analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Exploit Pack www.yourhacker.in.zip

Full analysis: https://app.any.run/tasks/6aeba81f-5c4f-4639-b405-9763a39b9b54
Verdict: Malicious activity
Threats:

DarkComet RAT is a malicious program designed to remotely control or administer a victim's computer, steal private data and spy on the victim.

Malware Trends Tracker     >>>
Analysis date: May 21, 2022, 03:14:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
darkcomet
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

1556E689004D8F31DBD7D06EF5E05695

SHA1:

8C16FF871B70F74068F7D35A74FE27B444F9108E

SHA256:

E4A182083C97B29550D76D1496910A0EDA566C80BC03612BFAFCB48F8F79C50B

SSDEEP:

196608:QXK9KW9x6BqzgXDML/XRqUJjqIgZRvvx55BKBQIPzZ8J1I1fBMTiC64:kGCB0cDML/bJuhZRHn5BKPqJ1WSWCl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3064)
      • REG Exploit Builder.exe (PID: 2676)
      • cmd.exe (PID: 3360)
      • REG Exploit Builder.exe (PID: 3564)
      • PDF Exploit Builder.exe (PID: 624)
      • PDF Exploit Builder.exe (PID: 3388)
      • Office Exploit Builder.exe (PID: 3728)

    • Application was dropped or rewritten from another process

      • PDF Exploit Builder.exe (PID: 624)
      • REG Exploit Builder.exe (PID: 2676)
      • REG Exploit Builder.exe (PID: 3564)
      • svchost.exe (PID: 3968)
      • svchost.exe (PID: 1132)
      • PDF Exploit Builder.exe (PID: 3388)
      • Office Exploit Builder.exe (PID: 3728)
      • svchost.exe (PID: 1768)
      • Office Exploit Builder.exe (PID: 3148)
      • Office Exploit Builder.exe (PID: 3652)
      • REG Exploit Builder.exe (PID: 2600)
      • REG Exploit Builder.exe (PID: 276)
      • svchost.exe (PID: 3596)
      • Office Exploit Builder.exe (PID: 2952)
      • svchost.exe (PID: 3732)

    • Runs app for hidden code execution

      • REG Exploit Builder.exe (PID: 2676)
      • PDF Exploit Builder.exe (PID: 624)
      • Office Exploit Builder.exe (PID: 3728)
      • REG Exploit Builder.exe (PID: 2600)
      • Office Exploit Builder.exe (PID: 3652)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2984)
      • reg.exe (PID: 2868)
      • reg.exe (PID: 3680)
      • reg.exe (PID: 2860)
      • reg.exe (PID: 3656)

    • Loads dropped or rewritten executable

      • REG Exploit Builder.exe (PID: 3564)
      • PDF Exploit Builder.exe (PID: 3388)
      • Office Exploit Builder.exe (PID: 3148)
      • REG Exploit Builder.exe (PID: 276)
      • Office Exploit Builder.exe (PID: 2952)

    • DARKCOMET detected by memory dumps

      • svchost.exe (PID: 3968)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3064)
      • REG Exploit Builder.exe (PID: 2676)
      • PDF Exploit Builder.exe (PID: 624)
      • REG Exploit Builder.exe (PID: 3564)
      • svchost.exe (PID: 3968)
      • svchost.exe (PID: 1132)
      • PDF Exploit Builder.exe (PID: 3388)
      • Office Exploit Builder.exe (PID: 3728)
      • svchost.exe (PID: 1768)
      • Office Exploit Builder.exe (PID: 3148)
      • Office Exploit Builder.exe (PID: 3652)
      • REG Exploit Builder.exe (PID: 2600)
      • svchost.exe (PID: 3596)
      • REG Exploit Builder.exe (PID: 276)
      • svchost.exe (PID: 3732)
      • Office Exploit Builder.exe (PID: 2952)

    • Checks supported languages

      • WinRAR.exe (PID: 3064)
      • PDF Exploit Builder.exe (PID: 624)
      • REG Exploit Builder.exe (PID: 2676)
      • cmd.exe (PID: 3360)
      • REG Exploit Builder.exe (PID: 3564)
      • svchost.exe (PID: 3968)
      • cmd.exe (PID: 240)
      • PDF Exploit Builder.exe (PID: 3388)
      • svchost.exe (PID: 1132)
      • cmd.exe (PID: 3616)
      • Office Exploit Builder.exe (PID: 3728)
      • Office Exploit Builder.exe (PID: 3148)
      • cmd.exe (PID: 4008)
      • svchost.exe (PID: 1768)
      • Office Exploit Builder.exe (PID: 3652)
      • REG Exploit Builder.exe (PID: 2600)
      • REG Exploit Builder.exe (PID: 276)
      • cmd.exe (PID: 3236)
      • svchost.exe (PID: 3596)
      • svchost.exe (PID: 3732)
      • Office Exploit Builder.exe (PID: 2952)
      • cmd.exe (PID: 3144)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3064)
      • REG Exploit Builder.exe (PID: 2676)
      • cmd.exe (PID: 3360)
      • PDF Exploit Builder.exe (PID: 624)
      • REG Exploit Builder.exe (PID: 3564)
      • PDF Exploit Builder.exe (PID: 3388)
      • Office Exploit Builder.exe (PID: 3728)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3064)
      • REG Exploit Builder.exe (PID: 2676)
      • cmd.exe (PID: 3360)
      • REG Exploit Builder.exe (PID: 3564)
      • PDF Exploit Builder.exe (PID: 624)
      • PDF Exploit Builder.exe (PID: 3388)
      • Office Exploit Builder.exe (PID: 3728)

    • Starts CMD.EXE for commands execution

      • REG Exploit Builder.exe (PID: 2676)
      • PDF Exploit Builder.exe (PID: 624)
      • Office Exploit Builder.exe (PID: 3728)
      • REG Exploit Builder.exe (PID: 2600)
      • Office Exploit Builder.exe (PID: 3652)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3360)
      • cmd.exe (PID: 3616)
      • cmd.exe (PID: 4008)
      • cmd.exe (PID: 3236)
      • cmd.exe (PID: 3144)

    • Creates executable files which already exist in Windows

      • REG Exploit Builder.exe (PID: 2676)

    • Reads mouse settings

      • REG Exploit Builder.exe (PID: 3564)
      • PDF Exploit Builder.exe (PID: 3388)
      • Office Exploit Builder.exe (PID: 3148)
      • REG Exploit Builder.exe (PID: 276)
      • Office Exploit Builder.exe (PID: 2952)

    • Creates files in the user directory

      • svchost.exe (PID: 3968)

  • INFO

    • Manual execution by user

      • REG Exploit Builder.exe (PID: 2676)
      • PDF Exploit Builder.exe (PID: 624)
      • Office Exploit Builder.exe (PID: 3728)
      • REG Exploit Builder.exe (PID: 2600)
      • Office Exploit Builder.exe (PID: 3652)

    • Checks supported languages

      • reg.exe (PID: 2984)
      • timeout.exe (PID: 2320)
      • reg.exe (PID: 2868)
      • reg.exe (PID: 3680)
      • reg.exe (PID: 2860)
      • reg.exe (PID: 3656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DarkComet

(PID) Process(3968) svchost.exe
Offline keyloggerTrue
gencodegRoaiSdA59FN
FWB0
sid3XPL01T
MutexDC_MUTEX-ULRUWYX
Version#KCMDDC51#
C2 (1)subdomain-dns.duckdns.org:3725
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: PDF Exploit Builder/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2019:12:31 07:20:16
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
28
Malicious processes
10
Suspicious processes
11

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winrar.exe reg exploit builder.exe pdf exploit builder.exe reg exploit builder.exe cmd.exe reg.exe #DARKCOMET svchost.exe cmd.exe no specs timeout.exe no specs pdf exploit builder.exe cmd.exe no specs reg.exe svchost.exe no specs office exploit builder.exe office exploit builder.exe no specs cmd.exe no specs reg.exe svchost.exe no specs reg exploit builder.exe no specs office exploit builder.exe no specs reg exploit builder.exe no specs cmd.exe no specs reg.exe svchost.exe no specs office exploit builder.exe no specs cmd.exe no specs reg.exe svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3064"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Exploit Pack www.yourhacker.in.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2676"C:\Users\admin\Desktop\REG Exploit Builder.exe" C:\Users\admin\Desktop\REG Exploit Builder.exe
Explorer.EXE
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Reader 9.0
Exit code:
0
Version:
9.0.0.2008061200
Modules
Images
c:\users\admin\desktop\reg exploit builder.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
624"C:\Users\admin\Desktop\PDF Exploit Builder\PDF Exploit Builder.exe" C:\Users\admin\Desktop\PDF Exploit Builder\PDF Exploit Builder.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\pdf exploit builder\pdf exploit builder.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
3564"C:\Users\admin\AppData\Local\Temp\REG Exploit Builder.exe" C:\Users\admin\AppData\Local\Temp\REG Exploit Builder.exe
REG Exploit Builder.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225547
Modules
Images
c:\users\admin\appdata\local\temp\reg exploit builder.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
3360"cmd.exe"C:\Windows\system32\cmd.exe
REG Exploit Builder.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2984reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\admin\AppData\Local\Temp\Macromed\FlashPlayerUpdateService.exe.lnk " /fC:\Windows\system32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3968"C:\Users\admin\AppData\Local\Temp\svchost.exe"C:\Users\admin\AppData\Local\Temp\svchost.exe
REG Exploit Builder.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\users\admin\appdata\local\temp\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\avicap32.dll
c:\windows\system32\user32.dll
DarkComet
(PID) Process(3968) svchost.exe
Offline keyloggerTrue
gencodegRoaiSdA59FN
FWB0
sid3XPL01T
MutexDC_MUTEX-ULRUWYX
Version#KCMDDC51#
C2 (1)subdomain-dns.duckdns.org:3725
240C:\Windows\system32\cmd.exe /c C:\Users\admin\AppData\Local\Temp\Macromed\FlashPlayerUpdateService.exe.batC:\Windows\system32\cmd.exe—REG Exploit Builder.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2320timeout /t 300C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\timeout.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
3388"C:\Users\admin\AppData\Local\Temp\PDF Exploit Builder.exe" C:\Users\admin\AppData\Local\Temp\PDF Exploit Builder.exe
PDF Exploit Builder.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225547
Modules
Images
c:\users\admin\appdata\local\temp\pdf exploit builder.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
Total events
8 763
Read events
8 688
Write events
75
Delete events
0

Modification events

(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3064) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Exploit Pack www.yourhacker.in.zip
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
12
Suspicious files
9
Text files
10
Unknown types
4

Dropped files

PID
Process
Filename
Type
3564REG Exploit Builder.exeC:\Users\admin\AppData\Local\Temp\imdf.jpgimage
MD5:0594266AAA63C395D265E25CE523CA71
SHA256:16FF57559194EF46E06D86B92B756877ABA7F794D410444BD59F66A208B45D47
2676REG Exploit Builder.exeC:\Users\admin\AppData\Local\Temp\Macromed\FlashPlayerUpdateService.exe.lnklnk
MD5:C453F56553800045A1FE7B2CE9833202
SHA256:A7B384D25279493BD4AA4B4B9BD3E69AA56B2FDF123392C57AB6BDD9B30498F4
3564REG Exploit Builder.exeC:\Users\admin\AppData\Local\Temp\aut25C5.tmpimage
MD5:0594266AAA63C395D265E25CE523CA71
SHA256:16FF57559194EF46E06D86B92B756877ABA7F794D410444BD59F66A208B45D47
2676REG Exploit Builder.exeC:\Users\admin\AppData\Local\Temp\REG Exploit Builder.exeexecutable
MD5:DB10D08958A7E6EF1293EEF3FF814CF0
SHA256:5EC4BEF1D77025B0F7B888C053DC089C10C7907EC7D84139D80C59CE88C95E9A
2676REG Exploit Builder.exeC:\Users\admin\AppData\Local\Temp\svchost.exeexecutable
MD5:30426476DE94A57F7807277BE471E32E
SHA256:DA5C2D3E6B5E937DB77E725E1C4BE5D1A7C32B9DA24D2A93CB86736087C466D0
3064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3064.10670\PDF Exploit Builder\PDF Exploit Builder.exeexecutable
MD5:9BE355706F21BA8F5DBD06224B7E5FED
SHA256:F37AC82BE444ADFEBCDDC1A2A0E1A5BA1EF90394067265F51A771A3896690C17
3064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3064.4443\Office Exploit Builder\Office Exploit Builder.exeexecutable
MD5:8D93FC41E0C81EEB49C21C3DFF98DBA0
SHA256:594A74A9C410F18720BE87893B57302AF6647766FBBD16F5A1D5D8F402C21C4C
3564REG Exploit Builder.exeC:\Users\admin\AppData\Local\Temp\aut25D5.tmpbinary
MD5:CB68E4CE4BAC8B40E64064A76F765F76
SHA256:45E7A6813B60E5F2F3E1F3B6E40AAC0380B61CC8C867DC3C975D7A946BA95431
2676REG Exploit Builder.exeC:\Users\admin\AppData\Local\Temp\Macromed\FlashPlayerUpdateService.exe.battext
MD5:095C7A8B83C6BEEAF339B69A345B25A5
SHA256:819D11AE9B5F46CC509D2DA61AD7B5D574F259201761EF499A739435B8E0D389
3564REG Exploit Builder.exeC:\Users\admin\AppData\Local\Temp\16.mp3mp3
MD5:0604FE07975C6953489625117E8C271B
SHA256:796394ADF1129CBDF55D8D7FAC67815D5CD0E9ED0B2D398804866B5667A13F8E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3968
svchost.exe
84.220.40.120:3725
subdomain-dns.duckdns.org
Tiscali SpA
IT
unknown
—
—
84.220.40.120:3725
subdomain-dns.duckdns.org
Tiscali SpA
IT
unknown

DNS requests

Domain
IP
Reputation
subdomain-dns.duckdns.org
  • 84.220.40.120
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Exploit Pack www.yourhacker.in.zip