File name:

Crypto Brutoforce.zip

Full analysis: https://app.any.run/tasks/0d82f56a-dc81-41c3-8de1-f1280721a0d1
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 25, 2024, 12:47:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

45B344877303B3CA013527531672394C

SHA1:

4C3F99D158E93DA98A44B955B2314EC9267EF19C

SHA256:

D57F51EA9FE46C6C14AE9B0AB84175A16BFC049811CD66F82E70E83B6C5378C8

SSDEEP:

98304:yl8+rk3PW2Eig0YBCdxZ+G/1B/ngX46GS0J6nMc3/nkv15QL2Ojo2e12yJpKIuDZ:ooSayj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4052)
      • SeedBrutoforce .exe (PID: 3228)
      • Both.exe (PID: 2304)

    • Actions looks like stealing of personal data

      • Client.exe (PID: 3276)

    • Steals credentials

      • Client.exe (PID: 3276)

    • Steals credentials from Web Browsers

      • Client.exe (PID: 3276)

    • Starts NET.EXE to view/add/change user profiles

      • powershell.exe (PID: 2408)
      • net.exe (PID: 2596)

    • Starts NET.EXE to view/change users localgroup

      • net.exe (PID: 844)
      • powershell.exe (PID: 1236)
      • net.exe (PID: 2320)
      • powershell.exe (PID: 3544)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SeedBrutoforce .exe (PID: 3228)
      • Both.exe (PID: 2304)

    • Reads the Internet Settings

      • SeedBrutoforce .exe (PID: 3228)
      • SeedBrutoforce.exe (PID: 2328)
      • Both.exe (PID: 2304)
      • RDP.exe (PID: 3964)
      • Client.exe (PID: 3276)

    • Reads security settings of Internet Explorer

      • SeedBrutoforce .exe (PID: 3228)
      • Both.exe (PID: 2304)
      • RDP.exe (PID: 3964)

    • Starts POWERSHELL.EXE for commands execution

      • RDP.exe (PID: 3964)

    • Searches for installed software

      • Client.exe (PID: 3276)

    • Write to the desktop.ini file (may be used to cloak folders)

      • Client.exe (PID: 3276)

    • Reads settings of System Certificates

      • Client.exe (PID: 3276)
      • RDP.exe (PID: 3964)

    • Reads browser cookies

      • Client.exe (PID: 3276)

    • Executing commands from ".cmd" file

      • RDP.exe (PID: 3964)

    • Starts CMD.EXE for commands execution

      • RDP.exe (PID: 3964)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 316)

    • Checks for external IP

      • RDP.exe (PID: 3964)
      • Client.exe (PID: 3276)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Client.exe (PID: 3276)
      • RDP.exe (PID: 3964)

    • Accesses Microsoft Outlook profiles

      • Client.exe (PID: 3276)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4052)

    • Checks supported languages

      • SeedBrutoforce .exe (PID: 3228)
      • Both.exe (PID: 2304)
      • SeedBrutoforce.exe (PID: 2328)
      • Client.exe (PID: 3276)
      • RDP.exe (PID: 3964)

    • Reads the computer name

      • SeedBrutoforce .exe (PID: 3228)
      • Both.exe (PID: 2304)
      • SeedBrutoforce.exe (PID: 2328)
      • RDP.exe (PID: 3964)
      • Client.exe (PID: 3276)

    • Reads the machine GUID from the registry

      • SeedBrutoforce .exe (PID: 3228)
      • SeedBrutoforce.exe (PID: 2328)
      • Both.exe (PID: 2304)
      • Client.exe (PID: 3276)
      • RDP.exe (PID: 3964)

    • Create files in a temporary directory

      • SeedBrutoforce .exe (PID: 3228)
      • Both.exe (PID: 2304)
      • Client.exe (PID: 3276)
      • RDP.exe (PID: 3964)

    • Manual execution by a user

      • SeedBrutoforce .exe (PID: 3228)

    • Reads Environment values

      • SeedBrutoforce.exe (PID: 2328)
      • Client.exe (PID: 3276)
      • RDP.exe (PID: 3964)

    • Creates files or folders in the user directory

      • Client.exe (PID: 3276)

    • Reads the software policy settings

      • Client.exe (PID: 3276)
      • RDP.exe (PID: 3964)

    • Reads CPU info

      • Client.exe (PID: 3276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:02:25 12:12:02
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Crypto Brutoforce/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
17
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe seedbrutoforce .exe both.exe seedbrutoforce.exe client.exe rdp.exe powershell.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp600F.tmp.cmd""C:\Windows\System32\cmd.exe—RDP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
764timeout 4 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
844"C:\Windows\system32\net.exe" localgroup Remote Desktop Users ThanksEgalsa /addC:\Windows\System32\net.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
1236"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" net localgroup administrators ThanksEgalsa /addC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—RDP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1784C:\Windows\system32\net1 localgroup Remote Desktop Users ThanksEgalsa /addC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
1860C:\Windows\system32\net1 user ThanksEgalsa ThanksEgalsa /addC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
2304"C:\Users\admin\AppData\Local\Temp\Both.exe" C:\Users\admin\AppData\Local\Temp\Both.exe
SeedBrutoforce .exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApp1
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\both.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2320"C:\Windows\system32\net.exe" localgroup administrators ThanksEgalsa /addC:\Windows\System32\net.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2328"C:\Users\admin\AppData\Local\Temp\SeedBrutoforce.exe" C:\Users\admin\AppData\Local\Temp\SeedBrutoforce.exe
SeedBrutoforce .exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
SeedBrutoforce
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\seedbrutoforce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2408"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" net user ThanksEgalsa ThanksEgalsa /addC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—RDP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
33 637
Read events
33 527
Write events
110
Delete events
0

Modification events

(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Crypto Brutoforce.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
6
Suspicious files
24
Text files
43
Unknown types
2

Dropped files

PID
Process
Filename
Type
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4052.26014\Crypto Brutoforce\SeedBrutoforce .exeexecutable
MD5:4E085BA5B9F87E84E3DDBD88595FF82B
SHA256:B2DA8B0FC695B60B07EBFAB78B13DB0A7C7767564035A31DC05ABAAAFA4890B0
2304Both.exeC:\Users\admin\AppData\Local\Temp\ImageFile2.UKtext
MD5:26FC605B0A0E4D04B50E9D764BB32BCB
SHA256:B804F473B30957FD110EBEB7088772E78ECB4C1BEA353F71C92AF097EC7A618B
3276Client.exeC:\Users\admin\AppData\Local\USER-PC\FileGrabber\Desktop\detailslistings.jpgimage
MD5:BDC08C8112C9D67A01777981F74764E0
SHA256:25CB9A32FFD3458C7D8F60DB51DB263B215BAE102630176EBCC316DFF35640C8
3276Client.exeC:\Users\admin\AppData\Local\Temp\places.raw —
MD5:—
SHA256:—
3228SeedBrutoforce .exeC:\Users\admin\AppData\Local\Temp\Both.exeexecutable
MD5:6DA9F969F03217C94526FCD30B024A67
SHA256:9676D9BF3222562CDCE6B4D53B818AF50A3A40EE2B7A41250778EC8C59997CD0
2304Both.exeC:\Users\admin\AppData\Local\Temp\Client.exeexecutable
MD5:4D0A2B6834670F59DE7F11518DA39304
SHA256:2ED252FDF9CB6C8AE84FCE7CC4B8103D2088C4195537BB36A8D98334943D6F73
2304Both.exeC:\Users\admin\AppData\Local\Temp\ImageFile1.UKtext
MD5:91FE33A8BAC0A89ECCAEF42FAEAB2A27
SHA256:F9C8427F7AFC93719EACA0B4E3C4B6A5525B215714B9AC35D802744B80EA5175
2304Both.exeC:\Users\admin\AppData\Local\Temp\RDP.exeexecutable
MD5:E8E2F4CFE17F5D7F7C22B58C2F63F5F7
SHA256:F9B1B043A427F1F41BAAB17C1D5BCDCAFED09D8993AB90882CAFFCEC07328221
3228SeedBrutoforce .exeC:\Users\admin\AppData\Local\Temp\ImageFile2.UKtext
MD5:81C2F6A014DFF85A9B0BD6C57DAF5521
SHA256:628D28251E5DBCDF46F8F7F6A570D513AFB2A4795C95607E5FC120885E98BA76
3276Client.exeC:\Users\admin\AppData\Local\USER-PC\FileGrabber\Desktop\desktop.initext
MD5:9E36CC3537EE9EE1E3B10FA4E761045B
SHA256:4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
760
TCP/UDP connections
25
DNS requests
13
Threats
46

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2328
SeedBrutoforce.exe
GET
200
2.21.20.155:80
http://www.msftncsi.com/ncsi.txt
unknown
text
14 b
unknown
2328
SeedBrutoforce.exe
GET
200
2.21.20.155:80
http://www.msftncsi.com/ncsi.txt
unknown
text
14 b
unknown
2328
SeedBrutoforce.exe
GET
200
2.21.20.155:80
http://www.msftncsi.com/ncsi.txt
unknown
text
14 b
unknown
2328
SeedBrutoforce.exe
GET
200
2.21.20.155:80
http://www.msftncsi.com/ncsi.txt
unknown
text
14 b
unknown
2328
SeedBrutoforce.exe
GET
200
2.21.20.155:80
http://www.msftncsi.com/ncsi.txt
unknown
text
14 b
unknown
2328
SeedBrutoforce.exe
GET
200
2.21.20.155:80
http://www.msftncsi.com/ncsi.txt
unknown
text
14 b
unknown
2328
SeedBrutoforce.exe
GET
200
2.21.20.155:80
http://www.msftncsi.com/ncsi.txt
unknown
text
14 b
unknown
2328
SeedBrutoforce.exe
GET
200
2.21.20.155:80
http://www.msftncsi.com/ncsi.txt
unknown
text
14 b
unknown
2328
SeedBrutoforce.exe
GET
200
2.21.20.155:80
http://www.msftncsi.com/ncsi.txt
unknown
text
14 b
unknown
2328
SeedBrutoforce.exe
GET
200
2.21.20.155:80
http://www.msftncsi.com/ncsi.txt
unknown
text
14 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2328
SeedBrutoforce.exe
2.21.20.155:80
www.msftncsi.com
Akamai International B.V.
DE
unknown
3276
Client.exe
188.114.97.3:443
freegeoip.app
CLOUDFLARENET
NL
unknown
3276
Client.exe
162.125.69.15:443
dl.dropboxusercontent.com
DROPBOX
US
unknown
3276
Client.exe
172.67.209.71:443
ipbase.com
CLOUDFLARENET
US
unknown
3964
RDP.exe
34.117.118.44:443
www.ifconfig.me
GOOGLE-CLOUD-PLATFORM
US
unknown
3964
RDP.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3964
RDP.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
unknown

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared
www.msftncsi.com
  • 2.21.20.155
whitelisted
dl.dropboxusercontent.com
  • 162.125.69.15
shared
freegeoip.app
  • 188.114.97.3
  • 188.114.96.3
whitelisted
ipbase.com
  • 172.67.209.71
  • 104.21.85.189
unknown
www.ifconfig.me
  • 34.117.118.44
unknown
ctldl.windowsupdate.com
  • 184.24.77.202
  • 184.24.77.194
whitelisted
api.telegram.org
  • 149.154.167.220
shared
api.ipify.org
  • 104.26.13.205
  • 104.26.12.205
  • 172.67.74.152
shared
ip-api.com
  • 208.95.112.1
shared

Threats

PID
Process
Class
Message
3276
Client.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
3276
Client.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
3276
Client.exe
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
3276
Client.exe
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
1080
svchost.exe
Potentially Bad Traffic
ET INFO External IP Lookup Domain Domain in DNS Lookup (ipbase .com)
3276
Client.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (ipbase .com in TLS SNI)
3276
Client.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
3276
Client.exe
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
3276
Client.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
3276
Client.exe
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Crypto Brutoforce.zip