File name:

photo2025052468.exe

Full analysis: https://app.any.run/tasks/d491ba19-b2ea-4a8d-b427-2ff5639a1e22
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 26, 2025, 10:54:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zhong
stealer
auto-reg
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

296A2384C375D1DBB92FE261FC4DA0A5

SHA1:

047554A0A9DB397DD5AF46F53B3866C085728464

SHA256:

A04F1E64FD7E2EF6DECBFD2E26AD2A3066862FBE039A3BBED5CC9B6EACD4EDF9

SSDEEP:

768:weZnCUSN8NAUaB5uka5VKIh/fU/XLppEG:weBzGMka5VKIh/fUfLpWG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • photo2025052468.exe (PID: 4424)

    • Changes the autorun value in the registry

      • VideoManagerEntry.exe (PID: 5376)

    • ZHONG mutex has been found

      • VideoManagerEntry.exe (PID: 5376)
      • VideoManagerEntry.exe (PID: 5228)
      • VideoManagerEntry.exe (PID: 5116)

    • ZHONG has been detected (SURICATA)

      • VideoManagerEntry.exe (PID: 5376)

    • Actions looks like stealing of personal data

      • VideoManagerEntry.exe (PID: 5376)

    • ZHONG has been detected (YARA)

      • VideoManagerEntry.exe (PID: 5376)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • photo2025052468.exe (PID: 4424)

    • Starts a Microsoft application from unusual location

      • photo2025052468.exe (PID: 4424)

    • Executable content was dropped or overwritten

      • photo2025052468.exe (PID: 4424)

    • Reads security settings of Internet Explorer

      • photo2025052468.exe (PID: 4424)

    • The process drops C-runtime libraries

      • photo2025052468.exe (PID: 4424)

    • Contacting a server suspected of hosting an CnC

      • VideoManagerEntry.exe (PID: 5376)

    • Connects to unusual port

      • VideoManagerEntry.exe (PID: 5376)

    • Multiple wallet extension IDs have been found

      • VideoManagerEntry.exe (PID: 5376)

    • There is functionality for taking screenshot (YARA)

      • VideoManagerEntry.exe (PID: 5376)

    • There is functionality for communication over UDP network (YARA)

      • VideoManagerEntry.exe (PID: 5376)

    • The process executes via Task Scheduler

      • VideoManagerEntry.exe (PID: 5228)

  • INFO

    • Checks supported languages

      • photo2025052468.exe (PID: 4424)
      • VideoManagerEntry.exe (PID: 5376)
      • VideoManagerEntry.exe (PID: 5228)
      • VideoManagerEntry.exe (PID: 5116)

    • Reads the computer name

      • photo2025052468.exe (PID: 4424)
      • VideoManagerEntry.exe (PID: 5376)

    • Disables trace logs

      • photo2025052468.exe (PID: 4424)

    • Reads the machine GUID from the registry

      • photo2025052468.exe (PID: 4424)

    • Checks proxy server information

      • photo2025052468.exe (PID: 4424)

    • Reads the software policy settings

      • photo2025052468.exe (PID: 4424)
      • slui.exe (PID: 2240)

    • The sample compiled with english language support

      • photo2025052468.exe (PID: 4424)

    • The sample compiled with chinese language support

      • photo2025052468.exe (PID: 4424)

    • Process checks computer location settings

      • photo2025052468.exe (PID: 4424)

    • Launch of the file from Registry key

      • VideoManagerEntry.exe (PID: 5376)

    • Reads CPU info

      • VideoManagerEntry.exe (PID: 5376)

    • Manual execution by a user

      • VideoManagerEntry.exe (PID: 5116)

    • Compiled with Borland Delphi (YARA)

      • VideoManagerEntry.exe (PID: 5376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:22 14:35:18+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware
PEType: PE32
LinkerVersion: 6
CodeSize: 23040
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x794e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.18.25040.2
ProductVersionNumber: 4.18.25040.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileVersion: 4.18.25040.2
ProductVersion: 4.18.25040.2
FileDescription: Browser Protection Native Messaging Host
CompanyName: Microsoft Corporation
OriginalFileName: mpextms.exe
ProductName: Microsoft® Windows® Operating System
LegalCopyright: © Microsoft Corporation. All rights reserved.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start photo2025052468.exe sppextcomobj.exe no specs slui.exe mspaint.exe no specs #ZHONG videomanagerentry.exe #ZHONG videomanagerentry.exe no specs #ZHONG videomanagerentry.exe no specs slui.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1128C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1348C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2240"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4424"C:\Users\admin\AppData\Local\Temp\photo2025052468.exe" C:\Users\admin\AppData\Local\Temp\photo2025052468.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Browser Protection Native Messaging Host
Exit code:
0
Version:
4.18.25040.2
Modules
Images
c:\users\admin\appdata\local\temp\photo2025052468.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5116C:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\VideoManagerEntry.exeC:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\VideoManagerEntry.exe
explorer.exe
User:
admin
Company:
Tencent
Integrity Level:
MEDIUM
Description:
腾讯视频
Exit code:
0
Version:
11.120.1281.0
Modules
Images
c:\users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\videomanagerentry.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\vcruntime140.dll
5228"C:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\VideoManagerEntry.exe"C:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\VideoManagerEntry.exe
svchost.exe
User:
admin
Company:
Tencent
Integrity Level:
MEDIUM
Description:
腾讯视频
Exit code:
0
Version:
11.120.1281.0
Modules
Images
c:\users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\videomanagerentry.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\vcruntime140.dll
5376"C:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\VideoManagerEntry.exe" C:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\VideoManagerEntry.exe
photo2025052468.exe
User:
admin
Company:
Tencent
Integrity Level:
MEDIUM
Description:
腾讯视频
Version:
11.120.1281.0
Modules
Images
c:\users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\videomanagerentry.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ucrtbase.dll
6816"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\image.jpg"C:\Windows\SysWOW64\mspaint.exe—photo2025052468.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
3 557
Read events
3 540
Write events
17
Delete events
0

Modification events

(PID) Process:(4424) photo2025052468.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\photo2025052468_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4424) photo2025052468.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\photo2025052468_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4424) photo2025052468.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\photo2025052468_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4424) photo2025052468.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\photo2025052468_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4424) photo2025052468.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\photo2025052468_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4424) photo2025052468.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\photo2025052468_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4424) photo2025052468.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\photo2025052468_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4424) photo2025052468.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\photo2025052468_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4424) photo2025052468.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\photo2025052468_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4424) photo2025052468.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\photo2025052468_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
6
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4424photo2025052468.exeC:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\image.jpgimage
MD5:7CB8C795C23FBE5D1BB5C8CB0066DF66
SHA256:9F335D538045315049062636BA790967AC48642FA15B209C681545BD06791CED
4424photo2025052468.exeC:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\VideoManagerEntry.exeexecutable
MD5:2A364B6A8FD42693B15264E26DC9E6CD
SHA256:015FE40D6EDC0B36EA0C02E1FF958A3315375F348F5B12B313431E6EF284C642
4424photo2025052468.exeC:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\VideoManagerMainModule.dllexecutable
MD5:E41FDB58A7FC572F4A86EE16306A2D1B
SHA256:9759B4CD8BB6ABAEB97759141858DE68CD5D2C79D514DBA3E62128A6210FBB9E
4424photo2025052468.exeC:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\LogManager.dllexecutable
MD5:519F7E0828C7EDB921F3F4ED03275B60
SHA256:BB180E01F4CBB88A5F15B84F11D11CA7751584B1104C11717BA19B1CB7C47288
4424photo2025052468.exeC:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\commonbase.dllexecutable
MD5:E34A0536171CE1EA0D026FB7A1CCA896
SHA256:21A4E405282159CFB3DDDA661AD239E401CDBF02556FACC30135BEE6EE084539
4424photo2025052468.exeC:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\vcruntime140.dllexecutable
MD5:E51018E4985943C51FF91471F8906504
SHA256:FF9C1123CFF493A8F5EACB91115611B6C1C808B30C82AF9B6F388C0EF1F6B46D
4424photo2025052468.exeC:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\VideoManagerEntry.txttext
MD5:D476FF5557309A1349660FAB8EFC4179
SHA256:CEAE30EA5C346A2467F8477A90E65E3FFFAAB4149FA01FA982430BB7985AAD53
4424photo2025052468.exeC:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\VideoManagerEntry.edskvbinary
MD5:44F432C76EBF0B7BA26F37CE9CC70AEA
SHA256:7F7F25BD4A4AA47755D844ACFE3C88FF9BF38B03670EB32E0888A576C0E0D6A2
4424photo2025052468.exeC:\Users\admin\16fd6f1a-1609-48b0-8bf6-00f719dbe5050521\msvcp140.dllexecutable
MD5:7E8BDD2C2304E204B44A3BEC09D66062
SHA256:E4C71980DBB4A1E1A86816687AFDAEA043B639B531135FC4516FB2429FE623FC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
13
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
968
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
968
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4220
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.159.4:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.63.118.230:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
FR
unknown
4424
photo2025052468.exe
52.219.199.162:443
videomanagerentry.s3.ap-northeast-1.amazonaws.com
AMAZON-02
JP
shared

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
videomanagerentry.s3.ap-northeast-1.amazonaws.com
  • 52.219.199.162
  • 52.219.136.83
  • 52.219.150.78
  • 3.5.157.185
  • 52.219.16.127
  • 52.219.1.87
  • 52.219.162.142
  • 52.219.172.46
shared
u.arpuu.com
  • 15.168.9.85
malicious
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted

Threats

PID
Process
Class
Message
5376
VideoManagerEntry.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Zhong Stealer Initial Packet with Magic (TCP)
5376
VideoManagerEntry.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Zhong Stealer Null Packet (TCP)
5376
VideoManagerEntry.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Zhong Stealer Null Packet (TCP)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
photo2025052468.exe