File name:

GNBot - _ed by Baseult.zip

Full analysis: https://app.any.run/tasks/2d8c26de-8e0b-4228-9e20-ee5abf303557
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: March 01, 2021, 04:31:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

EA41FF7A615770803B741D466A17224F

SHA1:

6A663E193A4D27598F9F3F2BCE1FCD061DC528AF

SHA256:

8AC561AEAB3B3FE1415DE4BB51994A70E840E468802191652DA97E6D95DDD5FE

SSDEEP:

393216:jNDFfdDJJ359zkHNbSZqvW4XYRWb957rmpm8Uimal5fyt:dFfdDfp94RYq+4XZRrmpfUimEyt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3112)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)
      • explorer.exe (PID: 656)

    • Changes settings of System certificates

      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

    • Application was dropped or rewritten from another process

      • GNLauncher - (Cracked by Baseult).exe (PID: 2108)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2196)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2604)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2604)

    • Creates files like Ransomware instruction

      • WinRAR.exe (PID: 2604)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2604)

    • Reads Environment values

      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

    • Starts Internet Explorer

      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)

    • Adds / modifies Windows certificates

      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

    • Reads internet explorer settings

      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

  • INFO

    • Manual execution by user

      • GNLauncher - (Cracked by Baseult).exe (PID: 2108)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2112)
      • iexplore.exe (PID: 2948)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2112)
      • iexplore.exe (PID: 2948)

    • Application launched itself

      • iexplore.exe (PID: 2948)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2112)
      • iexplore.exe (PID: 2948)

    • Changes internet zones settings

      • iexplore.exe (PID: 2948)

    • Creates files in the user directory

      • iexplore.exe (PID: 2112)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2112)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2112)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2021:02:19 18:29:29
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: GNBot - Cracked by Baseult/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
9
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs gnlauncher - (cracked by baseult).exe no specs gnlauncher - (cracked by baseult).exe iexplore.exe iexplore.exe explorer.exe no specs gnlauncher - (cracked by baseult).exe no specs gnlauncher - (cracked by baseult).exe

Process information

PID
CMD
Path
Indicators
Parent process
656C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
2108"C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe" C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
GNLauncher
Exit code:
3221226540
Version:
1.0.197.58675
Modules
Images
c:\users\admin\desktop\gnbot - cracked by baseult\gnlauncher - (cracked by baseult).exe
c:\systemroot\system32\ntdll.dll
2112"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2948 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2196"C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe" C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
GNLauncher
Exit code:
3221226540
Version:
1.0.197.58675
Modules
Images
c:\users\admin\desktop\gnbot - cracked by baseult\gnlauncher - (cracked by baseult).exe
c:\systemroot\system32\ntdll.dll
2604"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\GNBot - _ed by Baseult.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2680"C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe" C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
GNLauncher
Exit code:
0
Version:
1.0.197.58675
Modules
Images
c:\users\admin\desktop\gnbot - cracked by baseult\gnlauncher - (cracked by baseult).exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2780"C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe" C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
GNLauncher
Exit code:
0
Version:
1.0.197.58675
Modules
Images
c:\users\admin\desktop\gnbot - cracked by baseult\gnlauncher - (cracked by baseult).exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2948"C:\Program Files\Internet Explorer\iexplore.exe" http://baseult.xyz/discordC:\Program Files\Internet Explorer\iexplore.exe
GNLauncher - (Cracked by Baseult).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3112"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
6 503
Read events
6 231
Write events
270
Delete events
2

Modification events

(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2604) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2604) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\GNBot - _ed by Baseult.zip
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2604) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
21
Suspicious files
26
Text files
66
Unknown types
17

Dropped files

PID
Process
Filename
Type
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\BWbot.pngimage
MD5:8284379E400B9F7E159CFD22C040C79B
SHA256:95308A909F3B46540606FC5E96B9123E53C5DF8BEBF0B6E1D23AE75D4F9D2F9E
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\AForge.Imaging.dllexecutable
MD5:5392A22226E960D4AE7E408913C49D6C
SHA256:107DA9260B6D2796335B516F043B360250001FEB0AE3B1C8422F90B5B9F6E282
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\CGAbot.pngimage
MD5:2C5887ABECBE9052D6F3AFAE07FBE555
SHA256:46BE0B554C95F0ABA742CCE393FDDCB1C96CB5DB8A4BA820623E9DC835675831
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\AgeZbot.pngimage
MD5:898156FDCF20163D0090A1703E3F1483
SHA256:E530C7C60321FF82E1E21FFF27BF8B18500787B825A8CC65261574867DD1D4E1
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\AmsBot.pngimage
MD5:7CF405BA0FDCC804F5B5140C3216CE1D
SHA256:04F6219085527A41BC92ADE83AED2E6C0714B41DCA2C020A8F04BB31A6A16252
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\CoeBot.pngimage
MD5:4FCB6A72F7514606D06996B7AFE10E50
SHA256:6251A19393164C3CA7D22BC31AF5829637308CC4A494ECE4F0F67D43A7F3E935
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\CoqBot.pngimage
MD5:6E8BE8FC39CB696DC18B3D10998CE534
SHA256:B616BB55940E600F25E92024AE24FC430BB30E48C85CFC92A7A6DFB1CFF8F1B3
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\LssBot.pngimage
MD5:74080765E331C6A983CA60A72CBB5AE3
SHA256:3D75DE249EB29F2D320D9559C313F897997B9086C326F9EF9B339C7916E35029
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\MafiaBot.pngimage
MD5:2E32B8FFE41375E456123D0BE6E1F9E3
SHA256:9286ED4EC195EC779A3437E449170CEF0AD902ED4FE73C5842DCE7831BE14C9B
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\GunsBot.pngimage
MD5:54222EA8E62DD97F506636F54587721D
SHA256:DA9B6B46E302ACD3F9698E8CF0393928F92FF0CDD742E6FFD5EB741CFC3F4D87
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
38
DNS requests
18
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2112
iexplore.exe
GET
301
198.54.115.164:80
http://baseult.xyz/discord
US
html
235 b
malicious
2112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAfdgkhmvPm4LTkRato%2BqFw%3D
US
der
279 b
whitelisted
2112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAfdgkhmvPm4LTkRato%2BqFw%3D
US
der
279 b
whitelisted
2112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2948
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2780
GNLauncher - (Cracked by Baseult).exe
POST
200
89.245.47.12:80
http://89.245.47.12/register.php
DE
text
7 b
unknown
2948
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2948
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA8aVkWYLIkXQFXHYN8Oxso%3D
US
der
471 b
whitelisted
2948
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2680
GNLauncher - (Cracked by Baseult).exe
198.54.115.164:443
lolspam.fun
Namecheap, Inc.
US
suspicious
2948
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2780
GNLauncher - (Cracked by Baseult).exe
198.54.115.164:443
lolspam.fun
Namecheap, Inc.
US
suspicious
2780
GNLauncher - (Cracked by Baseult).exe
89.245.47.12:80
—
1&1 Versatel Deutschland GmbH
DE
unknown
2780
GNLauncher - (Cracked by Baseult).exe
160.153.209.242:80
www.goodnightbot.net
GoDaddy.com, LLC
US
suspicious
2780
GNLauncher - (Cracked by Baseult).exe
192.124.249.15:443
www.gnbots.com
Sucuri
US
malicious
2112
iexplore.exe
162.159.128.233:443
discord.com
Cloudflare Inc
—
malicious
2948
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2780
GNLauncher - (Cracked by Baseult).exe
142.250.185.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2780
GNLauncher - (Cracked by Baseult).exe
192.124.249.41:80
ocsp.godaddy.com
Sucuri
US
suspicious

DNS requests

Domain
IP
Reputation
lolspam.fun
  • 198.54.115.164
suspicious
baseult.xyz
  • 198.54.115.164
malicious
discord.gg
  • 162.159.134.234
  • 162.159.135.234
  • 162.159.136.234
  • 162.159.130.234
  • 162.159.133.234
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
discord.com
  • 162.159.128.233
  • 162.159.136.232
  • 162.159.135.232
  • 162.159.138.232
  • 162.159.137.232
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
www.goodnightbot.net
  • 160.153.209.242
suspicious

Threats

PID
Process
Class
Message
2112
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2112
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GNBot - _ed by Baseult.zip