File name:

GNBot - _ed by Baseult.zip

Full analysis: https://app.any.run/tasks/2d8c26de-8e0b-4228-9e20-ee5abf303557
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: March 01, 2021, 04:31:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

EA41FF7A615770803B741D466A17224F

SHA1:

6A663E193A4D27598F9F3F2BCE1FCD061DC528AF

SHA256:

8AC561AEAB3B3FE1415DE4BB51994A70E840E468802191652DA97E6D95DDD5FE

SSDEEP:

393216:jNDFfdDJJ359zkHNbSZqvW4XYRWb957rmpm8Uimal5fyt:dFfdDfp94RYq+4XZRrmpfUimEyt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GNLauncher - (Cracked by Baseult).exe (PID: 2108)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2196)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3112)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)
      • explorer.exe (PID: 656)

    • Changes settings of System certificates

      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

  • SUSPICIOUS

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2604)

    • Starts Internet Explorer

      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2604)

    • Reads Environment values

      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

    • Creates files like Ransomware instruction

      • WinRAR.exe (PID: 2604)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2604)

    • Adds / modifies Windows certificates

      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

    • Reads internet explorer settings

      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2948)

    • Manual execution by user

      • GNLauncher - (Cracked by Baseult).exe (PID: 2680)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2108)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2112)
      • iexplore.exe (PID: 2948)

    • Creates files in the user directory

      • iexplore.exe (PID: 2112)

    • Application launched itself

      • iexplore.exe (PID: 2948)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2112)
      • iexplore.exe (PID: 2948)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2112)
      • iexplore.exe (PID: 2948)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2112)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2112)
      • GNLauncher - (Cracked by Baseult).exe (PID: 2780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2021:02:19 18:29:29
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: GNBot - Cracked by Baseult/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
9
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs gnlauncher - (cracked by baseult).exe no specs gnlauncher - (cracked by baseult).exe iexplore.exe iexplore.exe explorer.exe no specs gnlauncher - (cracked by baseult).exe no specs gnlauncher - (cracked by baseult).exe

Process information

PID
CMD
Path
Indicators
Parent process
656C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
2108"C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe" C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
GNLauncher
Exit code:
3221226540
Version:
1.0.197.58675
Modules
Images
c:\users\admin\desktop\gnbot - cracked by baseult\gnlauncher - (cracked by baseult).exe
c:\systemroot\system32\ntdll.dll
2112"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2948 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2196"C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe" C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
GNLauncher
Exit code:
3221226540
Version:
1.0.197.58675
Modules
Images
c:\users\admin\desktop\gnbot - cracked by baseult\gnlauncher - (cracked by baseult).exe
c:\systemroot\system32\ntdll.dll
2604"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\GNBot - _ed by Baseult.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2680"C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe" C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
GNLauncher
Exit code:
0
Version:
1.0.197.58675
Modules
Images
c:\users\admin\desktop\gnbot - cracked by baseult\gnlauncher - (cracked by baseult).exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2780"C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe" C:\Users\admin\Desktop\GNBot - Cracked by Baseult\GNLauncher - (Cracked by Baseult).exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
GNLauncher
Exit code:
0
Version:
1.0.197.58675
Modules
Images
c:\users\admin\desktop\gnbot - cracked by baseult\gnlauncher - (cracked by baseult).exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2948"C:\Program Files\Internet Explorer\iexplore.exe" http://baseult.xyz/discordC:\Program Files\Internet Explorer\iexplore.exe
GNLauncher - (Cracked by Baseult).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3112"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
6 503
Read events
6 231
Write events
270
Delete events
2

Modification events

(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2604) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2604) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\GNBot - _ed by Baseult.zip
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2604) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
21
Suspicious files
26
Text files
66
Unknown types
17

Dropped files

PID
Process
Filename
Type
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\AgeZbot.pngimage
MD5:898156FDCF20163D0090A1703E3F1483
SHA256:E530C7C60321FF82E1E21FFF27BF8B18500787B825A8CC65261574867DD1D4E1
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\BWbot.pngimage
MD5:8284379E400B9F7E159CFD22C040C79B
SHA256:95308A909F3B46540606FC5E96B9123E53C5DF8BEBF0B6E1D23AE75D4F9D2F9E
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\AmsBot.pngimage
MD5:7CF405BA0FDCC804F5B5140C3216CE1D
SHA256:04F6219085527A41BC92ADE83AED2E6C0714B41DCA2C020A8F04BB31A6A16252
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\AForge.Math.dllexecutable
MD5:C69973F674D9D113411D0FA2D1DBE222
SHA256:A4F24C9A46705C66FF7838C3A4C61759F5BA58EE8A5B061D05340C61D790C0B7
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\ConquestBot.pngimage
MD5:A66C662B62685B00DB20D6BD53860332
SHA256:969B1C2AF5C009CF4BCC98B8B06E846BBC9F15C74A6022D50EFFEABAD8CE19A8
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\CoeBot.pngimage
MD5:4FCB6A72F7514606D06996B7AFE10E50
SHA256:6251A19393164C3CA7D22BC31AF5829637308CC4A494ECE4F0F67D43A7F3E935
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\AForge.dllexecutable
MD5:02C63F568E598AAD85DD401D7B26E82A
SHA256:966A474060A8ACA70C73BA09D0B6FE2353035961C7107B9003EF879C010FF8DA
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\KoAbot.pngimage
MD5:3E1B654C03CC38E99C22C2443081CDB3
SHA256:DA49BF058546D5F0A1114DD896227923965FD8AB424CDEBC3CF8A74F26950069
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\GunsBot.pngimage
MD5:54222EA8E62DD97F506636F54587721D
SHA256:DA9B6B46E302ACD3F9698E8CF0393928F92FF0CDD742E6FFD5EB741CFC3F4D87
2604WinRAR.exeC:\Users\admin\Desktop\GNBot - Cracked by Baseult\app_images\KingsBotWest.pngimage
MD5:1EC9A4B3676D95B8B61F7B581BBD8D60
SHA256:2E8D978F7C94146F95F3316EFB475F52448CD062640B40167F60DDDC23B79374
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
38
DNS requests
18
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2680
GNLauncher - (Cracked by Baseult).exe
POST
200
89.245.47.12:80
http://89.245.47.12/login.php
DE
text
7 b
unknown
2112
iexplore.exe
GET
301
198.54.115.164:80
http://baseult.xyz/discord
US
html
235 b
malicious
2112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAfdgkhmvPm4LTkRato%2BqFw%3D
US
der
279 b
whitelisted
2112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAfdgkhmvPm4LTkRato%2BqFw%3D
US
der
279 b
whitelisted
2948
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2948
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2948
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2948
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA8aVkWYLIkXQFXHYN8Oxso%3D
US
der
471 b
whitelisted
2780
GNLauncher - (Cracked by Baseult).exe
POST
200
89.245.47.12:80
http://89.245.47.12/register.php
DE
text
7 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2680
GNLauncher - (Cracked by Baseult).exe
198.54.115.164:443
lolspam.fun
Namecheap, Inc.
US
suspicious
2680
GNLauncher - (Cracked by Baseult).exe
89.245.47.12:80
—
1&1 Versatel Deutschland GmbH
DE
unknown
2948
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2780
GNLauncher - (Cracked by Baseult).exe
198.54.115.164:443
lolspam.fun
Namecheap, Inc.
US
suspicious
2780
GNLauncher - (Cracked by Baseult).exe
192.124.249.15:443
www.gnbots.com
Sucuri
US
malicious
2780
GNLauncher - (Cracked by Baseult).exe
160.153.209.242:80
www.goodnightbot.net
GoDaddy.com, LLC
US
suspicious
2780
GNLauncher - (Cracked by Baseult).exe
89.245.47.12:80
—
1&1 Versatel Deutschland GmbH
DE
unknown
2780
GNLauncher - (Cracked by Baseult).exe
172.217.18.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2780
GNLauncher - (Cracked by Baseult).exe
192.124.249.41:80
ocsp.godaddy.com
Sucuri
US
suspicious
—
—
142.250.186.131:443
fonts.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
lolspam.fun
  • 198.54.115.164
suspicious
baseult.xyz
  • 198.54.115.164
malicious
discord.gg
  • 162.159.134.234
  • 162.159.135.234
  • 162.159.136.234
  • 162.159.130.234
  • 162.159.133.234
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
discord.com
  • 162.159.128.233
  • 162.159.136.232
  • 162.159.135.232
  • 162.159.138.232
  • 162.159.137.232
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
www.goodnightbot.net
  • 160.153.209.242
suspicious

Threats

PID
Process
Class
Message
2112
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2112
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GNBot - _ed by Baseult.zip