Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 6, 2023, 4:52 p.m.	Sept. 6, 2023, 4:59 p.m.

Size	5.7MB
Type	MS-DOS executable, MZ for MS-DOS
MD5	`a5c6dcf7ef6eac4c0157b5e2f0155424`
SHA256	`6707dfab5d78cad62a28c59519e5809092c5b3d817d39c15a472f0363e88a5fa`
CRC32	`7CC3357C`
ssdeep	`98304:7VHBTaWbcTYcU8NyAvo1lRiz5zw5H3cQsnwOiUKgScSch+MppLNna52Cg95vFJwH:RBTacaYcRNypl8UcXneUbSc1bLUpg9VW`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature MPRESS_Zero - MPRESS packed file IsPE32 - (no description)

clips.exe "C:\Users\test22\AppData\Local\Temp\clips.exe"
2572
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\s1zg.0.bat" "
  2684
  - timeout.exe timeout 3
    2744
  - LEAJ.exe "C:\ProgramData\presepuesto\LEAJ.exe"
    2804
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f
      2916

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 6, 2023, 4:52 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 6, 2023, 4:52 p.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 6, 2023, 4:52 p.m.	buffer: Could Not Find C:\Users\test22\AppData\Local\Temp\s1zg.2 console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 6, 2023, 4:52 p.m.	buffer: SUCCESS: The scheduled task "LEAJ" has successfully been created. console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 6, 2023, 4:52 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.MPRESS1
section	.MPRESS2

The file contains an unknown PE resource name possibly indicative of a packer (3 events)

resource name	PCM
resource name	TEXTINCLUDE
resource name	TYPELIB

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ Sept. 6, 2023, 4:52 p.m.	stacktrace: clips+0x334ba9 @ 0x734ba9 clips+0x2eee02 @ 0x6eee02 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1638148 registers.edi: 4468736 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 1638276 registers.esi: 1995994155 registers.ecx: 2123366400	1
__exception__ Sept. 6, 2023, 4:52 p.m.	stacktrace: exception.instruction_r: ed e9 19 8d 05 00 15 43 ae 45 4a 77 26 7c c7 37 exception.symbol: clips+0x335086 exception.instruction: in eax, dx exception.module: clips.exe exception.exception_code: 0xc0000096 exception.offset: 3362950 exception.address: 0x735086 registers.esp: 1638268 registers.edi: 23735703 registers.eax: 1750617430 registers.ebp: 4468736 registers.edx: 546902 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ Sept. 6, 2023, 4:52 p.m.	stacktrace: exception.instruction_r: ed e9 02 d6 04 00 c3 e9 8c b8 04 00 3d a6 8f fc exception.symbol: clips+0x340a43 exception.instruction: in eax, dx exception.module: clips.exe exception.exception_code: 0xc0000096 exception.offset: 3410499 exception.address: 0x740a43 registers.esp: 1638268 registers.edi: 23735703 registers.eax: 1447909480 registers.ebp: 4468736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ Sept. 6, 2023, 4:52 p.m.	stacktrace: leaj+0x334ba9 @ 0x734ba9 leaj+0x2eee02 @ 0x6eee02 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1638148 registers.edi: 4468736 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 1638276 registers.esi: 1995994155 registers.ecx: 2498101248	1
__exception__ Sept. 6, 2023, 4:52 p.m.	stacktrace: exception.instruction_r: ed e9 19 8d 05 00 15 43 ae 45 4a 77 26 7c c7 37 exception.symbol: leaj+0x335086 exception.instruction: in eax, dx exception.module: LEAJ.exe exception.exception_code: 0xc0000096 exception.offset: 3362950 exception.address: 0x735086 registers.esp: 1638268 registers.edi: 20983326 registers.eax: 1750617430 registers.ebp: 4468736 registers.edx: 546902 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ Sept. 6, 2023, 4:52 p.m.	stacktrace: exception.instruction_r: ed e9 02 d6 04 00 c3 e9 8c b8 04 00 3d a6 8f fc exception.symbol: leaj+0x340a43 exception.instruction: in eax, dx exception.module: LEAJ.exe exception.exception_code: 0xc0000096 exception.offset: 3410499 exception.address: 0x740a43 registers.esp: 1638268 registers.edi: 20983326 registers.eax: 1447909480 registers.ebp: 4468736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76faf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76faf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

LEAJ.exe tried to sleep 212 seconds, actually delayed analysis time by 212 seconds

Creates executable files on the filesystem (2 events)

file	C:\ProgramData\presepuesto\LEAJ.exe
file	C:\Users\test22\AppData\Local\Temp\s1zg.0.bat

Creates a suspicious process (2 events)

cmdline	schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 6, 2023, 4:52 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\s1zg.0.bat parameters: filepath: C:\Users\test22\AppData\Local\Temp\s1zg.0.bat	1	1	0
ShellExecuteExW Sept. 6, 2023, 4:52 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f filepath: schtasks.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00599c00', u'virtual_address': u'0x00001000', u'entropy': 7.999963956928202, u'name': u'.MPRESS1', u'virtual_size': u'0x00ec5000'}

entropy

7.99996395693

description

A section with a high entropy has been found

entropy

0.990415335463

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (1 event)

url	https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation

Yara rule detected in process memory (32 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications over P2P network	rule	Network_P2P_Win
description	Communication using DGA	rule	Network_DGA
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Escalate priviledges	rule	Escalate_priviledges
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Take ScreenShot	rule	ScreenShot
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	File Downloader	rule	Network_Downloader

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f

Checks for the presence of known windows from debuggers and forensic tools (50 out of 162 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:52 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 6, 2023, 4:53 p.m.	class_name: Regmonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Installs itself for autorun at Windows startup (2 events)

cmdline	schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\s1zg.0.bat
file	C:\ProgramData\presepuesto\LEAJ.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2684 resumed a thread in remote process 2804
NtResumeThread Sept. 6, 2023, 4:52 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2804	1	0	0

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 6, 2023, 4:52 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 6, 2023, 4:52 p.m.	stacktrace: exception.instruction_r: ed e9 02 d6 04 00 c3 e9 8c b8 04 00 3d a6 8f fc exception.symbol: clips+0x340a43 exception.instruction: in eax, dx exception.module: clips.exe exception.exception_code: 0xc0000096 exception.offset: 3410499 exception.address: 0x740a43 registers.esp: 1638268 registers.edi: 23735703 registers.eax: 1447909480 registers.ebp: 4468736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.ClipBanker.Z!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.69126231
FireEye	Trojan.GenericKD.69126231
CAT-QuickHeal	W32.Virut.G
ALYac	Trojan.GenericKDS.61015072
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0059d2b31 )
K7GW	Trojan ( 0059d2b31 )
BitDefenderTheta	Gen:NN.ZexaF.36662.@pvaayxdltiG
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenCBL.DHF
Cynet	Malicious (score: 99)
APEX	Malicious
Kaspersky	Trojan-Banker.Win32.ClipBanker.zgu
BitDefender	Trojan.GenericKD.69126231
Tencent	Win32.Trojan.FalseSign.Tgil
Emsisoft	Trojan.GenericKD.69126231 (B)
F-Secure	Heuristic.HEUR/AGEN.1304053
VIPRE	Trojan.GenericKDS.61015072
TrendMicro	Trojan.Win32.AMADEY.YXDIEZ
McAfee-GW-Edition	Artemis!Trojan
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1304053
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	Trojan.Generic.D41EC857
ZoneAlarm	Trojan-Banker.Win32.ClipBanker.zgu
GData	Trojan.GenericKD.69126231
AhnLab-V3	Trojan/Win.Generic.C5470080
MAX	malware (ai score=81)
DeepInstinct	MALICIOUS
Malwarebytes	Malware.Heuristic.1003
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXDIEZ
Rising	Trojan.Kryptik!8.8 (TFE:5:biRMGD3p3sV)
Ikarus	Trojan.Crypt
Panda	Trj/Chgt.AC
CrowdStrike	win/malicious_confidence_100% (W)

clips.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All