File name:

NoClippingBro_[unknowncheats.me]_.exe

Full analysis: https://app.any.run/tasks/a60fde04-1473-4797-a0e8-d3247bf7a657
Verdict: Malicious activity
Analysis date: October 04, 2024, 18:52:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
lua
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1BF97464516EBA32632E4978EF2F7E4F

SHA1:

ECBADE5BED7C0E5077A780AE40F9989C35F2C0DF

SHA256:

3E636D37906E3D578472E3FC0E32FC627D5D459C65F8436EAAECDDB5440B29FF

SSDEEP:

98304:PirUeUkFkHKzsCEx41M9fg1rlFsb4KAUoVF+f6eY/b/WlmPBUFihKRkEeSD2mTRO:dXkeG8b/s7QV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • sidebar.exe (PID: 2920)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • NoClippingBro_[unknowncheats.me]_.exe (PID: 748)
      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3592)

    • There is functionality for communication over UDP network (YARA)

      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3060)

    • Process drops legitimate windows executable

      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3592)

    • Reads the Internet Settings

      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3060)
      • sidebar.exe (PID: 2920)

    • Reads security settings of Internet Explorer

      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3060)
      • sidebar.exe (PID: 2920)

    • Reads Microsoft Outlook installation path

      • sidebar.exe (PID: 2920)

    • Reads Internet Explorer settings

      • sidebar.exe (PID: 2920)

    • Reads settings of System Certificates

      • filezilla.exe (PID: 1476)

    • Connects to unusual port

      • fzsftp.exe (PID: 1916)

  • INFO

    • Reads the computer name

      • NoClippingBro_[unknowncheats.me]_.exe (PID: 748)
      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3060)
      • xmplayer.exe (PID: 2296)
      • sidebar.exe (PID: 2920)
      • filezilla.exe (PID: 1476)
      • fzsftp.exe (PID: 1916)
      • wmpnscfg.exe (PID: 524)

    • Create files in a temporary directory

      • NoClippingBro_[unknowncheats.me]_.exe (PID: 748)
      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3592)

    • Checks supported languages

      • NoClippingBro_[unknowncheats.me]_.exe (PID: 748)
      • sidebar.exe (PID: 2920)
      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3060)
      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3592)
      • xmplayer.exe (PID: 2296)
      • filezilla.exe (PID: 1476)
      • fzsftp.exe (PID: 1916)
      • wmpnscfg.exe (PID: 524)

    • The process uses Lua

      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3060)

    • Manual execution by a user

      • sidebar.exe (PID: 2920)
      • filezilla.exe (PID: 1476)
      • wmpnscfg.exe (PID: 524)

    • Sends debugging messages

      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3060)

    • The process uses the downloaded file

      • NoClippingBro_[unknowncheats.me]_.exe (PID: 3060)
      • sidebar.exe (PID: 2920)

    • Reads the machine GUID from the registry

      • sidebar.exe (PID: 2920)
      • fzsftp.exe (PID: 1916)
      • filezilla.exe (PID: 1476)

    • Checks proxy server information

      • sidebar.exe (PID: 2920)

    • Reads Environment values

      • sidebar.exe (PID: 2920)

    • Creates files or folders in the user directory

      • filezilla.exe (PID: 1476)
      • fzsftp.exe (PID: 1916)
      • sidebar.exe (PID: 2920)

    • Creates files in the program directory

      • sidebar.exe (PID: 2920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (47.3)
.exe | Win32 Executable MS Visual C++ (generic) (35.5)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:06:28 14:45:44+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 36352
InitializedDataSize: 5585920
UninitializedDataSize: -
EntryPoint: 0x15eb
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start noclippingbro_[unknowncheats.me]_.exe noclippingbro_[unknowncheats.me]_.exe THREAT noclippingbro_[unknowncheats.me]_.exe xmplayer.exe no specs sidebar.exe filezilla.exe no specs fzsftp.exe wmpnscfg.exe no specs noclippingbro_[unknowncheats.me]_.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
524"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
748"C:\Users\admin\Desktop\NoClippingBro_[unknowncheats.me]_.exe" C:\Users\admin\Desktop\NoClippingBro_[unknowncheats.me]_.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\noclippingbro_[unknowncheats.me]_.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1476"C:\Program Files\FileZilla FTP Client\filezilla.exe" C:\Program Files\FileZilla FTP Client\filezilla.exe—explorer.exe
User:
admin
Company:
FileZilla Project
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Version:
3, 65, 0, 0
Modules
Images
c:\program files\filezilla ftp client\filezilla.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\filezilla ftp client\libfzclient-commonui-private-3-65-0.dll
c:\program files\filezilla ftp client\libfzclient-private-3-65-0.dll
c:\program files\filezilla ftp client\libfilezilla-40.dll
c:\program files\filezilla ftp client\libgmp-10.dll
c:\windows\system32\msvcrt.dll
c:\program files\filezilla ftp client\libgcc_s_dw2-1.dll
1916"C:\Program Files\FileZilla FTP Client\fzsftp.exe" -vC:\Program Files\FileZilla FTP Client\fzsftp.exe
filezilla.exe
User:
admin
Company:
FileZilla Project
Integrity Level:
MEDIUM
Description:
SFTP module for FileZilla based on PuTTY's psftp component
Version:
Unidentified build
Modules
Images
c:\program files\filezilla ftp client\fzsftp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\filezilla ftp client\libnettle-8.dll
c:\windows\system32\msvcrt.dll
c:\program files\filezilla ftp client\libgcc_s_dw2-1.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2296"C:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\extracted\xmplayer.exe" CEAFCA1A660_30A4_40BE_AF24D4FF39135AAEC:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\extracted\xmplayer.exe—NoClippingBro_[unknowncheats.me]_.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\cetrainers\cetcc05.tmp\extracted\xmplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2920"C:\Program Files\Windows Sidebar\sidebar.exe" /showGadgetsC:\Program Files\Windows Sidebar\sidebar.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Desktop Gadgets
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows sidebar\sidebar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3060C:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\extracted\NoClippingBro_[unknowncheats.me]_.exe "C:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\admin\Desktop\"C:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\extracted\NoClippingBro_[unknowncheats.me]_.exe
NoClippingBro_[unknowncheats.me]_.exe
User:
admin
Company:
Cheat Engine
Integrity Level:
HIGH
Description:
Cheat Engine
Version:
6.4.0.4106
Modules
Images
c:\users\admin\appdata\local\temp\cetrainers\cetcc05.tmp\extracted\noclippingbro_[unknowncheats.me]_.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3256"C:\Users\admin\Desktop\NoClippingBro_[unknowncheats.me]_.exe" C:\Users\admin\Desktop\NoClippingBro_[unknowncheats.me]_.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\noclippingbro_[unknowncheats.me]_.exe
c:\windows\system32\ntdll.dll
3592"C:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\NoClippingBro_[unknowncheats.me]_.exe" -ORIGIN:"C:\Users\admin\Desktop\"C:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\NoClippingBro_[unknowncheats.me]_.exe
NoClippingBro_[unknowncheats.me]_.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\cetrainers\cetcc05.tmp\noclippingbro_[unknowncheats.me]_.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
4 172
Read events
4 140
Write events
28
Delete events
4

Modification events

(PID) Process:(3060) NoClippingBro_[unknowncheats.me]_.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3060) NoClippingBro_[unknowncheats.me]_.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3060) NoClippingBro_[unknowncheats.me]_.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3060) NoClippingBro_[unknowncheats.me]_.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3060) NoClippingBro_[unknowncheats.me]_.exeKey:HKEY_CURRENT_USER\Software\Cheat Engine\Window Positions
Operation:writeName:AdvancedOptions Position
Value:
7E010000FF0100007402000029010000
(PID) Process:(3060) NoClippingBro_[unknowncheats.me]_.exeKey:HKEY_CURRENT_USER\Software\Cheat Engine\Window Positions
Operation:writeName:frmAutoInject Position
Value:
8701000000050000AF0100004B010000
(PID) Process:(2920) sidebar.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Sidebar\Settings
Operation:writeName:ShowGadgets
Value:
1
(PID) Process:(2920) sidebar.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Sidebar
Value:
C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
(PID) Process:(2920) sidebar.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2920) sidebar.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
5
Suspicious files
4
Text files
32
Unknown types
0

Dropped files

PID
Process
Filename
Type
748NoClippingBro_[unknowncheats.me]_.exeC:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\CET_Archive.dat —
MD5:—
SHA256:—
2920sidebar.exeC:\Users\admin\AppData\Local\Microsoft\Windows Sidebar\Settings.initext
MD5:30D295030F52A72ECDA3994602164E4C
SHA256:E441993B15AF83500BE37304EADBE48CBC127CAB7D8FB531F770753FA56C4902
3592NoClippingBro_[unknowncheats.me]_.exeC:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\extracted\CET_TRAINER.CETRAINERbinary
MD5:11AB537E0F59EB5B06A8CA42259FDAEF
SHA256:D9A81673A749B2C27B1665B9B1513F517235122CDC46E4AEA31FA39BA654352F
3592NoClippingBro_[unknowncheats.me]_.exeC:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\extracted\lua5.1-32.dllexecutable
MD5:2730FF589AE86EF10D94952769F9404F
SHA256:FAF0850051BA175347E40481DA9E2CC3A122A09D428925042932BE555DB06E6B
3592NoClippingBro_[unknowncheats.me]_.exeC:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\extracted\defines.luatext
MD5:D8F9B4A10A48EBD8936255F6215C8A43
SHA256:D4347332B232622283E7DD3781F64966BD1097D06CCA7052B467CF99E62898F2
748NoClippingBro_[unknowncheats.me]_.exeC:\Users\admin\AppData\Local\Temp\cetrainers\CETCC05.tmp\NoClippingBro_[unknowncheats.me]_.exeexecutable
MD5:808DE473370EF6B5D98AB752F245A3CA
SHA256:65CBED2E8DB313B8966638E40EB27F94156C294EB060B28A02C130D146518C39
1476filezilla.exeC:\Users\admin\AppData\Roaming\FileZilla\layout.xmlxml
MD5:2C67357412FE5428D2EB67E2178925FA
SHA256:6E8BEE236C7BB6E2CD249AF7449B0F08AFCEBEBE4140CF818750E4489D570B69
1476filezilla.exeC:\Users\admin\AppData\Roaming\FileZilla\layout.xml~xml
MD5:2C67357412FE5428D2EB67E2178925FA
SHA256:6E8BEE236C7BB6E2CD249AF7449B0F08AFCEBEBE4140CF818750E4489D570B69
2920sidebar.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\8f96978fc46d9f00d8780351026924d7_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:DB733E033C397FEC5917611957620271
SHA256:1F3FFADD3B80C7F95BE06E245410768E8302A24E573868DA3C6FD91230025BDC
1476filezilla.exeC:\Users\admin\AppData\Local\FileZilla\default_localtreeview20x20.pngimage
MD5:6F1521A05994C29F5DB6711A2A56E25A
SHA256:C0B2F0998B11BFBC0D5EE0FBCA3320CC79A5AF5DF16800F7EDAAB99C7AF0949F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2564
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1916
fzsftp.exe
144.76.58.217:2022
gold.magmanode.com
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
gold.magmanode.com
  • 144.76.58.217
unknown

Threats

No threats detected
Process
Message
NoClippingBro_[unknowncheats.me]_.exe
Offset of LBR_Count=760
NoClippingBro_[unknowncheats.me]_.exe
sizeof fxstate = 512
NoClippingBro_[unknowncheats.me]_.exe
symbolloader thread finished
NoClippingBro_[unknowncheats.me]_.exe
Symbolhandler: sync: Calling finishedloadingsymbols
NoClippingBro_[unknowncheats.me]_.exe
finishedLoadingSymbols called
NoClippingBro_[unknowncheats.me]_.exe
exit finishedLoadingSymbols()
NoClippingBro_[unknowncheats.me]_.exe
after finishedloadingsymbols
NoClippingBro_[unknowncheats.me]_.exe
Symbol loader thread has finished without errors
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NoClippingBro_[unknowncheats.me]_.exe