download:

/loader.exe

Full analysis: https://app.any.run/tasks/ad9f1734-c075-4159-b47e-f3daae3a0873
Verdict: Malicious activity
Analysis date: March 31, 2025, 16:07:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 4 sections
MD5:

8FA4FBC14D91FFDFFB284DEC11D0E639

SHA1:

3B10B00AC89883DC2219EFFC2E44923D6B3B5233

SHA256:

3CBB9C06B3E217D273E30650650FF955983A7A9C3D6A3FAE7FB9FEA5EC839AEB

SSDEEP:

1536:fULaGp0b+IgEs2f0BVoz0xwlRN5Cc2+sWMbBrPGk5YkJom/1enyplwp:gIgEs2fQVSCc0rtxJoeQwC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • loader.exe (PID: 7584)
      • cmd.exe (PID: 8092)
      • cmd.exe (PID: 7608)
      • loader.exe (PID: 8064)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 8092)
      • cmd.exe (PID: 8108)
      • cmd.exe (PID: 7200)
      • loader.exe (PID: 8064)
      • loader.exe (PID: 7584)
      • cmd.exe (PID: 7608)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 7232)
      • cmd.exe (PID: 960)

    • Starts application with an unusual extension

      • cmd.exe (PID: 8108)
      • cmd.exe (PID: 5352)

    • Application launched itself

      • cmd.exe (PID: 7200)
      • cmd.exe (PID: 8108)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 7232)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 960)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7200)
      • cmd.exe (PID: 8108)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 7232)
      • cmd.exe (PID: 960)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 8108)
      • cmd.exe (PID: 5352)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 8108)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 8108)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 8108)
      • curl.exe (PID: 6044)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 7716)
      • cmd.exe (PID: 7932)

    • Get information on the list of running processes

      • cmd.exe (PID: 8108)

    • Connects to unusual port

      • curl.exe (PID: 8152)
      • curl.exe (PID: 7832)
      • curl.exe (PID: 1676)
      • curl.exe (PID: 5408)
      • curl.exe (PID: 7360)
      • curl.exe (PID: 4980)
      • curl.exe (PID: 5744)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 8108)

    • Uses WMIC.EXE to obtain data on the base board management (motherboard or system board)

      • cmd.exe (PID: 1096)
      • cmd.exe (PID: 2236)

  • INFO

    • Creates a new folder

      • cmd.exe (PID: 7900)
      • cmd.exe (PID: 7876)
      • cmd.exe (PID: 7504)
      • cmd.exe (PID: 7564)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 7804)
      • mode.com (PID: 8140)

    • Checks supported languages

      • mode.com (PID: 7804)
      • loader.exe (PID: 7584)
      • chcp.com (PID: 8132)
      • curl.exe (PID: 8152)
      • curl.exe (PID: 6044)
      • curl.exe (PID: 7260)
      • loader.exe (PID: 8064)
      • mode.com (PID: 8140)
      • chcp.com (PID: 7872)
      • curl.exe (PID: 7832)
      • curl.exe (PID: 6032)
      • curl.exe (PID: 1676)
      • curl.exe (PID: 7360)
      • curl.exe (PID: 5744)
      • curl.exe (PID: 5408)
      • curl.exe (PID: 4980)

    • Create files in a temporary directory

      • loader.exe (PID: 7584)
      • curl.exe (PID: 6044)
      • curl.exe (PID: 7260)
      • loader.exe (PID: 8064)
      • curl.exe (PID: 6032)

    • Changes the display of characters in the console

      • cmd.exe (PID: 8108)
      • cmd.exe (PID: 5352)

    • Reads the computer name

      • curl.exe (PID: 6044)
      • curl.exe (PID: 7260)
      • curl.exe (PID: 6032)

    • Execution of CURL command

      • cmd.exe (PID: 8108)
      • cmd.exe (PID: 5352)

    • Creates files or folders in the user directory

      • cmd.exe (PID: 8108)
      • cmd.exe (PID: 5352)

    • Manual execution by a user

      • loader.exe (PID: 7928)
      • loader.exe (PID: 8064)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6752)
      • WMIC.exe (PID: 8116)

    • Checks proxy server information

      • slui.exe (PID: 5392)

    • Reads the software policy settings

      • slui.exe (PID: 5392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:04:22 18:25:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 57344
InitializedDataSize: 11550720
UninitializedDataSize: -
EntryPoint: 0x7f86
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
227
Monitored processes
91
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start loader.exe conhost.exe no specs cmd.exe no specs mode.com no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe chcp.com no specs curl.exe timeout.exe no specs curl.exe svchost.exe cmd.exe no specs cmd.exe no specs findstr.exe no specs curl.exe tasklist.exe no specs findstr.exe no specs taskkill.exe no specs timeout.exe no specs takeown.exe no specs icacls.exe no specs timeout.exe no specs loader.exe no specs loader.exe conhost.exe no specs cmd.exe no specs mode.com no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs chcp.com no specs curl.exe timeout.exe no specs curl.exe cmd.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs timeout.exe no specs timeout.exe no specs cmd.exe no specs wmic.exe no specs curl.exe findstr.exe no specs timeout.exe no specs slui.exe cmd.exe no specs wmic.exe no specs curl.exe findstr.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs timeout.exe no specs timeout.exe no specs curl.exe findstr.exe no specs findstr.exe no specs timeout.exe no specs timeout.exe no specs curl.exe findstr.exe no specs findstr.exe no specs timeout.exe no specs timeout.exe no specs curl.exe findstr.exe no specs findstr.exe no specs timeout.exe no specs timeout.exe no specs loader.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616timeout /t 2 /nobreak C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
960C:\WINDOWS\system32\cmd.exe /c type logs\login.txt | findstr "user_id"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1020taskkill /F /IM loader.exe C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1052timeout /t 3 /nobreak C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1096C:\WINDOWS\system32\cmd.exe /c wmic baseboard get serialnumber /valueC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1184tasklist C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1276"C:\Users\admin\Desktop\loader.exe" C:\Users\admin\Desktop\loader.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1672timeout /t 1 /nobreak C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1676curl -s -X POST http://54.38.157.20:5000/create_account -H "Content-Type: application/json" -d "{\"username\":\"admin\", \"password\":\"admin\", \"hwid\":\"\"}" -o logs\account.txt C:\Windows\System32\curl.exe
cmd.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
HIGH
Description:
The curl executable
Exit code:
0
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\cryptsp.dll
1760findstr /C:"\"status\": \"success\"" logs\account.txt C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
Total events
3 772
Read events
3 772
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
3
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
8008cmd.exeC:\Users\admin\AppData\Local\Temp\i6.ftext
MD5:FBB567216D6FA2A929F4FE2389740816
SHA256:D10A6587021A36C1AF3B558DE7D5BDE0C047D0C494454C1ED08B6A19BBCF842A
7584loader.exeC:\Users\admin\AppData\Local\Temp\wtmpd\tmp78824.battext
MD5:0DBB6BF004BA3B0B304963F097DD2F2F
SHA256:415232BC67C8426FFDBC34615FABE286CF1A07BE95DC024B6580589D7F4AED77
6044curl.exeC:\Users\admin\AppData\Local\Temp\loader_new.exeexecutable
MD5:8FA4FBC14D91FFDFFB284DEC11D0E639
SHA256:3CBB9C06B3E217D273E30650650FF955983A7A9C3D6A3FAE7FB9FEA5EC839AEB
7584loader.exeC:\Users\admin\AppData\Local\Temp\i6.battext
MD5:1AF1AB0E1E623C11529763D3016C0818
SHA256:57F6713E8C793D5D81FBBF2E16DB7098B1D5A3A608915E62468F2435DAFBFD85
7584loader.exeC:\Users\admin\AppData\Local\Temp\wtmpd\tmp18804.exetext
MD5:3C52638971EAD82B5929D605C1314EE0
SHA256:5614459EC05FDF6110FA8CE54C34E859671EEFFBA2B7BB4B1AD6C2C6706855AB
7260curl.exeC:\Users\admin\AppData\Local\Temp\latest_version.txttext
MD5:73CCD957744DD2396F454D124D02080B
SHA256:24F502B1E3ABFA8EA2DB55A62DD09FD7BE591D415B91F82AF0CE90CD7A443063
7988cmd.exeC:\Users\admin\AppData\Local\Temp\i6.ttext
MD5:21438EF4B9AD4FC266B6129A2F60DE29
SHA256:13BF7B3039C63BF5A50491FA3CFD8EB4E699D1BA1436315AEF9CBE5711530354
8064loader.exeC:\Users\admin\AppData\Local\Temp\wtmpd\tmp72094.battext
MD5:FF0DE3DC977BCA9B711EAAC070A9A3B4
SHA256:7676A50B47348FF89451D8E7EEEC093632FB96D81B354619CFF779ECD4E0AD48
5352cmd.exeC:\Users\admin\AppData\Roaming\Loader\license.txttext
MD5:210CF7AA5E2682C9C9D4511F88FE2789
SHA256:3BE481CA29E74A01367CEACA0B5C7F5EE53E9A407D26D4368EDD539541F7B13C
1676curl.exeC:\Users\admin\Desktop\logs\account.txtbinary
MD5:0C1E7E331FF98F81D1DA7874942C8141
SHA256:77FB2073462B0ABA5EE8C449EC16680D0379096666084F43166CE53D590A67B5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
33
DNS requests
23
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5780
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8152
curl.exe
GET
200
54.38.157.20:5000
http://54.38.157.20:5000/status
unknown
—
—
unknown
5780
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
756
lsass.exe
GET
200
23.209.213.129:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
756
lsass.exe
GET
200
2.19.120.133:80
http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2ttjyD6VkMQQUDcXM%2FZvuFAWhTDCCpT5eisNYCdICEgU5ncLLotvVuAz3YjJe2GmmKg%3D%3D
unknown
—
—
whitelisted
7836
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7832
curl.exe
GET
200
54.38.157.20:5000
http://54.38.157.20:5000/status
unknown
—
—
unknown
7836
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4244
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
3216
svchost.exe
20.7.1.246:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5780
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
8152
curl.exe
54.38.157.20:5000
cdn.echostore.cc
OVH SAS
DE
unknown
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7260
curl.exe
54.38.157.20:443
cdn.echostore.cc
OVH SAS
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
client.wns.windows.com
  • 20.7.1.246
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 23.215.0.133
  • 96.7.128.192
  • 96.7.128.186
  • 23.215.0.132
whitelisted
ipv4only.arpa
  • 192.0.0.171
  • 192.0.0.170
whitelisted
login.live.com
  • 20.190.160.130
  • 20.190.160.64
  • 20.190.160.66
  • 20.190.160.3
  • 40.126.32.136
  • 20.190.160.67
  • 20.190.160.20
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted

Threats

PID
Process
Class
Message
8152
curl.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
7832
curl.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
1676
curl.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
5408
curl.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
4980
curl.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
7360
curl.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
5744
curl.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/loader.exe