File name:

[BETA 0.7] Doenerium.rar

Full analysis: https://app.any.run/tasks/7e1e6414-5243-4e3e-b291-1098ffdd5f0e
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: June 24, 2025, 11:50:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-scr
asyncrat
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A8F3A954545D0D827D2782BC3DB2C077

SHA1:

09F3ECC0BCA498FE7AC108F805BFA1B3C7BE4D22

SHA256:

CA2E5E47434E991D085CBC07F67287739BC2379AF356159732EA75DF00C83880

SSDEEP:

24576:Bkb3JhUID8Sk+8ekMQHusNly3I2iMZ7K64ZUBZe:yb3JhnD8Sk+8ekMQHusNly3JiMZ7K6Mx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6528)

    • Changes the autorun value in the registry

      • stub.exe (PID: 5808)

    • ASYNCRAT has been detected (YARA)

      • system.exe (PID: 1964)

  • SUSPICIOUS

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2780)

    • Connects to unusual port

      • system.exe (PID: 1964)

    • The executable file from the user directory is run by the CMD process

      • system.exe (PID: 1964)

    • The process creates files with name similar to system file names

      • stub.exe (PID: 5808)

    • Executable content was dropped or overwritten

      • stub.exe (PID: 5808)

    • Starts CMD.EXE for commands execution

      • stub.exe (PID: 5808)

    • Executing commands from a ".bat" file

      • stub.exe (PID: 5808)

  • INFO

    • Checks supported languages

      • stub.exe (PID: 5808)
      • system.exe (PID: 1964)
      • stub.exe (PID: 4100)
      • stub.exe (PID: 6348)
      • stub.exe (PID: 2512)

    • Manual execution by a user

      • cmd.exe (PID: 7080)
      • cmd.exe (PID: 6732)
      • cmd.exe (PID: 3632)
      • cmd.exe (PID: 5104)

    • Reads the computer name

      • system.exe (PID: 1964)
      • stub.exe (PID: 5808)
      • stub.exe (PID: 4100)
      • stub.exe (PID: 6348)
      • stub.exe (PID: 2512)

    • Reads the machine GUID from the registry

      • system.exe (PID: 1964)
      • stub.exe (PID: 5808)
      • stub.exe (PID: 4100)
      • stub.exe (PID: 6348)
      • stub.exe (PID: 2512)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6528)

    • Launching a file from a Registry key

      • stub.exe (PID: 5808)

    • Creates files or folders in the user directory

      • stub.exe (PID: 5808)

    • Checks proxy server information

      • slui.exe (PID: 4816)

    • Reads the software policy settings

      • slui.exe (PID: 4816)

    • Create files in a temporary directory

      • stub.exe (PID: 5808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(1964) system.exe
C2 (1)act-fluid.gl.at.ply.gg
Ports (1)43955
Version
Options
AutoRuntrue
MutexdΗCrתt勒CبωΔYA吉tTr迪cΑΔdΘ9
InstallFolder%AppData%
Certificates
Cert1MIICKTCCAZKgAwIBAgIVANuipMOb3bgqlyteV84QDUFElFzvMA0GCSqGSIb3DQEBDQUAMF0xDjAMBgNVBAMMBUVCT0xBMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwODI1MjE1OTI0WhcNMzMwNjAzMjE1OTI0WjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA...
Server_SignatureawddJZ934LMG4AsRbTa6pIYbTKaAy8xpwQBYqIxirQwX96V3TUahbZ35pxctnKcRI+g5ZT5IwSwH588jNX+S5OEWTydOgyPuShluDhMRIH63WQoYWVZDtPcJu3zxBoK0nf/LRjZD7INGT5afd0Eze6hszcA/lSerHZSLc4sb1TU=
Keys
AES475b96a784d13678b57fb842dae17bc91d7daf14324ee27b1e2a3b13bc199a69
SaltDcRatByqwqdanchun
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 1064
UncompressedSize: 3416
OperatingSystem: Win32
ArchivedFileName: [BETA 0.7] Doenerium/[BETA 0.7] Doenerium/build/build.js
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
20
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs cmd.exe no specs conhost.exe no specs stub.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs #ASYNCRAT system.exe svchost.exe cmd.exe no specs conhost.exe no specs stub.exe no specs cmd.exe no specs conhost.exe no specs stub.exe no specs cmd.exe no specs conhost.exe no specs stub.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
304timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1356\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1732\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1964"C:\Users\admin\AppData\Roaming\system.exe" C:\Users\admin\AppData\Roaming\system.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Version:
3.6.0.0
Modules
Images
c:\users\admin\appdata\roaming\system.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
AsyncRat
(PID) Process(1964) system.exe
C2 (1)act-fluid.gl.at.ply.gg
Ports (1)43955
Version
Options
AutoRuntrue
MutexdΗCrתt勒CبωΔYA吉tTr迪cΑΔdΘ9
InstallFolder%AppData%
Certificates
Cert1MIICKTCCAZKgAwIBAgIVANuipMOb3bgqlyteV84QDUFElFzvMA0GCSqGSIb3DQEBDQUAMF0xDjAMBgNVBAMMBUVCT0xBMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwODI1MjE1OTI0WhcNMzMwNjAzMjE1OTI0WjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA...
Server_SignatureawddJZ934LMG4AsRbTa6pIYbTKaAy8xpwQBYqIxirQwX96V3TUahbZ35pxctnKcRI+g5ZT5IwSwH588jNX+S5OEWTydOgyPuShluDhMRIH63WQoYWVZDtPcJu3zxBoK0nf/LRjZD7INGT5afd0Eze6hszcA/lSerHZSLc4sb1TU=
Keys
AES475b96a784d13678b57fb842dae17bc91d7daf14324ee27b1e2a3b13bc199a69
SaltDcRatByqwqdanchun
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2512"C:\Users\admin\Desktop\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\stub\stub.exe" C:\Users\admin\Desktop\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\stub\stub.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.6.0.0
Modules
Images
c:\users\admin\desktop\[beta 0.7] doenerium\[beta 0.7] doenerium\stub\stub.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2780C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp9B26.tmp.bat""C:\Windows\System32\cmd.exe—stub.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
3632C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\install.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3636\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
8 788
Read events
8 769
Write events
19
Delete events
0

Modification events

(PID) Process:(6528) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6528) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6528) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6528) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\[BETA 0.7] Doenerium.rar
(PID) Process:(6528) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6528) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6528) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6528) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6528) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(6528) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
2
Suspicious files
9
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
6528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6528.14788\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\fix.battext
MD5:E4EDB955A64B7F4C9A5058083F71BF0F
SHA256:41AA9F2797DBDFA5A81216E347C7AFB107FCDEE13A0CCCB88E8A49D6110ADFBE
6528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6528.14788\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\build\build.jsbinary
MD5:43A17F9F54F87D1C483D1A3F6BF5726C
SHA256:CB3E91FE5F70F01C74C5F7FE152559074F5A36FAFBE2416E987C8149ABD204EE
6528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6528.14788\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\build\ressources.mjsbinary
MD5:62E396661533311AFB6F814534128936
SHA256:7D2A9F9ADB9D0837CC5C99DAC731597EFF1E104E6AE332EDE8B3AA5059B9C1DA
6528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6528.14788\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\icon\gta6.icoimage
MD5:6EE88DD1522886AEDB1208D1606207F3
SHA256:B77416C5760A2FA222421D267502C5C0A2402BBFAD0D721E54F749E210ADD314
6528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6528.14788\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\build\package.jsonbinary
MD5:B7F67D186B8FE46FD16D5D8DA871E2E3
SHA256:C5F909AD2D915DA70EF931C4C63E6A4523451616F81E4C2C54988A29BEB1420A
6528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6528.14788\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\icon\edge.icoimage
MD5:CD39617876127AE39166642CCD050EEC
SHA256:792A31F03553CFB1B05FB0E833EA559F33B388198726AE5B5D313A0335219CC2
6528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6528.14788\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\build.battext
MD5:F4A5865541FC975CD7F12DA3FB0C1B5C
SHA256:6DA093D57CE03AD27A07824C31BA9B2C22B31ED0CB5DFB616717548A2925AD62
6528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6528.14788\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\icon\chrome.icoimage
MD5:8280054D1069F314B93DD99A418F1F0B
SHA256:A277CD9B5A4322F59BBE59B0B5A23B3B03D1313DCD16BF786AAE81ADF2AEE3E6
6528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6528.14788\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\icon\epic.icoimage
MD5:0032D1D989D1371DB34423F344D727CA
SHA256:B6FB6BA38FDBC15F50C5158E0F6E2F7A4E7AD908F8D96B72FFD6438B059974DD
6528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6528.14788\[BETA 0.7] Doenerium\[BETA 0.7] Doenerium\install.battext
MD5:4416DBEF6489E123AB45F72E6A5E4D87
SHA256:6B1E159A935BD22AF9440FC0E456294EA83DECAD4CCE0481E9198556FC41F235
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
43
DNS requests
18
Threats
3

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6024
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1964
system.exe
147.185.221.18:43955
act-fluid.gl.at.ply.gg
PLAYIT-GG
US
suspicious
1192
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4816
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.206
whitelisted
act-fluid.gl.at.ply.gg
  • 147.185.221.18
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted
self.events.data.microsoft.com
  • 20.189.173.28
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
  • 2603:1030:c02:2::284
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
2200
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
2200
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
[BETA 0.7] Doenerium.rar