download:

Download%20X-SLAYER%20Tools%20v0.2.exe

Full analysis: https://app.any.run/tasks/acae5645-f97f-47e7-8946-dd299cf3f73a
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: February 24, 2020, 18:10:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

CAD661F79A64CEBD4AD9D22AE1F2C3B6

SHA1:

C25BE755379079FEF53E1C54B7EC15756D127FE6

SHA256:

A0361B2A0A794F1364ED8345A1484C05D4A4EE797641FF3D0507B485EC73471F

SSDEEP:

24576:WZqqqqSqqqqqqLqq/qqAZl2Lcb24EgU1ouK0pH2iBjfz8Xq2VK4sFwpIz8:4jnQpTp2C4I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Mailist & Combo SLAYER.exe (PID: 3332)
      • Proxy Grabber v0.2 By X-SLAYER.exe (PID: 2648)

    • Loads dropped or rewritten executable

      • Mailist & Combo SLAYER.exe (PID: 3332)

  • SUSPICIOUS

    • Reads Environment values

      • Mailist & Combo SLAYER.exe (PID: 3332)

    • Executable content was dropped or overwritten

      • Mailist & Combo SLAYER.exe (PID: 3332)
      • WinRAR.exe (PID: 2336)
      • WinRAR.exe (PID: 3240)

    • Reads internet explorer settings

      • d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exe (PID: 3012)

  • INFO

    • Manual execution by user

      • WinRAR.exe (PID: 2336)
      • WinRAR.exe (PID: 3240)
      • WinRAR.exe (PID: 848)

    • Reads settings of System Certificates

      • Mailist & Combo SLAYER.exe (PID: 3332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe | Win64 Executable (generic) (21)
.scr | Windows screen saver (9.9)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:08:07 17:49:01+02:00
PEType: PE32
LinkerVersion: 11
CodeSize: 1744896
InitializedDataSize: 207872
UninitializedDataSize: -
EntryPoint: 0x1abe5e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription: Download X-SLAYER Tools v0.1
FileVersion: 1.0.0.0
InternalName: Download X-SLAYER Tools v0.1.exe
LegalCopyright: Copyright © 2019
OriginalFileName: Download X-SLAYER Tools v0.1.exe
ProductName: Download X-SLAYER Tools v0.1
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 07-Aug-2019 15:49:01
Debug artifacts:
  • C:\Users\X-SLAYER\Documents\Visual Studio 2013\Projects\Download X-SLAYER Tools v0.1\Download X-SLAYER Tools v0.1\obj\Debug\Download X-SLAYER Tools v0.1.pdb
FileDescription: Download X-SLAYER Tools v0.1
FileVersion: 1.0.0.0
InternalName: Download X-SLAYER Tools v0.1.exe
LegalCopyright: Copyright © 2019
OriginalFilename: Download X-SLAYER Tools v0.1.exe
ProductName: Download X-SLAYER Tools v0.1
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 07-Aug-2019 15:49:01
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x001A9E64
0x001AA000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.05685
.sdata
0x001AC000
0x00000138
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.99924
.rsrc
0x001AE000
0x000327D0
0x00032800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.62292
.reloc
0x001E2000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST
2
7.96073
42899
UNKNOWN
UNKNOWN
RT_ICON
3
3.19634
67624
UNKNOWN
UNKNOWN
RT_ICON
4
3.32117
38056
UNKNOWN
UNKNOWN
RT_ICON
5
3.37629
21640
UNKNOWN
UNKNOWN
RT_ICON
6
3.40732
16936
UNKNOWN
UNKNOWN
RT_ICON
7
3.43002
9640
UNKNOWN
UNKNOWN
RT_ICON
8
3.68584
4264
UNKNOWN
UNKNOWN
RT_ICON
9
3.86768
2440
UNKNOWN
UNKNOWN
RT_ICON
10
4.02343
1128
UNKNOWN
UNKNOWN
RT_ICON

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exe winrar.exe no specs winrar.exe mailist & combo slayer.exe winrar.exe proxy grabber v0.2 by x-slayer.exe

Process information

PID
CMD
Path
Indicators
Parent process
848"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Instagram Valid Email Checker.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2336"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Mailist & Combo SLAYER.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2648"C:\Users\admin\AppData\Local\Temp\Rar$EXa3240.2597\Proxy Grabber\Proxy Grabber v0.2 By X-SLAYER.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3240.2597\Proxy Grabber\Proxy Grabber v0.2 By X-SLAYER.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Proxy Grabber v0.1
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3240.2597\proxy grabber\proxy grabber v0.2 by x-slayer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3012"C:\Users\admin\AppData\Local\Temp\d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exe" C:\Users\admin\AppData\Local\Temp\d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Download X-SLAYER Tools v0.1
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3240"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Proxy Grabber.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3332"C:\Users\admin\AppData\Local\Temp\Rar$EXa2336.48311\Mailist & Combo SLAYER\Mailist & Combo SLAYER.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2336.48311\Mailist & Combo SLAYER\Mailist & Combo SLAYER.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SLAYER Combo Searcher v 0.4
Exit code:
0
Version:
0.4
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2336.48311\mailist & combo slayer\mailist & combo slayer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 550
Read events
1 426
Write events
124
Delete events
0

Modification events

(PID) Process:(3012) d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d54216ff-de7f-4a12-8a23-dc5a0e74ae87_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3012) d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d54216ff-de7f-4a12-8a23-dc5a0e74ae87_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3012) d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d54216ff-de7f-4a12-8a23-dc5a0e74ae87_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3012) d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d54216ff-de7f-4a12-8a23-dc5a0e74ae87_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3012) d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d54216ff-de7f-4a12-8a23-dc5a0e74ae87_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3012) d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d54216ff-de7f-4a12-8a23-dc5a0e74ae87_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3012) d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d54216ff-de7f-4a12-8a23-dc5a0e74ae87_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3012) d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d54216ff-de7f-4a12-8a23-dc5a0e74ae87_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3012) d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d54216ff-de7f-4a12-8a23-dc5a0e74ae87_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3012) d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d54216ff-de7f-4a12-8a23-dc5a0e74ae87_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
5
Suspicious files
4
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3012d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeC:\Users\admin\Desktop\Proxy Grabber.rarcompressed
MD5:—
SHA256:—
3012d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeC:\Users\admin\Desktop\Proxy Checker v0.1 By X-SLAYER.rarcompressed
MD5:—
SHA256:—
3012d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeC:\Users\admin\Desktop\Mailist & Combo SLAYER.rarcompressed
MD5:—
SHA256:—
3240WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3240.2597\Proxy Grabber\TXT Files MERGE by X-SLAYER.exeexecutable
MD5:—
SHA256:—
3240WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3240.2597\Proxy Grabber\Proxy Grabber v0.2 By X-SLAYER.exeexecutable
MD5:—
SHA256:—
3012d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exeC:\Users\admin\Desktop\Instagram Valid Email Checker.rarcompressed
MD5:—
SHA256:—
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.48311\Mailist & Combo SLAYER\SkinSoft.VisualStyler.dllexecutable
MD5:2D84A619D4BD339F860CB48AF0C9B6C8
SHA256:365FFDE7DF914840EB21C96F34C39912A4B031E3814B8E902B67ACEE6DFF65A1
3332Mailist & Combo SLAYER.exeC:\Users\admin\AppData\Local\SkinSoft\VisualStyler\2.3.5.0\x86\ssapihook.dllexecutable
MD5:D7F644C06B4CDE60651D02AED6B4174D
SHA256:A99EA2F5759B34859B484AFA3A58CE82A7F3BF792886A6C838DB852D517D9C0D
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.48311\Mailist & Combo SLAYER\Mailist & Combo SLAYER.exeexecutable
MD5:915C0A762D1996D97788DCA49E05004D
SHA256:20D770AD94FADF7E6F20E69124EE181863AE17D59EB2444AE32DE56CD825A771
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
15
DNS requests
12
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3332
Mailist & Combo SLAYER.exe
GET
200
172.217.21.196:80
http://www.google.com/search?q=gmail&start=30
US
html
31.3 Kb
malicious
3332
Mailist & Combo SLAYER.exe
GET
200
172.217.21.196:80
http://www.google.com/search?q=%0Ayahoo&start=30
US
html
33.0 Kb
malicious
3332
Mailist & Combo SLAYER.exe
GET
200
172.217.21.196:80
http://www.google.com/search?q=gmail&start=30
US
html
31.3 Kb
malicious
3332
Mailist & Combo SLAYER.exe
GET
200
172.217.21.196:80
http://www.google.com/search?q=%0Ayahoo&start=30
US
html
33.0 Kb
malicious
3332
Mailist & Combo SLAYER.exe
GET
200
172.217.21.196:80
http://www.google.com/search?q=%0Aaol&start=30
US
html
33.5 Kb
malicious
3332
Mailist & Combo SLAYER.exe
GET
200
172.217.21.196:80
http://www.google.com/search?q=%0Aaol&start=30
US
html
33.5 Kb
malicious
3332
Mailist & Combo SLAYER.exe
GET
200
104.23.98.190:80
http://pastebin.com/raw/TdUnEtwN
US
text
3 b
malicious
3332
Mailist & Combo SLAYER.exe
GET
200
172.217.21.196:80
http://www.google.com/search?q=%0A&start=30
US
html
18.9 Kb
malicious
3332
Mailist & Combo SLAYER.exe
GET
200
204.79.197.200:80
http://www.bing.com/search?q=%0Aaol&start=55
US
html
243 Kb
whitelisted
3332
Mailist & Combo SLAYER.exe
GET
200
204.79.197.200:80
http://www.bing.com/search?q=gmail&start=55
US
html
214 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3012
d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exe
172.217.23.110:443
drive.google.com
Google Inc.
US
whitelisted
3012
d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exe
216.58.205.225:443
doc-10-58-docs.googleusercontent.com
Google Inc.
US
whitelisted
3012
d54216ff-de7f-4a12-8a23-dc5a0e74ae87.exe
104.23.99.190:443
pastebin.com
Cloudflare Inc
US
malicious
3332
Mailist & Combo SLAYER.exe
172.217.21.196:80
www.google.com
Google Inc.
US
whitelisted
3332
Mailist & Combo SLAYER.exe
104.23.98.190:80
pastebin.com
Cloudflare Inc
US
malicious
3332
Mailist & Combo SLAYER.exe
172.217.21.196:443
www.google.com
Google Inc.
US
whitelisted
3332
Mailist & Combo SLAYER.exe
5.255.255.70:443
yandex.ru
YANDEX LLC
RU
whitelisted
3332
Mailist & Combo SLAYER.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3332
Mailist & Combo SLAYER.exe
216.58.208.36:443
www.google.com
Google Inc.
US
whitelisted
2648
Proxy Grabber v0.2 By X-SLAYER.exe
104.27.148.235:443
free-proxy-list.net
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.23.99.190
  • 104.23.98.190
malicious
drive.google.com
  • 172.217.23.110
shared
doc-10-58-docs.googleusercontent.com
  • 216.58.205.225
shared
doc-0c-58-docs.googleusercontent.com
  • 216.58.205.225
shared
doc-00-58-docs.googleusercontent.com
  • 216.58.205.225
whitelisted
doc-04-58-docs.googleusercontent.com
  • 216.58.205.225
whitelisted
www.google.com
  • 172.217.21.196
  • 216.58.208.36
malicious
yandex.ru
  • 5.255.255.70
  • 77.88.55.60
  • 77.88.55.66
  • 5.255.255.60
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
free-proxy-list.net
  • 104.27.148.235
  • 104.27.149.235
unknown

Threats

PID
Process
Class
Message
3332
Mailist & Combo SLAYER.exe
Misc activity
SUSPICIOUS [PTsecurity] Minimal HTTP Header for Request to Pastebin
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Download%20X-SLAYER%20Tools%20v0.2.exe