Edit tour

Windows Analysis Report
V1CCX70AZ8P70ADNI.exe

Overview

General Information

Sample name:	V1CCX70AZ8P70ADNI.exe
Analysis ID:	1631862
MD5:	c8b01a488052a5368731fe95a056639e
SHA1:	78a64b7cd6a75bd309174bf78fc6d28d524ce3cf
SHA256:	7cafcb54154e4e5f9e6c2b23b436a3ea4bdc9d1e0aa12868f3940c7567d8edab
Tags:	exeuser-aachum
Infos:

Detection

Clipboard Hijacker

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Clipboard Hijacker

Drops PE files with benign system names

Joe Sandbox ML detected suspicious sample

Potentially malicious time measurement code found

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses known network protocols on non-standard ports

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: CurrentVersion Autorun Keys Modification

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

V1CCX70AZ8P70ADNI.exe (PID: 6784 cmdline: "C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe" MD5: C8B01A488052A5368731FE95A056639E)

cmd.exe (PID: 7000 cmdline: C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7120 cmdline: cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6252 cmdline: ping localhost -n 1 MD5: 2F46799D79D22AC72C241EC0322B011D)

explorer.exe (PID: 2520 cmdline: C:\Users\user\AppData\Local\explorer.exe MD5: C8B01A488052A5368731FE95A056639E)

explorer.exe (PID: 3052 cmdline: "C:\Users\user\AppData\Local\explorer.exe" MD5: C8B01A488052A5368731FE95A056639E)

explorer.exe (PID: 6464 cmdline: "C:\Users\user\AppData\Local\explorer.exe" MD5: C8B01A488052A5368731FE95A056639E)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: explorer.exe PID: 2520	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe, ProcessId: 6784, TargetFilename: C:\Users\user\AppData\Local\explorer.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: C:\Users\user\AppData\Local\explorer.exe, CommandLine: C:\Users\user\AppData\Local\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\explorer.exe, NewProcessName: C:\Users\user\AppData\Local\explorer.exe, OriginalFileName: C:\Users\user\AppData\Local\explorer.exe, ParentCommandLine: cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7120, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\explorer.exe, ProcessId: 2520, ProcessName: explorer.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 185.208.159.226, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe, Initiated: true, ProcessId: 6784, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49683

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\explorer.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe, ProcessId: 6784, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer

Sigma detected: Proxy Execution Via Explorer.exe

Source: Process started

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative: Data: Command: C:\Users\user\AppData\Local\explorer.exe, CommandLine: C:\Users\user\AppData\Local\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\explorer.exe, NewProcessName: C:\Users\user\AppData\Local\explorer.exe, OriginalFileName: C:\Users\user\AppData\Local\explorer.exe, ParentCommandLine: cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7120, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\explorer.exe, ProcessId: 2520, ProcessName: explorer.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: V1CCX70AZ8P70ADNI.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://93.88.203.34/cl/BatClipT	Avira URL Cloud: Label: malware
Source: http://93.88.203.34/cl/BatClipT.bat	Avira URL Cloud: Label: malware
Source: http://93.88.203.34/cl/BatClipT.bat/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\explorer.exe

Avira: detection malicious, Label: TR/Spy.Banker.kdiut

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\explorer.exe

ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: V1CCX70AZ8P70ADNI.exe	Virustotal: Detection: 65%			Perma Link
Source: V1CCX70AZ8P70ADNI.exe	ReversingLabs: Detection: 63%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.7:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.7:49685 version: TLS 1.2

Source: V1CCX70AZ8P70ADNI.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Administrator\Desktop\OneDrive\good\921f83fca6994291b4bc3aa90673460d\x64\Release\LClipper.pdb source: V1CCX70AZ8P70ADNI.exe, explorer.exe.0.dr
Source:	Binary string: C:\Users\Administrator\Desktop\OneDrive\good\921f83fca6994291b4bc3aa90673460d\x64\Release\LClipper.pdbq source: V1CCX70AZ8P70ADNI.exe, explorer.exe.0.dr

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Local\explorer.exe	Network Connect: 185.208.159.226 8888	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Network Connect: 185.199.111.133 443	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Network Connect: 208.95.112.1 80	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49686

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping localhost -n 1

Source: global traffic

TCP traffic: 192.168.2.7:49683 -> 185.208.159.226:8888

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 185.199.111.133 185.199.111.133

Source: Joe Sandbox View

ASN Name: SIMPLECARRER2IT SIMPLECARRER2IT

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: ip-api.com

Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.208.159.226
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /VeraImage/MilitarySource/refs/heads/main/Code HTTP/1.1User-Agent: ClpBotHost: raw.githubusercontent.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /VeraImage/MilitarySource/refs/heads/main/Code HTTP/1.1User-Agent: ClpBotHost: raw.githubusercontent.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /line/ HTTP/1.1User-Agent: ClpBotHost: ip-api.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /921f83fca6994291b4bc3aa90673460d/ HTTP/1.1User-Agent: ClpBotHost: 185.208.159.226:8888Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /line/ HTTP/1.1User-Agent: ClpBotHost: ip-api.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /921f83fca6994291b4bc3aa90673460d/ HTTP/1.1User-Agent: ClpBotHost: 185.208.159.226:8888Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com

Source: explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226/
Source: explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226/=r
Source: explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226/Ir
Source: explorer.exe, 00000006.00000002.2110233357.00000153F617C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2110534367.00000153F625C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/
Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F868A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2110233357.00000153F61FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/(
Source: explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/0d/1
Source: explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/6
Source: explorer.exe, 00000006.00000002.2110534367.00000153F625C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/=S)t
Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F86B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/OIDx
Source: explorer.exe, 00000006.00000002.2110534367.00000153F625C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/S
Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F86B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/V
Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F86B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/o
Source: explorer.exe, 00000006.00000002.2109737946.0000003C4EAF8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.208.k
Source: explorer.exe, 00000006.00000002.2110534367.00000153F625C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://93.88.203.34/cl/BatClipT
Source: explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://93.88.203.34/cl/BatClipT.bat
Source: explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://93.88.203.34/cl/BatClipT.bat/
Source: explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/
Source: V1CCX70AZ8P70ADNI.exe, explorer.exe.0.dr	String found in binary or memory: http://ip-api.com/line/
Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F8645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/H
Source: explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/L
Source: V1CCX70AZ8P70ADNI.exe, explorer.exe.0.dr	String found in binary or memory: http://ip-api.com/line/RUBYUA3DF1789B5ACD4F84861DC911341D1559CnZ3Vw8LXyFUd3p9AHQBBVoCUydwWFAIAwIGdwU
Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F8645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/X
Source: explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/
Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F8645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/)r
Source: explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/C
Source: explorer.exe, 00000006.00000002.2110534367.00000153F625C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/Military
Source: explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Code
Source: explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Code/
Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F8645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Code4puoh
Source: explorer.exe, 00000006.00000002.2110233357.00000153F61FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/CodeH0
Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F866A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2110233357.00000153F61FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Codei
Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F866A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Codei5I
Source: explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/m

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443

Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.7:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.7:49685 version: TLS 1.2

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFBFF0	0_2_00007FF6A8AFBFF0
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFEFE2	0_2_00007FF6A8AFEFE2
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFE400	0_2_00007FF6A8AFE400
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFA172	0_2_00007FF6A8AFA172
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFED70	0_2_00007FF6A8AFED70
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFB760	0_2_00007FF6A8AFB760
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AF7740	0_2_00007FF6A8AF7740
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFE540	0_2_00007FF6A8AFE540
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFA9B0	0_2_00007FF6A8AFA9B0
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFB5A0	0_2_00007FF6A8AFB5A0
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AF95A0	0_2_00007FF6A8AF95A0
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AF3780	0_2_00007FF6A8AF3780
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFA180	0_2_00007FF6A8AFA180
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFBCC0	0_2_00007FF6A8AFBCC0
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFB900	0_2_00007FF6A8AFB900
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFB260	0_2_00007FF6A8AFB260
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFBE60	0_2_00007FF6A8AFBE60
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AF5C40	0_2_00007FF6A8AF5C40
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AF7A40	0_2_00007FF6A8AF7A40
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AF78A0	0_2_00007FF6A8AF78A0
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFCAA0	0_2_00007FF6A8AFCAA0
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AFF0A0	0_2_00007FF6A8AFF0A0
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AF8E80	0_2_00007FF6A8AF8E80
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928B260	6_2_00007FF64928B260
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928BE60	6_2_00007FF64928BE60
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF649285C40	6_2_00007FF649285C40
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF649287A40	6_2_00007FF649287A40
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928CAA0	6_2_00007FF64928CAA0
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928F0A0	6_2_00007FF64928F0A0
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF6492878A0	6_2_00007FF6492878A0
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF649288E80	6_2_00007FF649288E80
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928BCC0	6_2_00007FF64928BCC0
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928B900	6_2_00007FF64928B900
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928ED70	6_2_00007FF64928ED70
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928A172	6_2_00007FF64928A172
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928B760	6_2_00007FF64928B760
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928E540	6_2_00007FF64928E540
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF649287740	6_2_00007FF649287740
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928A9B0	6_2_00007FF64928A9B0
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928B5A0	6_2_00007FF64928B5A0
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF6492895A0	6_2_00007FF6492895A0
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928A180	6_2_00007FF64928A180
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF649283780	6_2_00007FF649283780
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928BFF0	6_2_00007FF64928BFF0
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928EFE2	6_2_00007FF64928EFE2
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF64928E400	6_2_00007FF64928E400

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@13/9@2/3

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\line[1].txt

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7076:120:WilError_03
Source: C:\Users\user\AppData\Local\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\aUkJ+dUJw
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7132:120:WilError_03

Source: C:\Users\user\AppData\Local\explorer.exe

File created: C:\Users\user~1\AppData\Local\Temp\ChromiumDatagram.txt

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\explorer.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\explorer.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\explorer.exe	Jump to behavior

Source: V1CCX70AZ8P70ADNI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: V1CCX70AZ8P70ADNI.exe	Virustotal: Detection: 65%
Source: V1CCX70AZ8P70ADNI.exe	ReversingLabs: Detection: 63%

Source: V1CCX70AZ8P70ADNI.exe	String found in binary or memory: id-cmc-addExtensions
Source: V1CCX70AZ8P70ADNI.exe	String found in binary or memory: set-addPolicy

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

File read: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe "C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe"
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\explorer.exe C:\Users\user\AppData\Local\explorer.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\explorer.exe "C:\Users\user\AppData\Local\explorer.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\explorer.exe "C:\Users\user\AppData\Local\explorer.exe"
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\explorer.exe C:\Users\user\AppData\Local\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: V1CCX70AZ8P70ADNI.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: V1CCX70AZ8P70ADNI.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: V1CCX70AZ8P70ADNI.exe

Static file information: File size 3648000 > 1048576

Source: V1CCX70AZ8P70ADNI.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1be400
Source: V1CCX70AZ8P70ADNI.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1a1200

Source: V1CCX70AZ8P70ADNI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: V1CCX70AZ8P70ADNI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: V1CCX70AZ8P70ADNI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: V1CCX70AZ8P70ADNI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: V1CCX70AZ8P70ADNI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: V1CCX70AZ8P70ADNI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: V1CCX70AZ8P70ADNI.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: V1CCX70AZ8P70ADNI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\Administrator\Desktop\OneDrive\good\921f83fca6994291b4bc3aa90673460d\x64\Release\LClipper.pdb source: V1CCX70AZ8P70ADNI.exe, explorer.exe.0.dr
Source:	Binary string: C:\Users\Administrator\Desktop\OneDrive\good\921f83fca6994291b4bc3aa90673460d\x64\Release\LClipper.pdbq source: V1CCX70AZ8P70ADNI.exe, explorer.exe.0.dr

Source: V1CCX70AZ8P70ADNI.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: V1CCX70AZ8P70ADNI.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: V1CCX70AZ8P70ADNI.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: V1CCX70AZ8P70ADNI.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: V1CCX70AZ8P70ADNI.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AF8317 push rax; retf	0_2_00007FF6A8AF8313
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AF82FE push rax; retf	0_2_00007FF6A8AF8313
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF649288317 push rax; retf	6_2_00007FF649288313
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF6492882FE push rax; retf	6_2_00007FF649288313

Source: V1CCX70AZ8P70ADNI.exe	Static PE information: section name: .text entropy: 6.862700216670016
Source: explorer.exe.0.dr	Static PE information: section name: .text entropy: 6.862700216670016

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

File created: C:\Users\user\AppData\Local\explorer.exe

Jump to dropped file

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

File created: C:\Users\user\AppData\Local\explorer.exe

Jump to dropped file

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer			Jump to behavior
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49686

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1			Jump to behavior

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

Code function: 0_2_00007FF6A8AF1380 rdtsc

0_2_00007FF6A8AF1380

Source: C:\Users\user\AppData\Local\explorer.exe

Window / User API: threadDelayed 5109

Jump to behavior

Source: C:\Users\user\AppData\Local\explorer.exe TID: 5312	Thread sleep count: 5109 > 30			Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe TID: 5312	Thread sleep time: -102180s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\explorer.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\explorer.exe	Last function: Thread delayed

Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F866A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2110233357.00000153F61FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F862D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2110233357.00000153F617C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AF1380	0_2_00007FF6A8AF1380
Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Code function: 0_2_00007FF6A8AF1330	0_2_00007FF6A8AF1330
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF649281330	6_2_00007FF649281330
Source: C:\Users\user\AppData\Local\explorer.exe	Code function: 6_2_00007FF649281380	6_2_00007FF649281380

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

Code function: 0_2_00007FF6A8AF1380 rdtsc

0_2_00007FF6A8AF1380

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Local\explorer.exe	Network Connect: 185.208.159.226 8888	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Network Connect: 185.199.111.133 443	Jump to behavior
Source: C:\Users\user\AppData\Local\explorer.exe	Network Connect: 208.95.112.1 80	Jump to behavior

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\explorer.exe C:\Users\user\AppData\Local\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

Code function: 0_2_00007FF6A8C77374 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6A8C77374

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match

File source: Process Memory Space: explorer.exe PID: 2520, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	111 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	3 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	111 Process Injection	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
V1CCX70AZ8P70ADNI.exe	65%	Virustotal		Browse
V1CCX70AZ8P70ADNI.exe	63%	ReversingLabs	Win32.Ransomware.ClipboardHijacker
V1CCX70AZ8P70ADNI.exe	100%	Avira	TR/Spy.Banker.kdiut

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\explorer.exe	100%	Avira	TR/Spy.Banker.kdiut
C:\Users\user\AppData\Local\explorer.exe	63%	ReversingLabs	Win32.Ransomware.ClipboardHijacker

Source	Detection	Scanner	Label
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/0d/1	0%	Avira URL Cloud	safe
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/OIDx	0%	Avira URL Cloud	safe
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/	0%	Avira URL Cloud	safe
http://185.208.159.226/=r	0%	Avira URL Cloud	safe
http://93.88.203.34/cl/BatClipT	100%	Avira URL Cloud	malware
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/V	0%	Avira URL Cloud	safe
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/S	0%	Avira URL Cloud	safe
http://185.208.159.226/Ir	0%	Avira URL Cloud	safe
http://185.208.159.226/	0%	Avira URL Cloud	safe
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/6	0%	Avira URL Cloud	safe
http://93.88.203.34/cl/BatClipT.bat	100%	Avira URL Cloud	malware
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/o	0%	Avira URL Cloud	safe
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/=S)t	0%	Avira URL Cloud	safe
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/(	0%	Avira URL Cloud	safe
http://93.88.203.34/cl/BatClipT.bat/	100%	Avira URL Cloud	malware
http://185.208.k	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.githubusercontent.com	185.199.111.133	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/	true	Avira URL Cloud: safe	unknown
http://ip-api.com/line/	false		high
https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Code	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Code/	explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/CodeH0	explorer.exe, 00000006.00000002.2110233357.00000153F61FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/m	explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/0d/1	explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/V	V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F86B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/line/X	V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F8645000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Codei	V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F866A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2110233357.00000153F61FB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/S	explorer.exe, 00000006.00000002.2110534367.00000153F625C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/OIDx	V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F86B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/	explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Codei5I	V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F866A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ip-api.com/line/H	V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F8645000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/	explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/C	explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/VeraImage/Military	explorer.exe, 00000006.00000002.2110534367.00000153F625C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.208.159.226/	explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/line/L	explorer.exe, 00000006.00000002.2110233357.00000153F61D4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://93.88.203.34/cl/BatClipT	explorer.exe, 00000006.00000002.2110534367.00000153F625C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.208.159.226/=r	explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/)r	V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F8645000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.208.159.226/Ir	explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/6	explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/line/RUBYUA3DF1789B5ACD4F84861DC911341D1559CnZ3Vw8LXyFUd3p9AHQBBVoCUydwWFAIAwIGdwU	V1CCX70AZ8P70ADNI.exe, explorer.exe.0.dr	false		high
https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Code4puoh	V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F8645000.00000004.00000020.00020000.00000000.sdmp	false		high
http://93.88.203.34/cl/BatClipT.bat	explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/o	V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F86B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.208.k	explorer.exe, 00000006.00000002.2109737946.0000003C4EAF8000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/=S)t	explorer.exe, 00000006.00000002.2110534367.00000153F625C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.208.159.226:8888/921f83fca6994291b4bc3aa90673460d/(	V1CCX70AZ8P70ADNI.exe, 00000000.00000002.917482163.00000168F868A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2110233357.00000153F61FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://93.88.203.34/cl/BatClipT.bat/	explorer.exe, 00000006.00000002.2110233357.00000153F622F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.208.159.226	unknown	Switzerland	34888	SIMPLECARRER2IT	true
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
185.199.111.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1631862
Start date and time:	2025-03-07 16:41:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	V1CCX70AZ8P70ADNI.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@13/9@2/3
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10, 23.60.203.209
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, c.pki.goog
Execution Graph export aborted for target V1CCX70AZ8P70ADNI.exe, PID 6784 because there are no executed function
Execution Graph export aborted for target explorer.exe, PID 2520 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:43:42	API Interceptor	3616x Sleep call for process: explorer.exe modified
16:42:52	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run explorer C:\Users\user\AppData\Local\explorer.exe
16:43:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run explorer C:\Users\user\AppData\Local\explorer.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	GQKWopXj7S.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	1W2TnU01xb.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	2PJ65Chy6v.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	oCPGyn28rc.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	d1e371d754658620e3ea7abf8c49cffe4cd427d1a8a40.exe	Get hash	malicious	Python Stealer, Blank Grabber, Njrat	Browse	ip-api.com/json/?fields=225545
	file.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	buttocks.vbs	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Request for Best Offer- HS CODE REF PO#2010050.exe	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	FA76543456780000987601.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	D9876543456780000.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
185.199.111.133	cr_asm2.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	wcae.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	wcae.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	OPwuNqXuHv.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	downloader.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	r-c.exe	Get hash	malicious	Python Stealer, Empyrean, Quasar, Discord Token Stealer	Browse	185.199.111.133
	Setup.exe	Get hash	malicious	AveMaria, Clipboard Hijacker, StormKitty	Browse	185.199.108.133
	Setup.exe	Get hash	malicious	AveMaria, Clipboard Hijacker, StormKitty	Browse	185.199.110.133
	reset.exe	Get hash	malicious	AveMaria, Clipboard Hijacker, StormKitty	Browse	185.199.111.133
	StormKittyBuild (3).exe	Get hash	malicious	AveMaria, Clipboard Hijacker, StormKitty	Browse	185.199.111.133
	ZZZ.exe	Get hash	malicious	AveMaria, Clipboard Hijacker, StormKitty	Browse	185.199.109.133
ip-api.com	GQKWopXj7S.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	1W2TnU01xb.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	2PJ65Chy6v.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	oCPGyn28rc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	d1e371d754658620e3ea7abf8c49cffe4cd427d1a8a40.exe	Get hash	malicious	Python Stealer, Blank Grabber, Njrat	Browse	208.95.112.1
	file.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	buttocks.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Request for Best Offer- HS CODE REF PO#2010050.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	FA76543456780000987601.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	D9876543456780000.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	https://donotcause.database-breaches.com/XalZ5eXlPT05RODFQWWJESkJCVEtUNmpQQ1hDRFZoRVltU0dqYXFlVG02SlRoN09SN0sra2xJdkNWb3I4Uk5PR1RPMkdlWHUveHpnQ0hiOEd6K01Jd0h0WUFoZ0JyTHJKQWNQUE9ZZFZET2RHdHZzZlFWdmUrMFNKNEdpR0NKaHBibEJiNXc0SmIrY2xIdC9NanAwMHd6L2ZncFZkbFlHRnd5Q1ovSGp4Q3Y1b1ZoKzg4akpLUG90cDVUNWxuT2pYT0lURFIwc1BTWFByeXZWNXhnPT0tLXZlSzFkL1B4YUlrNGFHRUEtLWc4aU56Z0FSWCtMNFFGRVd0a2g0U0E9PQ==?cid=9759078	Get hash	malicious	KnowBe4	Browse	199.232.192.193
	Cbonline Q1 Handbook-0782794.pdf	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.2.137
	https://ipfs.io/ipfs/bafkreieqld65z4s3qt2ewjyg6bbbyhkdl2tlzzvflxmef66o3zugau2mtu/#bgruwez@youtube.com	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://ipfs.io/ipfs/bafkreieqld65z4s3qt2ewjyg6bbbyhkdl2tlzzvflxmef66o3zugau2mtu/#bgruwez@besix.com	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	ATT9668233.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	VN_MSG-Splcenter.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.194.137
	http://rebcare.help	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://spaceavenue.ae/Wilbe/roni.html	Get hash	malicious	HTMLPhisher	Browse	151.101.129.229
	Blake Moss is inviting you to collaborate on Distribution Notice.eml	Get hash	malicious	Unknown	Browse	151.101.2.217
	https://shared.outlook.inky.com/link?domain=sonarmedia.a2hosted.com&t=h.eJw1jkEOwiAURK_SsDYlH2iBrrzKF76WQEsDNMYY764sXM_Me_NmZ0lsGdja2lEXzmvesWzkA44o1lwb-dHljV0GFntvp5bLw04wWSl5xEL7FRPWiC9KKT99qAc2t_YR13dQwmhPAFLMqL32Cidh9U16A8pw0AqEmY00owUtLcguoi7aQqROjhgokWsluP8R_8v3M6XPF5GqOpY.MEQCIG-ydO5bULjNxSxtbqdqhoXlnmTS_tzb28w3vOdO8_ksAiBb9fKtPLfM5aYfQbUW6d81oub3HxpVI_ll_oHZbUXVIA	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.194.137
TUT-ASUS	GQKWopXj7S.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	1W2TnU01xb.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	2PJ65Chy6v.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	oCPGyn28rc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	d1e371d754658620e3ea7abf8c49cffe4cd427d1a8a40.exe	Get hash	malicious	Python Stealer, Blank Grabber, Njrat	Browse	208.95.112.1
	file.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	buttocks.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Request for Best Offer- HS CODE REF PO#2010050.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	FA76543456780000987601.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	D9876543456780000.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	208.95.112.1
SIMPLECARRER2IT	logrotate	Get hash	malicious	Xmrig	Browse	185.196.8.41
	http://analysiscache.com	Get hash	malicious	Unknown	Browse	185.208.158.121
	cred.dll	Get hash	malicious	Amadey	Browse	185.196.8.37
	clip64.dll	Get hash	malicious	Amadey	Browse	185.196.8.37
	cred64.dll.dll	Get hash	malicious	Amadey	Browse	185.196.8.37
	cpainject.txt.ps1	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.208.159.170
	Th2M2e7ZfY.exe	Get hash	malicious	Quasar	Browse	185.208.159.150
	https://steamescommnunity.com/s/10429109537	Get hash	malicious	Unknown	Browse	185.208.158.242
	https://steamecomrmunity.com/s/10423910953	Get hash	malicious	Unknown	Browse	185.208.158.242
	http://account.turnkeycashsite.com/	Get hash	malicious	Unknown	Browse	185.208.159.7

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	oAuym78xev.exe	Get hash	malicious	GuLoader	Browse	185.199.111.133
	mF8WNclxnv.exe	Get hash	malicious	FormBook, GuLoader	Browse	185.199.111.133
	15Er6ACahF.exe	Get hash	malicious	GuLoader	Browse	185.199.111.133
	uPDwUy9ewY.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.199.111.133
	OeM750ajqm.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.199.111.133
	15Er6ACahF.exe	Get hash	malicious	GuLoader	Browse	185.199.111.133
	uxeS0sMmqM.exe	Get hash	malicious	GuLoader	Browse	185.199.111.133
	uxeS0sMmqM.exe	Get hash	malicious	GuLoader	Browse	185.199.111.133
	JMgOcFOEZC.exe	Get hash	malicious	GuLoader	Browse	185.199.111.133

Process:	C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:6:6
MD5:	A01AB5C0FF81A60B7D1CEA84CC7DCB7A
SHA1:	D0BC07EAB4BE33F0E19FF3F812AA27CDA3BE7CD0
SHA-256:	53CD6B72987929CB8E78FCAD49CBACF653683D9E367C0EDB1925982229E91232
SHA-512:	F53AD574B732E638C54EE91725118639BC273CC1E0BFC5D46E332FDC2FBE29785AD29CF1FD72CF6095ECBF435D085826DA0DCD70249992BE11FB8C8DDB425E82
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	"pro"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\line[1].txt

Download File

Process:	C:\Users\user\AppData\Local\explorer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	165
Entropy (8bit):	5.060832195732379
Encrypted:	false
SSDEEP:	3:BztLQhNEIGKXOASdXYGv5VYGGEwAyBvMHLWLvFPVXqSsXMEe:BZLQhNEMeAuIGv5VYi1hCLvzqSsX3e
MD5:	4E2E625E7C3CC184B4F583177B2389BD
SHA1:	D17F842BD24F93C63E832E4BE803C3C4D9406DB9
SHA-256:	D3A732806D980847D2ED9C6BBA55AF91E3A959E08FFB09DD1DF9F9169B24282C
SHA-512:	92214BE83D28FCC8598CFF05AFFB0FBF54835D142035692F083F2AFDC811B1855EB23000B981FCB5157879A74D8A24DD8C49A103D6631612337A31CDA3A39914
Malicious:	false
Reputation:	low
Preview:	success.United States.US.NY.New York.New York.10123.40.7128.-74.006.America/New_York.Level 3.CenturyLink Communications, LLC.AS3356 Level 3 Parent, LLC.8.46.123.189.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\921f83fca6994291b4bc3aa90673460d[1].json

Download File

Process:	C:\Users\user\AppData\Local\explorer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:6:6
MD5:	A01AB5C0FF81A60B7D1CEA84CC7DCB7A
SHA1:	D0BC07EAB4BE33F0E19FF3F812AA27CDA3BE7CD0
SHA-256:	53CD6B72987929CB8E78FCAD49CBACF653683D9E367C0EDB1925982229E91232
SHA-512:	F53AD574B732E638C54EE91725118639BC273CC1E0BFC5D46E332FDC2FBE29785AD29CF1FD72CF6095ECBF435D085826DA0DCD70249992BE11FB8C8DDB425E82
Malicious:	false
Preview:	"pro"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Code[1].txt

Download File

Process:	C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.010434089033337
Encrypted:	false
SSDEEP:	3:EQj7UFXDf/:EQnUtDf/
MD5:	92D65DE01D0749FDA422A3CA9DFFD46B
SHA1:	59D246850168572359D67DAE5F246C4CF9C4D3E5
SHA-256:	F6AFFEFD5085E01E46FD3EAF216AF82D28E475A581D263554A7959A26217F2A4
SHA-512:	29B24409B9D2F74C9F679FF10266A3D8790800A0E8F9C0D3C622FBA4E8B867F31C3B1BD1E79DFEF94471143FC57B27528B1A9808BCC4ABEFD8CE28DDF1F10DB1
Malicious:	false
Preview:	185.208.159.226:8888.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Code[1].txt

Download File

Process:	C:\Users\user\AppData\Local\explorer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.010434089033337
Encrypted:	false
SSDEEP:	3:EQj7UFXDf/:EQnUtDf/
MD5:	92D65DE01D0749FDA422A3CA9DFFD46B
SHA1:	59D246850168572359D67DAE5F246C4CF9C4D3E5
SHA-256:	F6AFFEFD5085E01E46FD3EAF216AF82D28E475A581D263554A7959A26217F2A4
SHA-512:	29B24409B9D2F74C9F679FF10266A3D8790800A0E8F9C0D3C622FBA4E8B867F31C3B1BD1E79DFEF94471143FC57B27528B1A9808BCC4ABEFD8CE28DDF1F10DB1
Malicious:	false
Preview:	185.208.159.226:8888.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\line[1].txt

Download File

Process:	C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	165
Entropy (8bit):	5.060832195732379
Encrypted:	false
SSDEEP:	3:BztLQhNEIGKXOASdXYGv5VYGGEwAyBvMHLWLvFPVXqSsXMEe:BZLQhNEMeAuIGv5VYi1hCLvzqSsX3e
MD5:	4E2E625E7C3CC184B4F583177B2389BD
SHA1:	D17F842BD24F93C63E832E4BE803C3C4D9406DB9
SHA-256:	D3A732806D980847D2ED9C6BBA55AF91E3A959E08FFB09DD1DF9F9169B24282C
SHA-512:	92214BE83D28FCC8598CFF05AFFB0FBF54835D142035692F083F2AFDC811B1855EB23000B981FCB5157879A74D8A24DD8C49A103D6631612337A31CDA3A39914
Malicious:	false
Preview:	success.United States.US.NY.New York.New York.10123.40.7128.-74.006.America/New_York.Level 3.CenturyLink Communications, LLC.AS3356 Level 3 Parent, LLC.8.46.123.189.

C:\Users\user\AppData\Local\Temp\ChromiumDatagram.txt

Download File

Process:	C:\Users\user\AppData\Local\explorer.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\explorer.exe

Download File

Process:	C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3648000
Entropy (8bit):	7.314772058336657
Encrypted:	false
SSDEEP:	49152:FmVwASOEGtlqCKIU6il1WrcTEhTWdrGa+nQEycjrAyn5VYRVctpXkESh491acOIm:2d+Vh5yUcOJx9iKqHHhrX2ANMnV
MD5:	C8B01A488052A5368731FE95A056639E
SHA1:	78A64B7CD6A75BD309174BF78FC6D28D524CE3CF
SHA-256:	7CAFCB54154E4E5F9E6C2B23B436A3EA4BDC9D1E0AA12868F3940C7567D8EDAB
SHA-512:	2F201307BE311A6653162B2F0B9A6C999D0D9A651C09DB4454DD1998213964D852012BED500D820512629F33DE5B19C632B697CC249D6336FF56DE64AE081215
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$................................-.......................................................................a......a......a......Rich............................PE..d......g.........."....*.....&.......l.........@.............................P8...........`...................................................5.......7.......6.L.............7.T[...4.p.....................4.(.....4.@............................................text............................... ..`.rdata..............................@..@.data........ 6..D....5.............@....pdata..L.....6......>6.............@..@.rsrc.........7......L7.............@..@.reloc..T[....7..\...N7.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\explorer.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.314772058336657
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	V1CCX70AZ8P70ADNI.exe
File size:	3'648'000 bytes
MD5:	c8b01a488052a5368731fe95a056639e
SHA1:	78a64b7cd6a75bd309174bf78fc6d28d524ce3cf
SHA256:	7cafcb54154e4e5f9e6c2b23b436a3ea4bdc9d1e0aa12868f3940c7567d8edab
SHA512:	2f201307be311a6653162b2f0b9a6c999d0d9a651c09db4454dd1998213964d852012bed500d820512629f33de5b19c632b697cc249d6336ff56de64ae081215
SSDEEP:	49152:FmVwASOEGtlqCKIU6il1WrcTEhTWdrGa+nQEycjrAyn5VYRVctpXkESh491acOIm:2d+Vh5yUcOJx9iKqHHhrX2ANMnV
TLSH:	C7F5D016B3A800E9D87BC13CD9964133E7B2B86917B0ABDB02A496751F237E15F3E741
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...................................-...................................................................................a.......a......

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140186c00
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67C9FC84 [Thu Mar 6 19:50:28 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	290b5b74ed388a2f4e81683b8fd40b54

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE178E0F090h
dec eax
add esp, 28h
jmp 00007FE178E0E797h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
lea ecx, dword ptr [001E403Ch]
call dword ptr [00039736h]
mov eax, dword ptr [001DD224h]
dec eax
lea ecx, dword ptr [001E4029h]
mov edx, dword ptr [001E4043h]
inc eax
mov dword ptr [001DD20Fh], eax
mov dword ptr [ebx], eax
dec eax
mov eax, dword ptr [00000058h]
inc ecx
mov ecx, 00000004h
dec esp
mov eax, dword ptr [eax+edx*8]
mov eax, dword ptr [001DD1F4h]
inc ebx
mov dword ptr [ecx+eax], eax
call dword ptr [000396EEh]
dec eax
lea ecx, dword ptr [001E3FE7h]
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000396EBh]
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
lea ecx, dword ptr [001E3FD0h]
call dword ptr [000396CAh]
cmp dword ptr [ebx], 00000000h
jne 00007FE178E0E944h
or dword ptr [ebx], FFFFFFFFh
jmp 00007FE178E0E967h
inc ebp
xor ecx, ecx
dec eax
lea edx, dword ptr [001E3FB6h]
inc ecx
or eax, FFFFFFFFh
dec eax
lea ecx, dword ptr [001E3FA3h]
call dword ptr [000396B5h]
jmp 00007FE178E0E8FBh
cmp dword ptr [ebx], FFFFFFFFh
je 00007FE178E0E900h
dec eax
mov eax, dword ptr [00000058h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x35fbfc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x37e000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x36d000	0x10d4c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x37f000	0x5b54	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x349ad0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x349d00	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x349990	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1c0000	0x5f0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1be218	0x1be400	5ee6900e233399fbbeb91fdab545e3cb	False	0.509053855917367	data	6.862700216670016	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1c0000	0x1a1098	0x1a1200	697c25748c064e00df241769bd360dbe	False	0.8067225661147738	data	7.483660133608383	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x362000	0xa784	0x4400	c50ba30d1b757a6501baada5cc8f82a5	False	0.21513097426470587	data	3.5776227565874184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x36d000	0x10d4c	0x10e00	8c6deaa3bc221c0ebd206b87b41fa1e3	False	0.4868923611111111	data	6.1448501326051055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x37e000	0x1e0	0x200	8596ef18191b12d8e3bec098ab630c55	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x37f000	0x5b54	0x5c00	2fb46eefcec0f38676ac873933237374	False	0.27390455163043476	data	5.447763627867713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x37e060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	CheckRemoteDebuggerPresent, GlobalMemoryStatusEx, SetFileAttributesA, GetSystemInfo, CloseHandle, GlobalAlloc, CreateFileA, OpenMutexA, CopyFileA, SetEndOfFile, WriteConsoleW, GetTimeZoneInformation, GetTempPathA, Sleep, CreateFileW, CreateMutexA, DeviceIoControl, WriteFile, GetCurrentProcess, GetModuleFileNameA, GetProcessHeap, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, SetStdHandle, HeapSize, CreateProcessW, GetExitCodeProcess, WaitForSingleObject, HeapReAlloc, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetLastError, SetLastError, QueryPerformanceCounter, QueryPerformanceFrequency, GetStdHandle, GetEnvironmentVariableW, GetFileType, GetModuleHandleW, GetProcAddress, MultiByteToWideChar, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, GetCurrentThreadId, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleExW, RtlVirtualUnwind, DeleteFiber, WideCharToMultiByte, GetCurrentProcessId, GetSystemTimeAsFileTime, ConvertFiberToThread, FreeLibrary, LoadLibraryA, LoadLibraryW, FindClose, FindFirstFileW, FindNextFileW, GetConsoleMode, SetConsoleMode, ReadConsoleA, ReadConsoleW, RtlCaptureContext, RtlLookupFunctionEntry, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, LocalFree, FormatMessageA, GetLocaleInfoEx, GetCurrentDirectoryW, FindFirstFileExW, GetFileAttributesExW, GetFileInformationByHandle, GetFullPathNameW, SetFileInformationByHandle, AreFileApisANSI, GetFileInformationByHandleEx, TryAcquireSRWLockExclusive, WaitForSingleObjectEx, GetExitCodeThread, LCMapStringEx, InitializeCriticalSectionEx, EncodePointer, DecodePointer, CompareStringEx, GetCPInfo, GetStringTypeW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, LoadLibraryExW, CreateThread, ExitThread, FreeLibraryAndExitThread, ExitProcess, SetConsoleCtrlHandler, ReadFile, GetDriveTypeW, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetModuleFileNameW, GetCommandLineA, GetCommandLineW, GetFileSizeEx, SetFilePointerEx, HeapAlloc, FlushFileBuffers, GetConsoleOutputCP, HeapFree, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, RtlUnwind
USER32.dll	GetClipboardData, EmptyClipboard, CloseClipboard, OpenClipboard, GetProcessWindowStation, SetClipboardData, GetClipboardSequenceNumber, GetUserObjectInformationW, MessageBoxW
ADVAPI32.dll	CryptGetUserKey, CryptGetProvParam, CryptExportKey, CryptDecrypt, CryptCreateHash, CryptDestroyHash, CryptSignHashW, CryptEnumProvidersW, DeregisterEventSource, RegisterEventSourceW, ReportEventW, CryptAcquireContextW, CryptReleaseContext, CryptDestroyKey, CryptSetHashParam, RegCreateKeyA, RegSetValueExA
SHELL32.dll	ShellExecuteA
bcrypt.dll	BCryptGenRandom
WININET.dll	InternetOpenA, InternetCloseHandle, InternetReadFile, InternetOpenUrlA
CRYPT32.dll	CertEnumCertificatesInStore, CertFindCertificateInStore, CertOpenStore, CertFreeCertificateContext, CertDuplicateCertificateContext, CertGetCertificateContextProperty, CertCloseStore
WS2_32.dll	WSACleanup, WSAGetLastError, closesocket, recv, send, WSASetLastError

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 16:42:44.489732027 CET	49681	80	192.168.2.7	208.95.112.1
Mar 7, 2025 16:42:44.494854927 CET	80	49681	208.95.112.1	192.168.2.7
Mar 7, 2025 16:42:44.495359898 CET	49681	80	192.168.2.7	208.95.112.1
Mar 7, 2025 16:42:44.495564938 CET	49681	80	192.168.2.7	208.95.112.1
Mar 7, 2025 16:42:44.500685930 CET	80	49681	208.95.112.1	192.168.2.7
Mar 7, 2025 16:42:44.994868040 CET	80	49681	208.95.112.1	192.168.2.7
Mar 7, 2025 16:42:44.994935989 CET	49681	80	192.168.2.7	208.95.112.1
Mar 7, 2025 16:42:45.022108078 CET	49682	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:45.022159100 CET	443	49682	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:45.022221088 CET	49682	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:45.032568932 CET	49682	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:45.032597065 CET	443	49682	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:46.970232964 CET	443	49682	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:46.970303059 CET	49682	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:47.137681007 CET	49682	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:47.137712955 CET	443	49682	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:47.138098955 CET	443	49682	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:47.138161898 CET	49682	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:47.165663958 CET	49682	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:47.212326050 CET	443	49682	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:47.774776936 CET	443	49682	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:47.774883032 CET	443	49682	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:47.774914026 CET	49682	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:47.774980068 CET	49682	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:47.776820898 CET	49682	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:47.776843071 CET	443	49682	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:47.806572914 CET	49683	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:42:47.811722994 CET	8888	49683	185.208.159.226	192.168.2.7
Mar 7, 2025 16:42:47.811846972 CET	49683	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:42:47.811975002 CET	49683	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:42:47.817001104 CET	8888	49683	185.208.159.226	192.168.2.7
Mar 7, 2025 16:42:48.907634974 CET	8888	49683	185.208.159.226	192.168.2.7
Mar 7, 2025 16:42:48.907720089 CET	49683	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:42:50.181380033 CET	49681	80	192.168.2.7	208.95.112.1
Mar 7, 2025 16:42:50.181562901 CET	49683	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:42:50.218357086 CET	49684	80	192.168.2.7	208.95.112.1
Mar 7, 2025 16:42:50.223462105 CET	80	49684	208.95.112.1	192.168.2.7
Mar 7, 2025 16:42:50.223598957 CET	49684	80	192.168.2.7	208.95.112.1
Mar 7, 2025 16:42:50.223972082 CET	49684	80	192.168.2.7	208.95.112.1
Mar 7, 2025 16:42:50.228976965 CET	80	49684	208.95.112.1	192.168.2.7
Mar 7, 2025 16:42:50.715259075 CET	80	49684	208.95.112.1	192.168.2.7
Mar 7, 2025 16:42:50.715328932 CET	49684	80	192.168.2.7	208.95.112.1
Mar 7, 2025 16:42:50.782612085 CET	49685	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:50.782666922 CET	443	49685	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:50.782748938 CET	49685	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:50.790486097 CET	49685	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:50.790518999 CET	443	49685	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:52.681029081 CET	443	49685	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:52.681159973 CET	49685	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:52.702953100 CET	49685	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:52.702997923 CET	443	49685	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:52.703098059 CET	49685	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:52.703110933 CET	443	49685	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:52.703588009 CET	443	49685	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:52.703660011 CET	49685	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:53.263307095 CET	443	49685	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:53.263370991 CET	49685	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:53.263406992 CET	443	49685	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:53.263432980 CET	443	49685	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:53.263448000 CET	49685	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:53.263463020 CET	49685	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:53.264039993 CET	49685	443	192.168.2.7	185.199.111.133
Mar 7, 2025 16:42:53.264060974 CET	443	49685	185.199.111.133	192.168.2.7
Mar 7, 2025 16:42:53.286297083 CET	49686	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:42:53.291318893 CET	8888	49686	185.208.159.226	192.168.2.7
Mar 7, 2025 16:42:53.291389942 CET	49686	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:42:53.291583061 CET	49686	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:42:53.296552896 CET	8888	49686	185.208.159.226	192.168.2.7
Mar 7, 2025 16:42:54.194355965 CET	8888	49686	185.208.159.226	192.168.2.7
Mar 7, 2025 16:42:54.194432020 CET	49686	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:42:59.194803953 CET	8888	49686	185.208.159.226	192.168.2.7
Mar 7, 2025 16:42:59.194885969 CET	49686	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:43:56.771505117 CET	80	49684	208.95.112.1	192.168.2.7
Mar 7, 2025 16:43:56.771661997 CET	49684	80	192.168.2.7	208.95.112.1
Mar 7, 2025 16:44:40.175806046 CET	49686	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:44:40.175960064 CET	49684	80	192.168.2.7	208.95.112.1
Mar 7, 2025 16:44:40.181169033 CET	80	49684	208.95.112.1	192.168.2.7
Mar 7, 2025 16:44:40.487937927 CET	49686	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:44:41.097275019 CET	49686	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:44:42.300353050 CET	49686	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:44:44.706562996 CET	49686	8888	192.168.2.7	185.208.159.226
Mar 7, 2025 16:44:49.519184113 CET	49686	8888	192.168.2.7	185.208.159.226

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 16:42:44.474914074 CET	60685	53	192.168.2.7	1.1.1.1
Mar 7, 2025 16:42:44.482589960 CET	53	60685	1.1.1.1	192.168.2.7
Mar 7, 2025 16:42:45.012891054 CET	62020	53	192.168.2.7	1.1.1.1
Mar 7, 2025 16:42:45.021193027 CET	53	62020	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 7, 2025 16:42:44.474914074 CET	192.168.2.7	1.1.1.1	0x2123	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 16:42:45.012891054 CET	192.168.2.7	1.1.1.1	0x1ab3	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 7, 2025 16:42:44.482589960 CET	1.1.1.1	192.168.2.7	0x2123	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 16:42:45.021193027 CET	1.1.1.1	192.168.2.7	0x1ab3	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Mar 7, 2025 16:42:45.021193027 CET	1.1.1.1	192.168.2.7	0x1ab3	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Mar 7, 2025 16:42:45.021193027 CET	1.1.1.1	192.168.2.7	0x1ab3	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Mar 7, 2025 16:42:45.021193027 CET	1.1.1.1	192.168.2.7	0x1ab3	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

ip-api.com

185.208.159.226:8888

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49681	208.95.112.1	80	6784	C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 16:42:44.495564938 CET	86	OUT	GET /line/ HTTP/1.1 User-Agent: ClpBot Host: ip-api.com Cache-Control: no-cache
Mar 7, 2025 16:42:44.994868040 CET	336	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 15:42:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 165 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 73 75 63 63 65 73 73 0a 55 6e 69 74 65 64 20 53 74 61 74 65 73 0a 55 53 0a 4e 59 0a 4e 65 77 20 59 6f 72 6b 0a 4e 65 77 20 59 6f 72 6b 0a 31 30 31 32 33 0a 34 30 2e 37 31 32 38 0a 2d 37 34 2e 30 30 36 0a 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 0a 4c 65 76 65 6c 20 33 0a 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 0a 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 0a 38 2e 34 36 2e 31 32 33 2e 31 38 39 0a Data Ascii: successUnited StatesUSNYNew YorkNew York1012340.7128-74.006America/New_YorkLevel 3CenturyLink Communications, LLCAS3356 Level 3 Parent, LLC8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49683	185.208.159.226	8888	6784	C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 16:42:47.811975002 CET	124	OUT	GET /921f83fca6994291b4bc3aa90673460d/ HTTP/1.1 User-Agent: ClpBot Host: 185.208.159.226:8888 Cache-Control: no-cache
Mar 7, 2025 16:42:48.907634974 CET	129	IN	HTTP/1.1 200 OK date: Fri, 07 Mar 2025 15:42:47 GMT server: uvicorn content-length: 5 content-type: application/json Data Raw: 22 70 72 6f 22 Data Ascii: "pro"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49684	208.95.112.1	80	2520	C:\Users\user\AppData\Local\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 16:42:50.223972082 CET	86	OUT	GET /line/ HTTP/1.1 User-Agent: ClpBot Host: ip-api.com Cache-Control: no-cache
Mar 7, 2025 16:42:50.715259075 CET	336	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 15:42:49 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 165 Access-Control-Allow-Origin: * X-Ttl: 54 X-Rl: 43 Data Raw: 73 75 63 63 65 73 73 0a 55 6e 69 74 65 64 20 53 74 61 74 65 73 0a 55 53 0a 4e 59 0a 4e 65 77 20 59 6f 72 6b 0a 4e 65 77 20 59 6f 72 6b 0a 31 30 31 32 33 0a 34 30 2e 37 31 32 38 0a 2d 37 34 2e 30 30 36 0a 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 0a 4c 65 76 65 6c 20 33 0a 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 0a 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 0a 38 2e 34 36 2e 31 32 33 2e 31 38 39 0a Data Ascii: successUnited StatesUSNYNew YorkNew York1012340.7128-74.006America/New_YorkLevel 3CenturyLink Communications, LLCAS3356 Level 3 Parent, LLC8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49686	185.208.159.226	8888	2520	C:\Users\user\AppData\Local\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 16:42:53.291583061 CET	124	OUT	GET /921f83fca6994291b4bc3aa90673460d/ HTTP/1.1 User-Agent: ClpBot Host: 185.208.159.226:8888 Cache-Control: no-cache
Mar 7, 2025 16:42:54.194355965 CET	129	IN	HTTP/1.1 200 OK date: Fri, 07 Mar 2025 15:42:53 GMT server: uvicorn content-length: 5 content-type: application/json Data Raw: 22 70 72 6f 22 Data Ascii: "pro"

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49682	185.199.111.133	443	6784	C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 15:42:47 UTC	141	OUT	GET /VeraImage/MilitarySource/refs/heads/main/Code HTTP/1.1 User-Agent: ClpBot Host: raw.githubusercontent.com Cache-Control: no-cache
2025-03-07 15:42:47 UTC	893	IN	HTTP/1.1 200 OK Connection: close Content-Length: 21 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "487c8fd5d11555c8fe0f835934373d10b5bf87fb3c9326ed680dd347bf276158" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: D5A0:3B24D4:94FE90:BC6EB5:67CB0CE4 Accept-Ranges: bytes Date: Fri, 07 Mar 2025 15:42:47 GMT Via: 1.1 varnish X-Served-By: cache-phx1710021-PHX X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1741362167.386727,VS0,VE120 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: a9f716f0f8ae6b795d8356045b01ac078ced5260 Expires: Fri, 07 Mar 2025 15:47:47 GMT Source-Age: 0
2025-03-07 15:42:47 UTC	21	IN	Data Raw: 31 38 35 2e 32 30 38 2e 31 35 39 2e 32 32 36 3a 38 38 38 38 0a Data Ascii: 185.208.159.226:8888

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49685	185.199.111.133	443	2520	C:\Users\user\AppData\Local\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 15:42:52 UTC	141	OUT	GET /VeraImage/MilitarySource/refs/heads/main/Code HTTP/1.1 User-Agent: ClpBot Host: raw.githubusercontent.com Cache-Control: no-cache
2025-03-07 15:42:53 UTC	891	IN	HTTP/1.1 200 OK Connection: close Content-Length: 21 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "487c8fd5d11555c8fe0f835934373d10b5bf87fb3c9326ed680dd347bf276158" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: D5A0:3B24D4:94FE90:BC6EB5:67CB0CE4 Accept-Ranges: bytes Date: Fri, 07 Mar 2025 15:42:52 GMT Via: 1.1 varnish X-Served-By: cache-phx1710024-PHX X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1741362173.983084,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 97d0575ee7f8f2d6c5af9b96b49b7d5ceeb9154d Expires: Fri, 07 Mar 2025 15:47:52 GMT Source-Age: 5
2025-03-07 15:42:53 UTC	21	IN	Data Raw: 31 38 35 2e 32 30 38 2e 31 35 39 2e 32 32 36 3a 38 38 38 38 0a Data Ascii: 185.208.159.226:8888

Target ID:	0
Start time:	10:42:43
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\V1CCX70AZ8P70ADNI.exe"
Imagebase:	0x7ff6a8af0000
File size:	3'648'000 bytes
MD5 hash:	C8B01A488052A5368731FE95A056639E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:42:48
Start date:	07/03/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe"
Imagebase:	0x7ff65c940000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:42:48
Start date:	07/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff642da0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:42:48
Start date:	07/03/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\explorer.exe"
Imagebase:	0x7ff65c940000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:42:48
Start date:	07/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff642da0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:42:48
Start date:	07/03/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping localhost -n 1
Imagebase:	0x7ff654c50000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:42:48
Start date:	07/03/2025
Path:	C:\Users\user\AppData\Local\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\explorer.exe
Imagebase:	0x7ff649280000
File size:	3'648'000 bytes
MD5 hash:	C8B01A488052A5368731FE95A056639E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:43:00
Start date:	07/03/2025
Path:	C:\Users\user\AppData\Local\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\explorer.exe"
Imagebase:	0x7ff649280000
File size:	3'648'000 bytes
MD5 hash:	C8B01A488052A5368731FE95A056639E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:43:08
Start date:	07/03/2025
Path:	C:\Users\user\AppData\Local\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\explorer.exe"
Imagebase:	0x7ff649280000
File size:	3'648'000 bytes
MD5 hash:	C8B01A488052A5368731FE95A056639E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report V1CCX70AZ8P70ADNI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\921f83fca6994291b4bc3aa90673460d[1].json

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\line[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\921f83fca6994291b4bc3aa90673460d[1].json

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Code[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Code[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\line[1].txt

C:\Users\user\AppData\Local\Temp\ChromiumDatagram.txt

C:\Users\user\AppData\Local\explorer.exe

C:\Users\user\AppData\Local\explorer.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
V1CCX70AZ8P70ADNI.exe