File name:

SPAM.7z

Full analysis: https://app.any.run/tasks/b46b388c-c431-427c-984a-5af2691ffb3e
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 11:47:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
stealer
delphi
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

BFBB8576405234C7201DD921FFE3503B

SHA1:

6913E85074F255B0E66594245CC8A845673E37CB

SHA256:

8DBA826D9AFCCE08018A7FC7CA2B6EFD9293398B1C95655A85B3B4C26BCDD898

SSDEEP:

393216:z74/xMY2HbGuojrlSSKKn1BwtVKy7cC+UtGk7Eoi:fsm77Yrl1DjM0AcC+cuoi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses base64 encoding (SCRIPT)

      • wscript.exe (PID: 6972)
      • wscript.exe (PID: 5124)
      • wscript.exe (PID: 4424)
      • wscript.exe (PID: 720)
      • wscript.exe (PID: 3884)
      • wscript.exe (PID: 7872)
      • wscript.exe (PID: 2772)
      • wscript.exe (PID: 5436)
      • wscript.exe (PID: 7832)
      • wscript.exe (PID: 5328)
      • wscript.exe (PID: 7416)
      • wscript.exe (PID: 7792)
      • wscript.exe (PID: 6480)
      • wscript.exe (PID: 7052)
      • wscript.exe (PID: 4208)
      • wscript.exe (PID: 1164)
      • wscript.exe (PID: 3032)
      • wscript.exe (PID: 4892)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 6972)
      • wscript.exe (PID: 5124)
      • wscript.exe (PID: 4424)
      • wscript.exe (PID: 720)
      • wscript.exe (PID: 3884)
      • wscript.exe (PID: 2772)
      • wscript.exe (PID: 7872)
      • wscript.exe (PID: 5436)
      • wscript.exe (PID: 7832)
      • wscript.exe (PID: 5328)
      • wscript.exe (PID: 7416)
      • wscript.exe (PID: 7792)
      • wscript.exe (PID: 6480)
      • wscript.exe (PID: 4208)
      • wscript.exe (PID: 7052)
      • wscript.exe (PID: 1164)
      • wscript.exe (PID: 3032)
      • wscript.exe (PID: 4892)

    • Actions looks like stealing of personal data

      • NxfFrgEOdmrgKIrmYPJtX.exe (PID: 1276)
      • cvcYsScGklAiviuY.exe (PID: 7188)
      • BTypUdqvswLfh.exe (PID: 6820)
      • tRmwTXLHRg.exe (PID: 6416)
      • gVLlAogOOvonQYNBHHtQXkthhfIS.exe (PID: 2800)
      • yHjotMriAPjhRPgEGATKBEIAKAJI.exe (PID: 2088)
      • twWPRVnIPflCvbG.exe (PID: 6572)
      • fTUscwtysBduCM.exe (PID: 6036)
      • lwRdZCigjFAjd.exe (PID: 1672)
      • gcGtGcGrKWcwqRIJFW.exe (PID: 2560)
      • xDULXEDVXu.exe (PID: 3896)
      • LwelrjjVDdoQvWGiqxHKvftHhB.exe (PID: 7540)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • CbeSpyEHHZCQ.exe (PID: 744)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • kcQXQQWDtiSl.exe (PID: 6080)
      • UtYowOgVxUtcVdnNmLldnhrQXiMx.exe (PID: 5244)
      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)

  • SUSPICIOUS

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 6972)
      • wscript.exe (PID: 5124)
      • wscript.exe (PID: 4424)
      • wscript.exe (PID: 720)
      • wscript.exe (PID: 3884)
      • wscript.exe (PID: 7872)
      • wscript.exe (PID: 2772)
      • wscript.exe (PID: 7832)
      • wscript.exe (PID: 5436)
      • wscript.exe (PID: 5328)
      • wscript.exe (PID: 7792)
      • wscript.exe (PID: 7416)
      • wscript.exe (PID: 6480)
      • wscript.exe (PID: 4208)
      • wscript.exe (PID: 7052)
      • wscript.exe (PID: 1164)
      • wscript.exe (PID: 3032)
      • wscript.exe (PID: 4892)

    • Sets XML DOM element text (SCRIPT)

      • wscript.exe (PID: 6972)
      • wscript.exe (PID: 5124)
      • wscript.exe (PID: 4424)
      • wscript.exe (PID: 720)
      • wscript.exe (PID: 3884)
      • wscript.exe (PID: 7872)
      • wscript.exe (PID: 2772)
      • wscript.exe (PID: 5436)
      • wscript.exe (PID: 7832)
      • wscript.exe (PID: 5328)
      • wscript.exe (PID: 7416)
      • wscript.exe (PID: 7792)
      • wscript.exe (PID: 6480)
      • wscript.exe (PID: 4208)
      • wscript.exe (PID: 7052)
      • wscript.exe (PID: 1164)
      • wscript.exe (PID: 3032)
      • wscript.exe (PID: 4892)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5124)
      • wscript.exe (PID: 6972)
      • wscript.exe (PID: 4424)
      • wscript.exe (PID: 720)
      • wscript.exe (PID: 3884)
      • wscript.exe (PID: 7872)
      • wscript.exe (PID: 2772)
      • wscript.exe (PID: 5436)
      • wscript.exe (PID: 7832)
      • wscript.exe (PID: 5328)
      • wscript.exe (PID: 7416)
      • wscript.exe (PID: 7792)
      • wscript.exe (PID: 6480)
      • wscript.exe (PID: 4208)
      • wscript.exe (PID: 7052)
      • wscript.exe (PID: 3032)
      • wscript.exe (PID: 1164)
      • wscript.exe (PID: 4892)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6972)
      • wscript.exe (PID: 5124)
      • wscript.exe (PID: 4424)
      • wscript.exe (PID: 720)
      • wscript.exe (PID: 3884)
      • wscript.exe (PID: 7872)
      • wscript.exe (PID: 2772)
      • wscript.exe (PID: 5436)
      • wscript.exe (PID: 7832)
      • wscript.exe (PID: 5328)
      • wscript.exe (PID: 7416)
      • wscript.exe (PID: 7792)
      • wscript.exe (PID: 6480)
      • wscript.exe (PID: 4208)
      • wscript.exe (PID: 7052)
      • wscript.exe (PID: 1164)
      • wscript.exe (PID: 4892)
      • wscript.exe (PID: 3032)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 6972)
      • wscript.exe (PID: 5124)
      • wscript.exe (PID: 4424)
      • wscript.exe (PID: 720)
      • wscript.exe (PID: 3884)
      • wscript.exe (PID: 7872)
      • wscript.exe (PID: 2772)
      • wscript.exe (PID: 5436)
      • wscript.exe (PID: 7832)
      • wscript.exe (PID: 5328)
      • wscript.exe (PID: 7792)
      • wscript.exe (PID: 7416)
      • wscript.exe (PID: 6480)
      • wscript.exe (PID: 4208)
      • wscript.exe (PID: 7052)
      • wscript.exe (PID: 1164)
      • wscript.exe (PID: 3032)
      • wscript.exe (PID: 4892)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 5124)
      • wscript.exe (PID: 6972)
      • wscript.exe (PID: 4424)
      • wscript.exe (PID: 720)
      • wscript.exe (PID: 3884)
      • wscript.exe (PID: 7872)
      • wscript.exe (PID: 2772)
      • wscript.exe (PID: 5436)
      • wscript.exe (PID: 7832)
      • wscript.exe (PID: 5328)
      • wscript.exe (PID: 7792)
      • wscript.exe (PID: 7416)
      • wscript.exe (PID: 6480)
      • wscript.exe (PID: 4208)
      • wscript.exe (PID: 7052)
      • wscript.exe (PID: 1164)
      • wscript.exe (PID: 3032)
      • wscript.exe (PID: 4892)

    • Likely accesses (executes) a file from the Public directory

      • NxfFrgEOdmrgKIrmYPJtX.exe (PID: 1276)
      • cvcYsScGklAiviuY.exe (PID: 7188)
      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • UtYowOgVxUtcVdnNmLldnhrQXiMx.exe (PID: 5244)
      • CbeSpyEHHZCQ.exe (PID: 744)
      • kcQXQQWDtiSl.exe (PID: 6080)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • xDULXEDVXu.exe (PID: 3896)
      • LwelrjjVDdoQvWGiqxHKvftHhB.exe (PID: 7540)
      • gcGtGcGrKWcwqRIJFW.exe (PID: 2560)
      • lwRdZCigjFAjd.exe (PID: 1672)
      • fTUscwtysBduCM.exe (PID: 6036)
      • twWPRVnIPflCvbG.exe (PID: 6572)
      • yHjotMriAPjhRPgEGATKBEIAKAJI.exe (PID: 2088)
      • gVLlAogOOvonQYNBHHtQXkthhfIS.exe (PID: 2800)
      • BTypUdqvswLfh.exe (PID: 6820)
      • tRmwTXLHRg.exe (PID: 6416)

    • Checks for external IP

      • NxfFrgEOdmrgKIrmYPJtX.exe (PID: 1276)
      • cvcYsScGklAiviuY.exe (PID: 7188)
      • svchost.exe (PID: 2196)
      • BTypUdqvswLfh.exe (PID: 6820)
      • tRmwTXLHRg.exe (PID: 6416)
      • gVLlAogOOvonQYNBHHtQXkthhfIS.exe (PID: 2800)
      • yHjotMriAPjhRPgEGATKBEIAKAJI.exe (PID: 2088)
      • lwRdZCigjFAjd.exe (PID: 1672)
      • twWPRVnIPflCvbG.exe (PID: 6572)
      • fTUscwtysBduCM.exe (PID: 6036)
      • LwelrjjVDdoQvWGiqxHKvftHhB.exe (PID: 7540)
      • gcGtGcGrKWcwqRIJFW.exe (PID: 2560)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • kcQXQQWDtiSl.exe (PID: 6080)
      • UtYowOgVxUtcVdnNmLldnhrQXiMx.exe (PID: 5244)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • CbeSpyEHHZCQ.exe (PID: 744)
      • xDULXEDVXu.exe (PID: 3896)
      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)

    • There is functionality for taking screenshot (YARA)

      • NxfFrgEOdmrgKIrmYPJtX.exe (PID: 1276)
      • cvcYsScGklAiviuY.exe (PID: 7188)
      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • UtYowOgVxUtcVdnNmLldnhrQXiMx.exe (PID: 5244)
      • kcQXQQWDtiSl.exe (PID: 6080)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • CbeSpyEHHZCQ.exe (PID: 744)
      • xDULXEDVXu.exe (PID: 3896)
      • LwelrjjVDdoQvWGiqxHKvftHhB.exe (PID: 7540)
      • gcGtGcGrKWcwqRIJFW.exe (PID: 2560)
      • lwRdZCigjFAjd.exe (PID: 1672)
      • fTUscwtysBduCM.exe (PID: 6036)
      • twWPRVnIPflCvbG.exe (PID: 6572)
      • BTypUdqvswLfh.exe (PID: 6820)
      • yHjotMriAPjhRPgEGATKBEIAKAJI.exe (PID: 2088)
      • gVLlAogOOvonQYNBHHtQXkthhfIS.exe (PID: 2800)
      • tRmwTXLHRg.exe (PID: 6416)

    • Connects to unusual port

      • NxfFrgEOdmrgKIrmYPJtX.exe (PID: 1276)
      • cvcYsScGklAiviuY.exe (PID: 7188)
      • BTypUdqvswLfh.exe (PID: 6820)
      • tRmwTXLHRg.exe (PID: 6416)
      • gVLlAogOOvonQYNBHHtQXkthhfIS.exe (PID: 2800)
      • yHjotMriAPjhRPgEGATKBEIAKAJI.exe (PID: 2088)
      • twWPRVnIPflCvbG.exe (PID: 6572)
      • lwRdZCigjFAjd.exe (PID: 1672)
      • fTUscwtysBduCM.exe (PID: 6036)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • xDULXEDVXu.exe (PID: 3896)
      • LwelrjjVDdoQvWGiqxHKvftHhB.exe (PID: 7540)
      • gcGtGcGrKWcwqRIJFW.exe (PID: 2560)
      • CbeSpyEHHZCQ.exe (PID: 744)
      • kcQXQQWDtiSl.exe (PID: 6080)
      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)
      • UtYowOgVxUtcVdnNmLldnhrQXiMx.exe (PID: 5244)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)

    • There is functionality for communication over UDP network (YARA)

      • NxfFrgEOdmrgKIrmYPJtX.exe (PID: 1276)
      • cvcYsScGklAiviuY.exe (PID: 7188)
      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • UtYowOgVxUtcVdnNmLldnhrQXiMx.exe (PID: 5244)
      • kcQXQQWDtiSl.exe (PID: 6080)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • CbeSpyEHHZCQ.exe (PID: 744)
      • xDULXEDVXu.exe (PID: 3896)
      • LwelrjjVDdoQvWGiqxHKvftHhB.exe (PID: 7540)
      • gcGtGcGrKWcwqRIJFW.exe (PID: 2560)
      • lwRdZCigjFAjd.exe (PID: 1672)
      • fTUscwtysBduCM.exe (PID: 6036)
      • twWPRVnIPflCvbG.exe (PID: 6572)
      • BTypUdqvswLfh.exe (PID: 6820)
      • yHjotMriAPjhRPgEGATKBEIAKAJI.exe (PID: 2088)
      • gVLlAogOOvonQYNBHHtQXkthhfIS.exe (PID: 2800)
      • tRmwTXLHRg.exe (PID: 6416)

    • Read disk information to detect sandboxing environments

      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • tRmwTXLHRg.exe (PID: 6416)

    • Reads the date of Windows installation

      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • tRmwTXLHRg.exe (PID: 6416)

  • INFO

    • Manual execution by a user

      • wscript.exe (PID: 5124)
      • wscript.exe (PID: 6972)
      • WinRAR.exe (PID: 4120)
      • wscript.exe (PID: 720)
      • wscript.exe (PID: 4424)
      • wscript.exe (PID: 7872)
      • wscript.exe (PID: 3884)
      • wscript.exe (PID: 2772)
      • wscript.exe (PID: 5436)
      • wscript.exe (PID: 7832)
      • wscript.exe (PID: 5328)
      • wscript.exe (PID: 7792)
      • wscript.exe (PID: 7416)
      • wscript.exe (PID: 6480)
      • wscript.exe (PID: 4208)
      • wscript.exe (PID: 7052)
      • wscript.exe (PID: 3032)
      • wscript.exe (PID: 1164)
      • wscript.exe (PID: 4892)

    • Reads the software policy settings

      • SIHClient.exe (PID: 7408)
      • NxfFrgEOdmrgKIrmYPJtX.exe (PID: 1276)
      • cvcYsScGklAiviuY.exe (PID: 7188)
      • BTypUdqvswLfh.exe (PID: 6820)
      • tRmwTXLHRg.exe (PID: 6416)
      • gVLlAogOOvonQYNBHHtQXkthhfIS.exe (PID: 2800)
      • yHjotMriAPjhRPgEGATKBEIAKAJI.exe (PID: 2088)
      • lwRdZCigjFAjd.exe (PID: 1672)
      • gcGtGcGrKWcwqRIJFW.exe (PID: 2560)
      • twWPRVnIPflCvbG.exe (PID: 6572)
      • fTUscwtysBduCM.exe (PID: 6036)
      • LwelrjjVDdoQvWGiqxHKvftHhB.exe (PID: 7540)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • xDULXEDVXu.exe (PID: 3896)
      • CbeSpyEHHZCQ.exe (PID: 744)
      • slui.exe (PID: 7900)
      • kcQXQQWDtiSl.exe (PID: 6080)
      • UtYowOgVxUtcVdnNmLldnhrQXiMx.exe (PID: 5244)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)

    • The sample compiled with english language support

      • wscript.exe (PID: 6972)
      • wscript.exe (PID: 720)
      • wscript.exe (PID: 2772)
      • wscript.exe (PID: 5436)
      • wscript.exe (PID: 4892)

    • Checks supported languages

      • cvcYsScGklAiviuY.exe (PID: 7188)
      • NxfFrgEOdmrgKIrmYPJtX.exe (PID: 1276)
      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • UtYowOgVxUtcVdnNmLldnhrQXiMx.exe (PID: 5244)
      • kcQXQQWDtiSl.exe (PID: 6080)
      • CbeSpyEHHZCQ.exe (PID: 744)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • xDULXEDVXu.exe (PID: 3896)
      • LwelrjjVDdoQvWGiqxHKvftHhB.exe (PID: 7540)
      • gcGtGcGrKWcwqRIJFW.exe (PID: 2560)
      • lwRdZCigjFAjd.exe (PID: 1672)
      • fTUscwtysBduCM.exe (PID: 6036)
      • twWPRVnIPflCvbG.exe (PID: 6572)
      • yHjotMriAPjhRPgEGATKBEIAKAJI.exe (PID: 2088)
      • gVLlAogOOvonQYNBHHtQXkthhfIS.exe (PID: 2800)
      • BTypUdqvswLfh.exe (PID: 6820)
      • tRmwTXLHRg.exe (PID: 6416)

    • Reads the computer name

      • cvcYsScGklAiviuY.exe (PID: 7188)
      • NxfFrgEOdmrgKIrmYPJtX.exe (PID: 1276)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)
      • UtYowOgVxUtcVdnNmLldnhrQXiMx.exe (PID: 5244)
      • kcQXQQWDtiSl.exe (PID: 6080)
      • CbeSpyEHHZCQ.exe (PID: 744)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • xDULXEDVXu.exe (PID: 3896)
      • LwelrjjVDdoQvWGiqxHKvftHhB.exe (PID: 7540)
      • gcGtGcGrKWcwqRIJFW.exe (PID: 2560)
      • fTUscwtysBduCM.exe (PID: 6036)
      • lwRdZCigjFAjd.exe (PID: 1672)
      • twWPRVnIPflCvbG.exe (PID: 6572)
      • yHjotMriAPjhRPgEGATKBEIAKAJI.exe (PID: 2088)
      • gVLlAogOOvonQYNBHHtQXkthhfIS.exe (PID: 2800)
      • BTypUdqvswLfh.exe (PID: 6820)
      • tRmwTXLHRg.exe (PID: 6416)

    • Checks proxy server information

      • NxfFrgEOdmrgKIrmYPJtX.exe (PID: 1276)
      • cvcYsScGklAiviuY.exe (PID: 7188)
      • BTypUdqvswLfh.exe (PID: 6820)
      • tRmwTXLHRg.exe (PID: 6416)
      • gVLlAogOOvonQYNBHHtQXkthhfIS.exe (PID: 2800)
      • yHjotMriAPjhRPgEGATKBEIAKAJI.exe (PID: 2088)
      • twWPRVnIPflCvbG.exe (PID: 6572)
      • fTUscwtysBduCM.exe (PID: 6036)
      • lwRdZCigjFAjd.exe (PID: 1672)
      • gcGtGcGrKWcwqRIJFW.exe (PID: 2560)
      • xDULXEDVXu.exe (PID: 3896)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • LwelrjjVDdoQvWGiqxHKvftHhB.exe (PID: 7540)
      • CbeSpyEHHZCQ.exe (PID: 744)
      • slui.exe (PID: 7900)
      • kcQXQQWDtiSl.exe (PID: 6080)
      • UtYowOgVxUtcVdnNmLldnhrQXiMx.exe (PID: 5244)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)

    • Compiled with Borland Delphi (YARA)

      • NxfFrgEOdmrgKIrmYPJtX.exe (PID: 1276)
      • cvcYsScGklAiviuY.exe (PID: 7188)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)
      • UtYowOgVxUtcVdnNmLldnhrQXiMx.exe (PID: 5244)
      • kcQXQQWDtiSl.exe (PID: 6080)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • CbeSpyEHHZCQ.exe (PID: 744)
      • xDULXEDVXu.exe (PID: 3896)
      • LwelrjjVDdoQvWGiqxHKvftHhB.exe (PID: 7540)
      • gcGtGcGrKWcwqRIJFW.exe (PID: 2560)
      • lwRdZCigjFAjd.exe (PID: 1672)
      • fTUscwtysBduCM.exe (PID: 6036)
      • twWPRVnIPflCvbG.exe (PID: 6572)
      • yHjotMriAPjhRPgEGATKBEIAKAJI.exe (PID: 2088)
      • gVLlAogOOvonQYNBHHtQXkthhfIS.exe (PID: 2800)
      • BTypUdqvswLfh.exe (PID: 6820)
      • tRmwTXLHRg.exe (PID: 6416)

    • Reads Environment values

      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • tRmwTXLHRg.exe (PID: 6416)

    • Reads product name

      • fecoPoEfLdNXkEBIBgYntCW.exe (PID: 7748)
      • gZkGComOTZVWXkNUiUURKZqDH.exe (PID: 7608)
      • gqGtkuWbjkUxuNxtGo.exe (PID: 7852)
      • tRmwTXLHRg.exe (PID: 6416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2025:03:24 02:13:08+00:00
ArchivedFileName: VER_006764817_2025-24-05-44202007_86580124F6N.vbs
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
184
Monitored processes
46
Malicious processes
37
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sihclient.exe winrar.exe no specs rundll32.exe no specs wscript.exe no specs wscript.exe no specs nxffrgeodmrgkirmypjtx.exe cvcysscgklaiviuy.exe wscript.exe no specs wscript.exe no specs fecopoefldnxkebibgyntcw.exe gzkgcomotzvwxknuiuurkzqdh.exe wscript.exe no specs slui.exe wscript.exe no specs utyowogvxutcvdnnmlldnhrqximx.exe wscript.exe no specs kcqxqqwdtisl.exe wscript.exe no specs cbespyehhzcq.exe wscript.exe no specs gqgtkuwbjkuxunxtgo.exe wscript.exe no specs xdulxedvxu.exe wscript.exe no specs lwelrjjvddoqvwgiqxhkvfthhb.exe wscript.exe no specs gcgtgcgrkwcwqrijfw.exe wscript.exe no specs lwrdzcigjfajd.exe wscript.exe no specs ftuscwtysbducm.exe wscript.exe no specs twwprvnipflcvbg.exe yhjotmriapjhrpgegatkbeiakaji.exe wscript.exe no specs wscript.exe no specs gvllaogoovonqynbhhtqxkthhfis.exe wscript.exe no specs btypudqvswlfh.exe trmwtxlhrg.exe ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\Desktop\SPAM\VER_041159253_2025-24-05-1113564896_2052T7H4.vbs" C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
744"C:\Users\Public\CbeSpyEHHZCQ.exe" C:\Users\Public\CbeSpyEHHZCQ.exe
wscript.exe
User:
admin
Company:
CloudBridge Solutions 8624285 Inc.
Integrity Level:
MEDIUM
Description:
Advanced Data Protection Management 8624285, 35817.23513.13747.61906, Y242.
Version:
35817.23513.13747.61906
Modules
Images
c:\users\public\cbespyehhzcq.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll
1164"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\Desktop\SPAM\VER_44203466585_2025-24-05-6430590109_7338057XR26.vbs" C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1276"C:\Users\Public\NxfFrgEOdmrgKIrmYPJtX.exe" C:\Users\Public\NxfFrgEOdmrgKIrmYPJtX.exe
wscript.exe
User:
admin
Company:
CloudBridge Solutions 437756 Inc.
Integrity Level:
MEDIUM
Description:
Advanced Data Protection Management 437756, 49590.13709.32418.30035, I821.
Exit code:
0
Version:
49590.13709.32418.30035
Modules
Images
c:\users\public\nxffrgeodmrgkirmypjtx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll
1672"C:\Users\Public\lwRdZCigjFAjd.exe" C:\Users\Public\lwRdZCigjFAjd.exe
wscript.exe
User:
admin
Company:
CloudBridge Solutions 4596154 Inc.
Integrity Level:
MEDIUM
Description:
Advanced Data Protection Management 4596154, 18735.63608.52600.57062, I404.
Version:
18735.63608.52600.57062
Modules
Images
c:\users\public\lwrdzcigjfajd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll
2088"C:\Users\Public\yHjotMriAPjhRPgEGATKBEIAKAJI.exe" C:\Users\Public\yHjotMriAPjhRPgEGATKBEIAKAJI.exe
wscript.exe
User:
admin
Company:
CloudBridge Solutions 0730194 Inc.
Integrity Level:
MEDIUM
Description:
Advanced Data Protection Management 0730194, 31086.26765.11881.17806, R739.
Version:
31086.26765.11881.17806
Modules
Images
c:\users\public\yhjotmriapjhrpgegatkbeiakaji.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2560"C:\Users\Public\gcGtGcGrKWcwqRIJFW.exe" C:\Users\Public\gcGtGcGrKWcwqRIJFW.exe
wscript.exe
User:
admin
Company:
CloudBridge Solutions 3051868 Inc.
Integrity Level:
MEDIUM
Description:
Advanced Data Protection Management 3051868, 13001.55083.42695.44047, R807.
Version:
13001.55083.42695.44047
Modules
Images
c:\users\public\gcgtgcgrkwcwqrijfw.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll
2772"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\Desktop\SPAM\VER_081313490_2025-24-05-86712836_7756601174.vbs" C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2800"C:\Users\Public\gVLlAogOOvonQYNBHHtQXkthhfIS.exe" C:\Users\Public\gVLlAogOOvonQYNBHHtQXkthhfIS.exe
wscript.exe
User:
admin
Company:
CloudBridge Solutions 5807457 Inc.
Integrity Level:
MEDIUM
Description:
Advanced Data Protection Management 5807457, 16433.52435.45617.60111, Y282.
Version:
16433.52435.45617.60111
Modules
Images
c:\users\public\gvllaogoovonqynbhhtqxkthhfis.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll
Total events
42 853
Read events
42 819
Write events
34
Delete events
0

Modification events

(PID) Process:(8100) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(8100) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(8100) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(8100) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\SPAM.7z
(PID) Process:(8100) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(8100) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(8100) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(8100) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7408) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Expires
Value:
2025-03-26 11:48:11
(PID) Process:(7408) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:LastModified
Value:
2001-01-01 00:00:00
Executable files
0
Suspicious files
24
Text files
37
Unknown types
0

Dropped files

PID
Process
Filename
Type
4120WinRAR.exeC:\Users\admin\Desktop\SPAM\VER_04721852_2025-24-05-5145244081_60896ZA39Q5.vbstext
MD5:6C8D9DB6D5CE33A9A66358071B88461C
SHA256:6DD776C16C704ABED1E6AE6FF3848690B5B3E28B4180875238F0C1308F023AAC
4120WinRAR.exeC:\Users\admin\Desktop\SPAM\VER_006764817_2025-24-05-44202007_86580124F6N.vbstext
MD5:93DDC8B7838A14C96843C1A1BDB6CDF4
SHA256:D6E823FA5D81B3878F04BCBAF4FAD22279BC8E8C872A3F77323CAF265A282C43
7408SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E94643DE99F5621BC288D045BEA85DDbinary
MD5:B69C738C71C947FD12B66D6319DF84A5
SHA256:5582F1CB870F1C1801E659399C2295CB131E180893A6E54FC992B0DCD2FB88A2
7408SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\51867C3735CFAECCDB556E146BB12C28binary
MD5:F6E0F40130BB0E42121D40A03EE56ADA
SHA256:C3541DE3AE73D6B440B237548B8ABE7528833DC9A2CBB57621EFD87585AD1DFE
7408SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\51867C3735CFAECCDB556E146BB12C28binary
MD5:C9F83563ECF15CF675A4207F4FBD5524
SHA256:84AAF3B97C1E91817DF5EE7C854B8D43221EC57BC58AC2670007D369F8A890F4
4120WinRAR.exeC:\Users\admin\Desktop\SPAM\VER_041159253_2025-24-05-1113564896_2052T7H4.vbstext
MD5:C8EE509A00416DEAFAFA9E2A6EFAB5D5
SHA256:4A71A5F71BFC9C8AFBE5A5346BCEE5D798FF1200BCB33F410082768A44C96CE7
6972wscript.exeC:\Users\Public\JXGFSJrsmni5H8BAB0Z420Y3NDKNMSyravs.yls —
MD5:—
SHA256:—
4120WinRAR.exeC:\Users\admin\Desktop\SPAM\VER_071167030_2025-24-05-735831680_0959H650.vbstext
MD5:CFB4EAC44E7284B5B35D0D7560FE7EDE
SHA256:F8DBAF0FBCAA27D782B25802573D0D029EF76CA4CBAC97E2A0D4C0C586C5071B
6972wscript.exeC:\Users\Public\NxfFrgEOdmrgKIrmYPJtX.exe —
MD5:—
SHA256:—
4120WinRAR.exeC:\Users\admin\Desktop\SPAM\VER_1151366825_2025-24-05-49588327960_5044GO2G7X.vbstext
MD5:ED86DE2D0452CD86A62008F2C208E9B2
SHA256:AE471E8035D65784507DCB6FF5A1904A571664A33334962927AA6D6A190D7F57
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
113
TCP/UDP connections
188
DNS requests
24
Threats
228

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7804
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7408
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7408
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1276
NxfFrgEOdmrgKIrmYPJtX.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
whitelisted
1276
NxfFrgEOdmrgKIrmYPJtX.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
whitelisted
1276
NxfFrgEOdmrgKIrmYPJtX.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
whitelisted
1276
NxfFrgEOdmrgKIrmYPJtX.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
whitelisted
1276
NxfFrgEOdmrgKIrmYPJtX.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7804
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7804
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7408
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
login.live.com
  • 40.126.31.1
  • 40.126.31.128
  • 40.126.31.129
  • 20.190.159.71
  • 40.126.31.73
  • 40.126.31.2
  • 20.190.159.64
  • 20.190.159.128
  • 40.126.31.69
  • 40.126.31.130
  • 40.126.31.131
  • 20.190.159.130
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
1276
NxfFrgEOdmrgKIrmYPJtX.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (Clever Internet Suite)
1276
NxfFrgEOdmrgKIrmYPJtX.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
1276
NxfFrgEOdmrgKIrmYPJtX.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (Clever Internet Suite)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
1276
NxfFrgEOdmrgKIrmYPJtX.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
1276
NxfFrgEOdmrgKIrmYPJtX.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (Clever Internet Suite)
1276
NxfFrgEOdmrgKIrmYPJtX.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
1276
NxfFrgEOdmrgKIrmYPJtX.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
1276
NxfFrgEOdmrgKIrmYPJtX.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (Clever Internet Suite)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SPAM.7z