URL:

https://ravenfile.com/dtemplate/dynamicgame?ac=1&v_token=1&cid=2OcmCOJtHsYsaRehu&fhnid=28376495

Full analysis: https://app.any.run/tasks/d090e49d-f555-4962-bc27-03f95d13d1ff
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: December 19, 2020, 21:12:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MD5:

0B0D2543602A633AF1001B579EA5FECD

SHA1:

8F2E27BB4291A6918AE513CC25A6EF93F5C8A1B7

SHA256:

FF9A0249AEDACC8DD1FCE173698B5676D8BB434428B8EAAB9639872423B7C95F

SSDEEP:

3:N8d9LGWRnbXF9aEPY6RVAIMY9Ipw6MYEFQ:2C2Lv9MxwPYEq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AmongUs_com.innersloth.spacemafia_dy_1866127856.exe (PID: 3156)
      • AmongUs_com.innersloth.spacemafia_dy_1866127856.exe (PID: 2408)

    • Actions looks like stealing of personal data

      • AmongUs_com.innersloth.spacemafia_dy_1866127856.exe (PID: 2408)

    • Loads dropped or rewritten executable

      • AmongUs_com.innersloth.spacemafia_dy_1866127856.exe (PID: 2408)

  • SUSPICIOUS

    • Reads internet explorer settings

      • AmongUs_com.innersloth.spacemafia_dy_1866127856.exe (PID: 2408)

    • Executable content was dropped or overwritten

      • AmongUs_com.innersloth.spacemafia_dy_1866127856.exe (PID: 2408)
      • chrome.exe (PID: 2612)

    • Reads Environment values

      • AmongUs_com.innersloth.spacemafia_dy_1866127856.exe (PID: 2408)

    • Application launched itself

      • AmongUs_com.innersloth.spacemafia_dy_1866127856.exe (PID: 3156)

    • Drops a file that was compiled in debug mode

      • AmongUs_com.innersloth.spacemafia_dy_1866127856.exe (PID: 2408)

    • Cleans NTFS data-stream (Zone Identifier)

      • AmongUs_com.innersloth.spacemafia_dy_1866127856.exe (PID: 3156)

  • INFO

    • Reads settings of System Certificates

      • chrome.exe (PID: 2612)

    • Reads the hosts file

      • chrome.exe (PID: 2612)
      • chrome.exe (PID: 1760)

    • Manual execution by user

      • AmongUs_com.innersloth.spacemafia_dy_1866127856.exe (PID: 3156)

    • Application launched itself

      • chrome.exe (PID: 2612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
13
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs amongus_com.innersloth.spacemafia_dy_1866127856.exe no specs amongus_com.innersloth.spacemafia_dy_1866127856.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
700"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12443453457312652329,4843391527921419527,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14864173868895365304 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2300 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
836"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12443453457312652329,4843391527921419527,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=597853037390919085 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1540"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12443453457312652329,4843391527921419527,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12183334102992188233 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1760"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,12443453457312652329,4843391527921419527,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=10511352237462902356 --mojo-platform-channel-handle=1548 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1840"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12443453457312652329,4843391527921419527,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3139424508151322152 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2220"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=996,12443453457312652329,4843391527921419527,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=13327008118525132844 --mojo-platform-channel-handle=3504 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2408"C:\Users\admin\Downloads\AmongUs_com.innersloth.spacemafia_dy_1866127856.exe" /XBNGWvK9Tg /cSBuIR9bUQ:YyhwYgxaFRAiP211FM5W /atRzDoPGuw:1 /GrzC:\Users\admin\Downloads\AmongUs_com.innersloth.spacemafia_dy_1866127856.exe
AmongUs_com.innersloth.spacemafia_dy_1866127856.exe
User:
admin
Company:
Program application
Integrity Level:
HIGH
Description:
Software Internet Stub Setup
Exit code:
0
Version:
3.1.4.4
Modules
Images
c:\users\admin\downloads\amongus_com.innersloth.spacemafia_dy_1866127856.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2568"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2648 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2612"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://ravenfile.com/dtemplate/dynamicgame?ac=1&v_token=1&cid=2OcmCOJtHsYsaRehu&fhnid=28376495"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2812"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,12443453457312652329,4843391527921419527,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=8481208884415001376 --mojo-platform-channel-handle=1096 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
1 439
Read events
1 354
Write events
82
Delete events
3

Modification events

(PID) Process:(2612) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2612) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2612) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2612) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2612) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2568) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2612-13252885939928000
Value:
259
(PID) Process:(2612) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2612) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2612) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(2612) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
5
Suspicious files
16
Text files
139
Unknown types
0

Dropped files

PID
Process
Filename
Type
2612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FDE6CB4-A34.pma —
MD5:—
SHA256:—
2612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old —
MD5:—
SHA256:—
2612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\e35d8168-c0f1-4ea7-aeea-9ecf32d700ba.tmp —
MD5:—
SHA256:—
2612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
2612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.oldtext
MD5:—
SHA256:—
2612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF15b0cb.TMPtext
MD5:—
SHA256:—
2612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:1A89A1BEBE6C843C4FF582E7ED33CA1F
SHA256:65099CA087B66AA8CA420AB121DAAD713E1DB5A61C5A574D9B1C0DF24F012520
2612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF15af73.TMPtext
MD5:—
SHA256:—
2612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
2612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF15b1a6.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
42
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1760
chrome.exe
GET
200
143.204.90.61:80
http://d1z0mfyqx7ypd2.cloudfront.net/ext/notification_request_up.gif
US
image
42.3 Kb
whitelisted
1760
chrome.exe
GET
200
143.204.90.61:80
http://d1z0mfyqx7ypd2.cloudfront.net/ext/edge_run.png
US
image
38.9 Kb
whitelisted
1760
chrome.exe
GET
200
143.204.90.61:80
http://d1z0mfyqx7ypd2.cloudfront.net/ext/downloadhere.gif
US
image
162 Kb
whitelisted
1760
chrome.exe
GET
200
143.204.90.61:80
http://d1z0mfyqx7ypd2.cloudfront.net/ext/downloadhere_notext.gif
US
image
92.6 Kb
whitelisted
1760
chrome.exe
GET
200
143.204.90.61:80
http://d1z0mfyqx7ypd2.cloudfront.net/ext/gears.gif
US
image
59.6 Kb
whitelisted
2408
AmongUs_com.innersloth.spacemafia_dy_1866127856.exe
POST
200
65.9.70.29:80
http://d2esj9mgpiaw9z.cloudfront.net/
US
—
—
malicious
1760
chrome.exe
GET
200
143.204.90.61:80
http://d1z0mfyqx7ypd2.cloudfront.net/ext/game-console.png
US
image
44.6 Kb
whitelisted
2408
AmongUs_com.innersloth.spacemafia_dy_1866127856.exe
GET
200
65.9.68.30:80
http://payperclickadz.com/app/isbanner?appid=com.innersloth.spacemafia
US
image
11.6 Kb
whitelisted
2408
AmongUs_com.innersloth.spacemafia_dy_1866127856.exe
POST
200
65.9.70.29:80
http://d2esj9mgpiaw9z.cloudfront.net/
US
—
—
malicious
2408
AmongUs_com.innersloth.spacemafia_dy_1866127856.exe
POST
200
65.9.70.197:80
http://d16dy2xs66mk5n.cloudfront.net/
US
binary
568 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1760
chrome.exe
216.58.212.173:443
accounts.google.com
Google Inc.
US
whitelisted
1760
chrome.exe
23.21.81.231:443
ravenfile.com
Amazon.com, Inc.
US
suspicious
1760
chrome.exe
143.204.90.61:80
d1z0mfyqx7ypd2.cloudfront.net
—
US
suspicious
1760
chrome.exe
143.204.90.97:443
zonedgamers.com
—
US
suspicious
1760
chrome.exe
104.16.18.94:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
1760
chrome.exe
23.111.9.35:443
use.fontawesome.com
netDNA
US
suspicious
1760
chrome.exe
99.86.3.39:443
mbdl219.com
AT&T Services, Inc.
US
unknown
1760
chrome.exe
216.58.205.234:443
fonts.googleapis.com
Google Inc.
US
whitelisted
1760
chrome.exe
172.217.16.131:443
fonts.gstatic.com
Google Inc.
US
whitelisted
1760
chrome.exe
52.219.120.41:443
ext-emulator.s3-us-west-1.amazonaws.com
—
US
shared

DNS requests

Domain
IP
Reputation
ravenfile.com
  • 23.21.81.231
  • 50.19.252.223
suspicious
accounts.google.com
  • 216.58.212.173
shared
ajax.googleapis.com
  • 209.85.233.95
whitelisted
d1z0mfyqx7ypd2.cloudfront.net
  • 143.204.90.61
  • 143.204.90.92
  • 143.204.90.24
  • 143.204.90.4
whitelisted
zonedgamers.com
  • 143.204.90.97
  • 143.204.90.83
  • 143.204.90.123
  • 143.204.90.13
suspicious
stats-tracker.net
  • 13.225.80.2
  • 13.225.80.108
  • 13.225.80.15
  • 13.225.80.92
whitelisted
atlasox.s3.amazonaws.com
  • 52.217.64.68
shared
use.fontawesome.com
  • 23.111.9.35
whitelisted
cdnjs.cloudflare.com
  • 104.16.18.94
  • 104.16.19.94
whitelisted
fonts.googleapis.com
  • 216.58.205.234
whitelisted

Threats

PID
Process
Class
Message
2408
AmongUs_com.innersloth.spacemafia_dy_1866127856.exe
A Network Trojan was detected
ADWARE [PTsecurity] InstallCore
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://ravenfile.com/dtemplate/dynamicgame?ac=1&v_token=1&cid=2OcmCOJtHsYsaRehu&fhnid=28376495