writeName:LongPathHash
Value:
2019-09-19-vticm|e9cd6928a1683bda
(PID) Process:(5044) WerFault.exeKey:\REGISTRY\A\{5780f863-52d4-1c01-de40-a4c9a47da764}\Root\InventoryApplicationFile\2019-09-19-vticm|e9cd6928a1683bda
Operation:writeName:Name
Value:
2019-09-19-Vticmbqt-gtag-neq18-tettieved-by-Wtupif-ipfected-hqut.exe
Executable files
2
Suspicious files
9
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6592WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_explorer.exe_143533f3d72dc53a02be69282248d74de8248_4d8954a1_70ab003a-4176-4e43-89d8-93c9f9227ea0\Report.wer —
MD5:—
SHA256:—
6208WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2019-09-19-Trick_d82efcada43ab71fd1937339fc287af998441786_c3e56d89_10ee79d5-5b22-4d09-b91d-e1f2d6aca481\Report.wer —
MD5:—
SHA256:—
5044WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2019-09-19-Vticm_d3b938b2dc21848c448a423835bc1dba0558af_98418f3a_f9fc41a4-b1c5-4725-a1a2-38f3a3e2f7da\Report.wer —
MD5:—
SHA256:—
6208WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE80C.tmp.WERInternalMetadata.xmlxml
MD5:48134B9AAFC7EA446109D0A21463DE75
SHA256:B2F7158A3DC6A0C6AD7CA00A69ACC6CFE9D713D4EF67197D509664B8F90504E2
6592WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER8DC6.tmp.dmpbinary
MD5:880BC7B0C8CD13F0448EFF7CE761178B
SHA256:BF23B56E05AD60A9A60FF0980224536039CDA354A448D5626C01197F542720C5
6592WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe.6040.dmpbinary
MD5:C44216E35F5E9922097E45F763183E2B
SHA256:26A2A0D332EAA2F3E4CF04F1F9FDD71A6A7BB685BE593C7AD78FB3257A100A16
6208WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE82C.tmp.xmlxml
MD5:CA7BB12629C969306F651908B881089B
SHA256:8B7FBA0542A90D8D0541A15D311F60577210A14D2470E8FCA89537444832A51C
6208WerFault.exeC:\Windows\appcompat\Programs\Amcache.hvebinary
MD5:D396257E7737392869E0FB5C2811641C
SHA256:A72717A65165989721F944ED5E7651AB0E9FD1D9A95F551BB4A5D513D0FF3A49
6208WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE7CD.tmp.dmpbinary
MD5:3AB099D291AEE9C1E972E763984DC39D
SHA256:F84CD00E7EFAAA7F7ECCD8BE52168A2B9D0F56EBCF25FECE92D1B95797C3932D
6208WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe.6676.dmpbinary
MD5:EE73CC8EAE0AC906E8CF430150F548C7
SHA256:46DCE9DDE4DD196BE03AE9F15906D71897113BF0E4D1724C3FBD1BD8257E812F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
67
DNS requests
17
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6028
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 20.198.162.78
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.132
  • 20.190.160.65
  • 20.190.160.3
  • 40.126.32.76
  • 40.126.32.133
  • 20.190.160.131
  • 40.126.32.74
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
  • 2a01:111:f100:a000::4134:4847
whitelisted
18.31.95.13.in-addr.arpa
  • —
unknown
7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-09-19-Trickbot-gtag-leo16-retrieved-by-Ursnif-infected-host.exe