File name:

Annabelle.exe

Full analysis: https://app.any.run/tasks/dd98ae4b-21a3-4c4b-a806-7032fa2be7d3
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 09, 2024, 00:28:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
confuser
ransomware
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

0F743287C9911B4B1C726C7C7EDCAF7D

SHA1:

9760579E73095455FCBADDFE1E7E98A2BB28BFE0

SHA256:

716335BA5CD1E7186C40295B199190E2B6655E48F1C1CBE12139BA67FAA5E1AC

SSDEEP:

393216:UMwm0qBknxdEX+LbMUgoSZmWSmh4aaRN22ChHCMNku1y4:UMcKX+Lbjgd7W1RNVC9ku1x

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Annabelle.exe (PID: 4864)

    • Deletes shadow copies

      • Annabelle.exe (PID: 4864)

    • Changes the login/logoff helper path in the registry

      • Annabelle.exe (PID: 4864)

    • Disables the Run the Start menu

      • Annabelle.exe (PID: 4864)

    • Disables Windows Defender

      • Annabelle.exe (PID: 4864)

    • UAC/LUA settings modification

      • Annabelle.exe (PID: 4864)

    • Changes image file execution options

      • Annabelle.exe (PID: 4864)
      • Annabelle.exe (PID: 4208)

    • RANSOMWARE has been detected

      • Annabelle.exe (PID: 4864)

  • SUSPICIOUS

    • Uses NETSH.EXE to change the status of the firewall

      • Annabelle.exe (PID: 4864)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6188)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 6492)
      • Annabelle.exe (PID: 4864)

    • Creates file in the systems drive root

      • Annabelle.exe (PID: 4864)
      • Annabelle.exe (PID: 4208)

    • Reads the date of Windows installation

      • Annabelle.exe (PID: 4864)

    • The system shut down or reboot

      • Annabelle.exe (PID: 4864)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 1372)

    • Checks for external IP

      • Annabelle.exe (PID: 4208)

  • INFO

    • Reads the machine GUID from the registry

      • Annabelle.exe (PID: 4864)
      • Annabelle.exe (PID: 4208)

    • Confuser has been detected (YARA)

      • Annabelle.exe (PID: 4864)

    • Reads the computer name

      • ShellExperienceHost.exe (PID: 6492)
      • Annabelle.exe (PID: 4208)
      • PLUGScheduler.exe (PID: 1372)

    • Checks supported languages

      • ShellExperienceHost.exe (PID: 6492)
      • Annabelle.exe (PID: 4864)
      • Annabelle.exe (PID: 4208)
      • PLUGScheduler.exe (PID: 1372)

    • The process uses the downloaded file

      • Annabelle.exe (PID: 4864)

    • Process checks computer location settings

      • Annabelle.exe (PID: 4864)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 1372)

    • Reads Environment values

      • Annabelle.exe (PID: 4208)

    • Disables trace logs

      • Annabelle.exe (PID: 4208)

    • Checks proxy server information

      • Annabelle.exe (PID: 4208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2018:02:18 17:54:24+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 80
CodeSize: 16437248
InitializedDataSize: 274432
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.0
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Annabelle
FileVersion: 2.1.0.0
InternalName: Annabelle.exe
LegalCopyright: Copyright © 2018
LegalTrademarks: -
OriginalFileName: Annabelle.exe
ProductName: UpdateBackup
ProductVersion: 2.1.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
230
Monitored processes
16
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT annabelle.exe vssadmin.exe no specs vssadmin.exe no specs conhost.exe no specs vssadmin.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs conhost.exe no specs vssvc.exe no specs shellexperiencehost.exe no specs shutdown.exe no specs conhost.exe no specs plugscheduler.exe no specs annabelle.exe annabelle.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
836\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—vssadmin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
848vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—Annabelle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1372"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2788"C:\Users\admin\AppData\Local\Temp\Annabelle.exe" C:\Users\admin\AppData\Local\Temp\Annabelle.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Annabelle
Exit code:
3221226540
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\annabelle.exe
c:\windows\system32\ntdll.dll
4208C:\Users\admin\AppData\Local\Temp\Annabelle.exeC:\Users\admin\AppData\Local\Temp\Annabelle.exe
userinit.exe
User:
admin
Integrity Level:
HIGH
Description:
Annabelle
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\annabelle.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4864"C:\Users\admin\AppData\Local\Temp\Annabelle.exe" C:\Users\admin\AppData\Local\Temp\Annabelle.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Annabelle
Exit code:
1073807364
Version:
2.1.0.0
Modules
Images
c:\windows\system32\wldp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\amsi.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\mpoav.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\mpclient.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msasn1.dll
5092\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—vssadmin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5640vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—Annabelle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5712vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—Annabelle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
3 448
Read events
3 344
Write events
104
Delete events
0

Modification events

(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateBackup
Value:
C:\Users\admin\AppData\Local\Temp\Annabelle.exe
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateBackup
Value:
C:\Users\admin\AppData\Local\Temp\Annabelle.exe
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateBackup
Value:
C:\Users\admin\AppData\Local\Temp\Annabelle.exe
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableRoutinelyTakingAction
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:WindowsDefenderMAJ
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:WindowsDefenderMAJ
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script Host\Settings
Operation:writeName:Enabled
Value:
0
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings
Operation:writeName:Enabled
Value:
0
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
Operation:writeName:DisableSR
Value:
1
Executable files
0
Suspicious files
60
Text files
2
Unknown types
8

Dropped files

PID
Process
Filename
Type
4864Annabelle.exeC:\Users\admin\Documents\Database1.accdb.ANNABELLEbinary
MD5:6923415A237011EFB8D48C0981D40E42
SHA256:66C65F8208725E985A2DE2E56200173FC3F91FBDB64EFDE9DF799945BF0E9E1C
4864Annabelle.exeC:\Users\admin\Documents\sonamong.rtf.ANNABELLEbinary
MD5:217B20A7D5C7D7D60D01872F901FB69C
SHA256:63A15379EA4EB7B671C6A5F4A76C8F1CAA06A52F0EB9BD2038E25AC6097637A6
4864Annabelle.exeC:\Users\admin\Documents\downhousing.rtf.ANNABELLEbinary
MD5:737DCF601F96A1EA12B56972B6559EE0
SHA256:E4186F57624E74E6DBB7D24FFA8D5D934B259FD9F64A4469444209F92D675153
4864Annabelle.exeC:\Users\admin\Documents\songseveral.rtf.ANNABELLEbinary
MD5:696707DE2DBE15C8D442887023FCD4C5
SHA256:7E38E48DB148E86FFA8A561D562CCE50184A1D7372BF2D257ACCC3F37087DC78
4864Annabelle.exeC:\Users\admin\Documents\muchnature.rtf.ANNABELLEbinary
MD5:0684666CEBA6223501C19393BCBBA8DF
SHA256:728A573B871759A8E05FC03B4BD0813F90AE0FF42EDE8E4493398A578F9E5181
4864Annabelle.exeC:\Users\admin\Pictures\askedpalm.jpg.ANNABELLEbinary
MD5:F5CEBEA9E3D1A62B5A4A9791CEB80EA8
SHA256:5F3056BFE7C0098EFA010D4D75E24B61455CB6E3DA50BD8CD1A2C7B1C54F565C
4864Annabelle.exeC:\Users\admin\Documents\yourmountain.rtf.ANNABELLEbinary
MD5:7CF94DE5AB08C5F9C9AD4DF48A254BE7
SHA256:C6FF3DFCEA86AB6EFACBC9EDAF9C1A05376F99564B885642743099286CF09BC0
4864Annabelle.exeC:\Users\admin\Pictures\afterstandards.png.ANNABELLEbinary
MD5:AB58273CEB7DB3D6DC5832905096B470
SHA256:D7F68D5420246B91C67AE30D3F67C3B25CE59D1100EEA2654DE4679606625ADD
4864Annabelle.exeC:\Users\admin\Pictures\endingad.png.ANNABELLEbinary
MD5:A4FB717EC3090B776F87E4EDC5F88733
SHA256:04F6CE8FD883C86865FFB73A58C5DCCD66623E6C28EF23514D9DC35EF63DB083
4864Annabelle.exeC:\Users\admin\Documents\stylevisitors.rtf.ANNABELLEbinary
MD5:BCEC9824EE37DA55F755E7EEAEC221FB
SHA256:2C0CF90C1278C7A6F875DA82FE99A5FD3FD50A0ECA6BFA3CC77C3CFC6CFF74F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
49
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2160
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2160
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4380
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2704
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4752
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2160
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2160
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.209.182:443
—
Akamai International B.V.
GB
unknown
2160
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.9
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.181.156
whitelisted
google.com
  • 216.58.206.78
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.17
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
self.events.data.microsoft.com
  • 52.168.117.174
  • 20.189.173.26
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted

Threats

PID
Process
Class
Message
4208
Annabelle.exe
Device Retrieving External IP Address Detected
ET POLICY Internal Host Retrieving External IP via myip.dnsomatic.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Annabelle.exe