Windows Analysis Report
zyx3qItgQK.exe

Machine Learning detection for dropped file

Source: Yara match	File source: zyx3qItgQK.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zyx3qItgQK.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4507767686.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zyx3qItgQK.exe PID: 5576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ESET Service.exe PID: 5872, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED
Source: Yara match	File source: C:\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, type: DROPPED

Source: C:\svchost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: zyx3qItgQK.exe

Joe Sandbox ML: detected

Source: zyx3qItgQK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\zyx3qItgQK.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Creates autorun.inf (USB autostart)

Source: zyx3qItgQK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

File created: C:\autorun.inf

Snort IDS alert for network traffic

Source: zyx3qItgQK.exe, 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: zyx3qItgQK.exe, 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: zyx3qItgQK.exe, 00000000.00000002.2120098959.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: zyx3qItgQK.exe, 00000000.00000002.2120098959.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: zyx3qItgQK.exe	Binary or memory string: autorun.inf
Source: zyx3qItgQK.exe	Binary or memory string: [autorun]
Source: autorun.inf.2.dr	Binary or memory string: [autorun]
Source: svchost.exe.2.dr	Binary or memory string: autorun.inf
Source: svchost.exe.2.dr	Binary or memory string: [autorun]
Source: 7891fdab3e9ec8884436ba440a809c8a.exe.2.dr	Binary or memory string: autorun.inf
Source: 7891fdab3e9ec8884436ba440a809c8a.exe.2.dr	Binary or memory string: [autorun]
Source: ESET Service.exe.0.dr	Binary or memory string: autorun.inf
Source: ESET Service.exe.0.dr	Binary or memory string: [autorun]

Networking

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.6:49699 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.6:49699 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.6:49699 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.6:49699 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.6:49699 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.6:49707 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.6:49707 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.6:49707 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.6:49707 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.6:49707 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.6:49710 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.6:49710 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.6:49710 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.6:49710 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.6:49711 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.6:49711 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.6:49711 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.6:49711 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.6:49711 -> 3.69.115.178:12041
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.6:49712 -> 18.197.239.109:12041
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.6:49712 -> 18.197.239.109:12041
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.6:49712 -> 18.197.239.109:12041
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.6:49712 -> 18.197.239.109:12041
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.6:49712 -> 18.197.239.109:12041
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.6:49713 -> 18.197.239.109:12041
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.6:49713 -> 18.197.239.109:12041
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.6:49713 -> 18.197.239.109:12041
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.6:49713 -> 18.197.239.109:12041
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.6:49714 -> 3.68.171.119:12041
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.6:49714 -> 3.68.171.119:12041
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.6:49714 -> 3.68.171.119:12041
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.6:49714 -> 3.68.171.119:12041
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.6:49714 -> 3.68.171.119:12041
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.6:49715 -> 3.68.171.119:12041
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.6:49715 -> 3.68.171.119:12041
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.6:49715 -> 3.68.171.119:12041
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.6:49715 -> 3.68.171.119:12041

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 6.tcp.eu.ngrok.io

Source: global traffic	TCP traffic: 192.168.2.6:49699 -> 3.69.115.178:12041
Source: global traffic	TCP traffic: 192.168.2.6:49712 -> 18.197.239.109:12041
Source: global traffic	TCP traffic: 192.168.2.6:49714 -> 3.68.171.119:12041

Source: Joe Sandbox View	IP Address: 18.197.239.109 18.197.239.109
Source: Joe Sandbox View	IP Address: 3.69.115.178 3.69.115.178
Source: Joe Sandbox View	IP Address: 3.68.171.119 3.68.171.119

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: 6.tcp.eu.ngrok.io

Source: zyx3qItgQK.exe, svchost.exe.2.dr, 7891fdab3e9ec8884436ba440a809c8a.exe.2.dr, ESET Service.exe.0.dr

String found in binary or memory: https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: zyx3qItgQK.exe, kl.cs	.Net Code: VKCodeToUnicode
Source: ESET Service.exe.0.dr, kl.cs	.Net Code: VKCodeToUnicode
Source: 7891fdab3e9ec8884436ba440a809c8a.exe.2.dr, kl.cs	.Net Code: VKCodeToUnicode
Source: svchost.exe.2.dr, kl.cs	.Net Code: VKCodeToUnicode

E-Banking Fraud

Protects its processes via BreakOnTermination flag

Source: Yara match	File source: zyx3qItgQK.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zyx3qItgQK.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4507767686.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zyx3qItgQK.exe PID: 5576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ESET Service.exe PID: 5872, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED
Source: Yara match	File source: C:\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, type: DROPPED

Operating System Destruction

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

Process information set: 01 00 00 00

Malicious sample detected (through community Yara rule)

System Summary

Source: zyx3qItgQK.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: zyx3qItgQK.exe, type: SAMPLE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: zyx3qItgQK.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.zyx3qItgQK.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.zyx3qItgQK.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.zyx3qItgQK.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\svchost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\svchost.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\svchost.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Code function: 2_2_04C90346 NtQuerySystemInformation,	2_2_04C90346
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Code function: 2_2_04C9010E NtSetInformationProcess,	2_2_04C9010E
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Code function: 2_2_04C900EC NtSetInformationProcess,	2_2_04C900EC
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Code function: 2_2_04C9030B NtQuerySystemInformation,	2_2_04C9030B

Source: zyx3qItgQK.exe, 00000000.00000002.2119808718.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs zyx3qItgQK.exe

Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: zyx3qItgQK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: zyx3qItgQK.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: zyx3qItgQK.exe, type: SAMPLE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: zyx3qItgQK.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.zyx3qItgQK.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.zyx3qItgQK.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.zyx3qItgQK.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\svchost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\svchost.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\svchost.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.spre.troj.adwa.spyw.evad.winEXE@12/10@4/3

Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Code function: 2_2_00A8BDA2 AdjustTokenPrivileges,		2_2_00A8BDA2
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Code function: 2_2_00A8BD6B AdjustTokenPrivileges,		2_2_00A8BD6B

Source: C:\Users\user\Desktop\zyx3qItgQK.exe

File created: C:\Users\user\AppData\Roaming\ESET Service.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6708:120:WilError_03
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Mutant created: \Sessions\1\BaseNamedObjects\7891fdab3e9ec8884436ba440a809c8a
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3536:120:WilError_03

Source: zyx3qItgQK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: zyx3qItgQK.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "taskmgr.exe")

Source: C:\Users\user\Desktop\zyx3qItgQK.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\zyx3qItgQK.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: zyx3qItgQK.exe

ReversingLabs: Detection: 97%

Source: C:\Users\user\Desktop\zyx3qItgQK.exe

File read: C:\Users\user\Desktop\zyx3qItgQK.exe

Source: unknown	Process created: C:\Users\user\Desktop\zyx3qItgQK.exe C:\Users\user\Desktop\zyx3qItgQK.exe
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe"
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\ESET Service.exe" "ESET Service.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM taskmgr.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\ESET Service.exe" "ESET Service.exe" ENABLE	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM taskmgr.exe	Jump to behavior

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: zyx3qItgQK.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\zyx3qItgQK.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

.NET source code contains potential unpacker

Source: zyx3qItgQK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: zyx3qItgQK.exe, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: ESET Service.exe.0.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 7891fdab3e9ec8884436ba440a809c8a.exe.2.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: svchost.exe.2.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

Code function: 2_2_010631E4 push FFFFFFE8h; iretd

2_2_010631ED

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

File created: C:\svchost.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\ESET Service.exe	File created: C:\svchost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe	Jump to dropped file
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	File created: C:\Users\user\AppData\Roaming\ESET Service.exe	Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7891fdab3e9ec8884436ba440a809c8a

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe

Source: C:\Users\user\AppData\Roaming\ESET Service.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7891fdab3e9ec8884436ba440a809c8a	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7891fdab3e9ec8884436ba440a809c8a	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 7891fdab3e9ec8884436ba440a809c8a	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 7891fdab3e9ec8884436ba440a809c8a	Jump to behavior

Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Memory allocated: E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Memory allocated: 2F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Memory allocated: 1230000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: 2B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: E80000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: 1510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: 3190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: 5190000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: 1690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: 1690000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: 9C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: 2710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Memory allocated: A30000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\zyx3qItgQK.exe

Code function: 0_2_0131000C rdtsc

0_2_0131000C

Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Window / User API: threadDelayed 3214	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Window / User API: threadDelayed 934	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Window / User API: threadDelayed 4219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Window / User API: foregroundWindowGot 458	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Window / User API: foregroundWindowGot 1254	Jump to behavior

Source: C:\Users\user\Desktop\zyx3qItgQK.exe TID: 3660	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe TID: 5844	Thread sleep time: -934000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe TID: 5844	Thread sleep time: -4219000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe TID: 4396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe TID: 3652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe TID: 6460	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\zyx3qItgQK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: zyx3qItgQK.exe, 00000000.00000002.2119808718.0000000000F0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: zyx3qItgQK.exe, 00000000.00000002.2119808718.0000000000F0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: netsh.exe, 00000003.00000003.2187308440.00000000008C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll?
Source: ESET Service.exe, 00000002.00000002.4507512114.0000000000CF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\zyx3qItgQK.exe

Code function: 0_2_0131000C rdtsc

0_2_0131000C

Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\zyx3qItgQK.exe

Memory allocated: page read and write | page guard

.NET source code references suspicious native API functions

HIPS / PFW / Operating System Protection Evasion

Source: zyx3qItgQK.exe, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: zyx3qItgQK.exe, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: zyx3qItgQK.exe, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Uses taskkill to terminate AV processes

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM taskmgr.exe

Source: C:\Users\user\Desktop\zyx3qItgQK.exe

Process created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe"

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM taskmgr.exe

Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002DA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Ll\
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000002.00000002.4507767686.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000002.00000002.4507767686.0000000002DA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Llh
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000002.00000002.4507767686.0000000003094000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000002.00000002.4507767686.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@9Ll
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.LlL
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Lll
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Ll,
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.LlQ
Source: ESET Service.exe, 00000002.00000002.4507512114.0000000000CF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Rh Program Manager,
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000002.00000002.4507767686.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000002.00000002.4507767686.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program manager
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000002.00000002.4507767686.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000002.00000002.4507767686.0000000002DA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Ll
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000002.00000002.4507767686.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.LlhA
Source: ESET Service.exe, 00000002.00000002.4507767686.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Lll%

Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ESET Service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Modifies the windows firewall

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\ESET Service.exe" "ESET Service.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Roaming\ESET Service.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\ESET Service.exe" "ESET Service.exe" ENABLE

Stealing of Sensitive Information

Source: Yara match	File source: zyx3qItgQK.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zyx3qItgQK.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4507767686.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zyx3qItgQK.exe PID: 5576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ESET Service.exe PID: 5872, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED
Source: Yara match	File source: C:\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, type: DROPPED

Remote Access Functionality

Source: Yara match	File source: zyx3qItgQK.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zyx3qItgQK.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4507767686.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zyx3qItgQK.exe PID: 5576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ESET Service.exe PID: 5872, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED
Source: Yara match	File source: C:\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	11 Replication Through Removable Media	1 Windows Management Instrumentation	221 Registry Run Keys / Startup Folder	1 Access Token Manipulation	11 Masquerading	1 Input Capture	111 Security Software Discovery	Remote Services	1 Input Capture	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	12 Process Injection	311 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	221 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
zyx3qItgQK.exe	97%	ReversingLabs	ByteCode-MSIL.Backdoor.Ratenjay
zyx3qItgQK.exe	100%	Avira	TR/ATRAPS.Gen
zyx3qItgQK.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\svchost.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Roaming\ESET Service.exe	100%	Avira	TR/ATRAPS.Gen
C:\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ESET Service.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ESET Service.exe	97%	ReversingLabs	ByteCode-MSIL.Backdoor.Ratenjay
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe	97%	ReversingLabs	ByteCode-MSIL.Backdoor.Ratenjay
C:\svchost.exe	97%	ReversingLabs	ByteCode-MSIL.Backdoor.Ratenjay

Source	Detection	Scanner	Label	Link
6.tcp.eu.ngrok.io	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
6.tcp.eu.ngrok.io	3.69.115.178	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
6.tcp.eu.ngrok.io	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0	zyx3qItgQK.exe, svchost.exe.2.dr, 7891fdab3e9ec8884436ba440a809c8a.exe.2.dr, ESET Service.exe.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.197.239.109	unknown	United States	16509	AMAZON-02US	true
3.69.115.178	6.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true
3.68.171.119	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1384274
Start date and time:	2024-01-31 18:01:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zyx3qItgQK.exe renamed because original name is a hash value
Original Sample Name:	1D641A341DF0631BF135F5767440DF01.exe
Detection:	MAL
Classification:	mal100.spre.troj.adwa.spyw.evad.winEXE@12/10@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 206 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: zyx3qItgQK.exe

Simulations

Behavior and APIs

Time	Type	Description
18:02:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7891fdab3e9ec8884436ba440a809c8a "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
18:02:14	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run 7891fdab3e9ec8884436ba440a809c8a "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
18:02:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7891fdab3e9ec8884436ba440a809c8a "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
18:02:32	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe
18:02:37	API Interceptor	119976x Sleep call for process: ESET Service.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
18.197.239.109	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse
	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse
	30b4CoDmKk.exe	Get hash	malicious	Njrat	Browse
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse
	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse
	bRxR.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	ZuXcnAYgVp.exe	Get hash	malicious	Njrat	Browse
	d09l64ZAW6.exe	Get hash	malicious	Njrat	Browse
	8AKGdJOQ8N.exe	Get hash	malicious	Njrat	Browse
3.69.115.178	ziTLBa3N50.exe	Get hash	malicious	Njrat	Browse
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse
	myidJB8lDL.exe	Get hash	malicious	Njrat	Browse
	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse
	30b4CoDmKk.exe	Get hash	malicious	Njrat	Browse
	QsKtlzYaKF.exe	Get hash	malicious	Njrat	Browse
	xZLQ8X9Cxo.exe	Get hash	malicious	Njrat	Browse
	sCXwkZrcZ3.exe	Get hash	malicious	Njrat	Browse
	wiUnP1h5Ex.exe	Get hash	malicious	Njrat	Browse
	d09l64ZAW6.exe	Get hash	malicious	Njrat	Browse
3.68.171.119	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse
	m5l9v13hIi.exe	Get hash	malicious	Njrat	Browse
	sCXwkZrcZ3.exe	Get hash	malicious	Njrat	Browse
	X5eo58PPCB.exe	Get hash	malicious	Njrat	Browse
	wiUnP1h5Ex.exe	Get hash	malicious	Njrat	Browse
	d09l64ZAW6.exe	Get hash	malicious	Njrat	Browse
	8AKGdJOQ8N.exe	Get hash	malicious	Njrat	Browse
	uPMGLG7QnV.exe	Get hash	malicious	Njrat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6.tcp.eu.ngrok.io	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	ziTLBa3N50.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	1.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	Terraria.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	myidJB8lDL.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	30b4CoDmKk.exe	Get hash	malicious	Njrat	Browse	18.197.239.109
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse	3.68.171.119

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	UnvB121TyH.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	qz91XNGYhe.elf	Get hash	malicious	Mirai	Browse	63.32.218.208
	UDABfsLPdO.elf	Get hash	malicious	Mirai	Browse	44.244.87.62
	rdDs41qwgi.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	tml3sr196t.elf	Get hash	malicious	Unknown	Browse	54.217.10.153
	https://dogfriendlytahoe.com/s/_.php?uni=jasmine.salazar-bryan@filterresources.com&aidna=Ki5kb2dmcmllbmRseXRhaG9lLmNvbQ=&u=aGlyZW9mZnNob3JlLmNvL3MveXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eWUvamFzbWluZS5zYWxhemFyLWJyeWFuQGZpbHRlcnJlc291cmNlcy5jb20=	Get hash	malicious	Unknown	Browse	54.230.31.114
	https://dogfriendlytahoe.com/s/_.php?uni=jasmine.salazar-bryan@filterresources.com&aidna=Ki5kb2dmcmllbmRseXRhaG9lLmNvbQ=&u=aGlyZW9mZnNob3JlLmNvL3MveXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eWUvamFzbWluZS5zYWxhemFyLWJyeWFuQGZpbHRlcnJlc291cmNlcy5jb20=	Get hash	malicious	Unknown	Browse	52.85.151.98
	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer	Browse	99.86.229.15
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	52.219.142.64
AMAZON-02US	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	UnvB121TyH.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	qz91XNGYhe.elf	Get hash	malicious	Mirai	Browse	63.32.218.208
	UDABfsLPdO.elf	Get hash	malicious	Mirai	Browse	44.244.87.62
	rdDs41qwgi.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	tml3sr196t.elf	Get hash	malicious	Unknown	Browse	54.217.10.153
	https://dogfriendlytahoe.com/s/_.php?uni=jasmine.salazar-bryan@filterresources.com&aidna=Ki5kb2dmcmllbmRseXRhaG9lLmNvbQ=&u=aGlyZW9mZnNob3JlLmNvL3MveXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eWUvamFzbWluZS5zYWxhemFyLWJyeWFuQGZpbHRlcnJlc291cmNlcy5jb20=	Get hash	malicious	Unknown	Browse	54.230.31.114
	https://dogfriendlytahoe.com/s/_.php?uni=jasmine.salazar-bryan@filterresources.com&aidna=Ki5kb2dmcmllbmRseXRhaG9lLmNvbQ=&u=aGlyZW9mZnNob3JlLmNvL3MveXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eWUvamFzbWluZS5zYWxhemFyLWJyeWFuQGZpbHRlcnJlc291cmNlcy5jb20=	Get hash	malicious	Unknown	Browse	52.85.151.98
	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer	Browse	99.86.229.15
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	52.219.142.64
AMAZON-02US	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	UnvB121TyH.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	qz91XNGYhe.elf	Get hash	malicious	Mirai	Browse	63.32.218.208
	UDABfsLPdO.elf	Get hash	malicious	Mirai	Browse	44.244.87.62
	rdDs41qwgi.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	tml3sr196t.elf	Get hash	malicious	Unknown	Browse	54.217.10.153
	https://dogfriendlytahoe.com/s/_.php?uni=jasmine.salazar-bryan@filterresources.com&aidna=Ki5kb2dmcmllbmRseXRhaG9lLmNvbQ=&u=aGlyZW9mZnNob3JlLmNvL3MveXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eWUvamFzbWluZS5zYWxhemFyLWJyeWFuQGZpbHRlcnJlc291cmNlcy5jb20=	Get hash	malicious	Unknown	Browse	54.230.31.114
	https://dogfriendlytahoe.com/s/_.php?uni=jasmine.salazar-bryan@filterresources.com&aidna=Ki5kb2dmcmllbmRseXRhaG9lLmNvbQ=&u=aGlyZW9mZnNob3JlLmNvL3MveXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eWUvamFzbWluZS5zYWxhemFyLWJyeWFuQGZpbHRlcnJlc291cmNlcy5jb20=	Get hash	malicious	Unknown	Browse	52.85.151.98
	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer	Browse	99.86.229.15
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	52.219.142.64

Process:	C:\Users\user\AppData\Roaming\ESET Service.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\zyx3qItgQK.exe.log

Process:	C:\Users\user\Desktop\zyx3qItgQK.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Roaming\ESET Service.exe

Process:	C:\Users\user\Desktop\zyx3qItgQK.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.573297734149507
Encrypted:	false
SSDEEP:	384:KstKUiDtblmJEpRGyEf7JfJuQCY6iX1rAF+rMRTyN/0L+EcoinblneHQM3epzXk/:dtiHpR9Ef7JsQCFilrM+rMRa8Nuelt
MD5:	1D641A341DF0631BF135F5767440DF01
SHA1:	2E76BE5D5A7F0BAE3657A649EB60F47C4FBDE3CF
SHA-256:	3FA1B0D5AB8CC2B3435718E8B625E63E651A6D3DF4D7657DC8C3859CAEB5B4E9
SHA-512:	08D78D42B96734006BF0986DD666D0C5A15E2EC4C13817E82F3FE6AF55CEDE59F3685466A2B004AD765FE291B360625490C17E97FA89EF0965B09E7A448CE853
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 97%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................. ........@.. ....................................@.................................p...K.......@............................................................................ ............... ..H............text....... ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\ESET Service.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\zyx3qItgQK.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe

Process:	C:\Users\user\AppData\Roaming\ESET Service.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.573297734149507
Encrypted:	false
SSDEEP:	384:KstKUiDtblmJEpRGyEf7JfJuQCY6iX1rAF+rMRTyN/0L+EcoinblneHQM3epzXk/:dtiHpR9Ef7JsQCFilrM+rMRa8Nuelt
MD5:	1D641A341DF0631BF135F5767440DF01
SHA1:	2E76BE5D5A7F0BAE3657A649EB60F47C4FBDE3CF
SHA-256:	3FA1B0D5AB8CC2B3435718E8B625E63E651A6D3DF4D7657DC8C3859CAEB5B4E9
SHA-512:	08D78D42B96734006BF0986DD666D0C5A15E2EC4C13817E82F3FE6AF55CEDE59F3685466A2B004AD765FE291B360625490C17E97FA89EF0965B09E7A448CE853
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 97%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................. ........@.. ....................................@.................................p...K.......@............................................................................ ............... ..H............text....... ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7891fdab3e9ec8884436ba440a809c8a.exe:Zone.Identifier

Process:	C:\Users\user\AppData\Roaming\ESET Service.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\autorun.inf

Process:	C:\Users\user\AppData\Roaming\ESET Service.exe
File Type:	Microsoft Windows Autorun file
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.320240000427043
Encrypted:	false
SSDEEP:	3:It1KV2LKMACovK0x:e1KzxvD
MD5:	5B0B50BADE67C5EC92D42E971287A5D9
SHA1:	90D5C99143E7A56AD6E5EE401015F8ECC093D95A
SHA-256:	04DDE2489D2D2E6846D42250D813AB90B5CA847D527F8F2C022E6C327DC6DB53
SHA-512:	C064DC3C4185A38D1CAEBD069ACB9FDBB85DFB650D6A241036E501A09BC89FD06E267BE9D400D20E6C14B4068473D1C6557962E8D82FDFD191DB7EABB6E66821
Malicious:	true
Preview:	[autorun]..open=C:\svchost.exe..shellexecute=C:\..

C:\svchost.exe

Process:	C:\Users\user\AppData\Roaming\ESET Service.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.573297734149507
Encrypted:	false
SSDEEP:	384:KstKUiDtblmJEpRGyEf7JfJuQCY6iX1rAF+rMRTyN/0L+EcoinblneHQM3epzXk/:dtiHpR9Ef7JsQCFilrM+rMRa8Nuelt
MD5:	1D641A341DF0631BF135F5767440DF01
SHA1:	2E76BE5D5A7F0BAE3657A649EB60F47C4FBDE3CF
SHA-256:	3FA1B0D5AB8CC2B3435718E8B625E63E651A6D3DF4D7657DC8C3859CAEB5B4E9
SHA-512:	08D78D42B96734006BF0986DD666D0C5A15E2EC4C13817E82F3FE6AF55CEDE59F3685466A2B004AD765FE291B360625490C17E97FA89EF0965B09E7A448CE853
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\svchost.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\svchost.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\svchost.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\svchost.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 97%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................. ........@.. ....................................@.................................p...K.......@............................................................................ ............... ..H............text....... ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\svchost.exe:Zone.Identifier

Process:	C:\Users\user\AppData\Roaming\ESET Service.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.573297734149507
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	zyx3qItgQK.exe
File size:	37'888 bytes
MD5:	1d641a341df0631bf135f5767440df01
SHA1:	2e76be5d5a7f0bae3657a649eb60f47c4fbde3cf
SHA256:	3fa1b0d5ab8cc2b3435718e8b625e63e651a6d3df4d7657dc8c3859caeb5b4e9
SHA512:	08d78d42b96734006bf0986dd666d0c5a15e2ec4c13817e82f3fe6af55cede59f3685466a2b004ad765fe291b360625490c17e97fa89ef0965b09e7a448ce853
SSDEEP:	384:KstKUiDtblmJEpRGyEf7JfJuQCY6iX1rAF+rMRTyN/0L+EcoinblneHQM3epzXk/:dtiHpR9Ef7JsQCFilrM+rMRa8Nuelt
TLSH:	3D032A4D7FE18168C5FD467B05B2D41207BBE04B6E23D90ECEE564AA37636C18B50AF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40abbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65B41CD0 [Fri Jan 26 20:57:52 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xab70	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x240	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8bc4	0x8c00	459c332f63a31fff36bf80b50c01a6e0	False	0.4636160714285714	data	5.604798648983626	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x240	0x400	f7ce2f7b506ce16c06c85a549ef2cd98	False	0.3134765625	data	4.968771659524424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	163d66697186c0743c0da6f82247a39a	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xc058	0x1e7	XML 1.0 document, ASCII text, with CRLF line terminators			0.5338809034907598

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.63.69.115.17849707120412033132 01/31/24-18:02:40.293747	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49707	12041	192.168.2.6	3.69.115.178
192.168.2.63.69.115.17849711120412825564 01/31/24-18:03:57.860489	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49711	12041	192.168.2.6	3.69.115.178
192.168.2.618.197.239.10949713120412814856 01/31/24-18:04:50.646104	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49713	12041	192.168.2.6	18.197.239.109
192.168.2.63.68.171.11949714120412825563 01/31/24-18:05:23.258517	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49714	12041	192.168.2.6	3.68.171.119
192.168.2.618.197.239.10949712120412033132 01/31/24-18:04:17.975768	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49712	12041	192.168.2.6	18.197.239.109
192.168.2.63.68.171.11949714120412825564 01/31/24-18:05:51.313700	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49714	12041	192.168.2.6	3.68.171.119
192.168.2.63.68.171.11949715120412825564 01/31/24-18:05:55.916285	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49715	12041	192.168.2.6	3.68.171.119
192.168.2.63.69.115.17849707120412825563 01/31/24-18:02:40.497750	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49707	12041	192.168.2.6	3.69.115.178
192.168.2.63.69.115.17849710120412825564 01/31/24-18:03:36.423392	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49710	12041	192.168.2.6	3.69.115.178
192.168.2.618.197.239.10949712120412814856 01/31/24-18:04:18.182874	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49712	12041	192.168.2.6	18.197.239.109
192.168.2.63.69.115.17849699120412814860 01/31/24-18:02:13.547863	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49699	12041	192.168.2.6	3.69.115.178
192.168.2.63.69.115.17849707120412825564 01/31/24-18:03:10.096095	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49707	12041	192.168.2.6	3.69.115.178
192.168.2.618.197.239.10949713120412033132 01/31/24-18:04:50.445338	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49713	12041	192.168.2.6	18.197.239.109
192.168.2.63.69.115.17849711120412825563 01/31/24-18:03:45.587236	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49711	12041	192.168.2.6	3.69.115.178
192.168.2.63.69.115.17849707120412814856 01/31/24-18:02:40.497750	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49707	12041	192.168.2.6	3.69.115.178
192.168.2.63.69.115.17849710120412033132 01/31/24-18:03:12.896650	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49710	12041	192.168.2.6	3.69.115.178
192.168.2.63.68.171.11949714120412814856 01/31/24-18:05:23.258517	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49714	12041	192.168.2.6	3.68.171.119
192.168.2.63.68.171.11949715120412814856 01/31/24-18:05:55.717331	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49715	12041	192.168.2.6	3.68.171.119
192.168.2.63.69.115.17849710120412814860 01/31/24-18:03:43.043933	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49710	12041	192.168.2.6	3.69.115.178
192.168.2.63.69.115.17849711120412814860 01/31/24-18:03:57.860489	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49711	12041	192.168.2.6	3.69.115.178
192.168.2.63.69.115.17849711120412033132 01/31/24-18:03:45.382419	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49711	12041	192.168.2.6	3.69.115.178
192.168.2.63.69.115.17849710120412814856 01/31/24-18:03:13.103025	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49710	12041	192.168.2.6	3.69.115.178
192.168.2.618.197.239.10949712120412814860 01/31/24-18:04:48.199794	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49712	12041	192.168.2.6	18.197.239.109
192.168.2.63.69.115.17849699120412825564 01/31/24-18:02:13.547863	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49699	12041	192.168.2.6	3.69.115.178
192.168.2.63.69.115.17849711120412814856 01/31/24-18:03:45.587236	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49711	12041	192.168.2.6	3.69.115.178
192.168.2.63.69.115.17849699120412825563 01/31/24-18:02:08.215265	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49699	12041	192.168.2.6	3.69.115.178
192.168.2.63.69.115.17849699120412033132 01/31/24-18:02:07.907549	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49699	12041	192.168.2.6	3.69.115.178
192.168.2.618.197.239.10949713120412814860 01/31/24-18:05:18.691447	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49713	12041	192.168.2.6	18.197.239.109
192.168.2.63.69.115.17849699120412814856 01/31/24-18:02:08.215265	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49699	12041	192.168.2.6	3.69.115.178
192.168.2.618.197.239.10949712120412825563 01/31/24-18:04:18.182874	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49712	12041	192.168.2.6	18.197.239.109
192.168.2.63.69.115.17849707120412814860 01/31/24-18:03:10.096095	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49707	12041	192.168.2.6	3.69.115.178
192.168.2.618.197.239.10949712120412825564 01/31/24-18:04:47.577535	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49712	12041	192.168.2.6	18.197.239.109
192.168.2.63.68.171.11949714120412033132 01/31/24-18:05:23.054371	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49714	12041	192.168.2.6	3.68.171.119
192.168.2.63.68.171.11949715120412814860 01/31/24-18:05:55.916285	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49715	12041	192.168.2.6	3.68.171.119
192.168.2.63.68.171.11949714120412814860 01/31/24-18:05:51.313700	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49714	12041	192.168.2.6	3.68.171.119
192.168.2.618.197.239.10949713120412825564 01/31/24-18:05:18.691447	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49713	12041	192.168.2.6	18.197.239.109
192.168.2.63.68.171.11949715120412033132 01/31/24-18:05:55.518415	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49715	12041	192.168.2.6	3.68.171.119

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 31, 2024 18:02:07.601418018 CET	49699	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:07.805454016 CET	12041	49699	3.69.115.178	192.168.2.6
Jan 31, 2024 18:02:07.805577040 CET	49699	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:07.907548904 CET	49699	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:08.215066910 CET	12041	49699	3.69.115.178	192.168.2.6
Jan 31, 2024 18:02:08.215265036 CET	49699	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:08.419259071 CET	12041	49699	3.69.115.178	192.168.2.6
Jan 31, 2024 18:02:13.547863007 CET	49699	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:13.752088070 CET	12041	49699	3.69.115.178	192.168.2.6
Jan 31, 2024 18:02:28.900213003 CET	12041	49699	3.69.115.178	192.168.2.6
Jan 31, 2024 18:02:28.900429010 CET	49699	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:38.062952995 CET	12041	49699	3.69.115.178	192.168.2.6
Jan 31, 2024 18:02:38.063191891 CET	49699	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:40.079741001 CET	49699	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:40.081720114 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:40.283947945 CET	12041	49699	3.69.115.178	192.168.2.6
Jan 31, 2024 18:02:40.285665989 CET	12041	49707	3.69.115.178	192.168.2.6
Jan 31, 2024 18:02:40.285768032 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:40.293746948 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:40.497543097 CET	12041	49707	3.69.115.178	192.168.2.6
Jan 31, 2024 18:02:40.497750044 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:40.704612017 CET	12041	49707	3.69.115.178	192.168.2.6
Jan 31, 2024 18:02:45.985716105 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:02:46.189863920 CET	12041	49707	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:01.408046961 CET	12041	49707	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:01.408262968 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:04.016621113 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:04.220837116 CET	12041	49707	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:05.422851086 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:05.627454996 CET	12041	49707	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:09.891772985 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:10.095874071 CET	12041	49707	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:10.096095085 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:10.300097942 CET	12041	49707	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:10.553540945 CET	12041	49707	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:10.553673983 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:12.563251972 CET	49707	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:12.686687946 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:12.767330885 CET	12041	49707	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:12.893023014 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:12.893107891 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:12.896650076 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:13.102838993 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:13.103024960 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:13.309340000 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:13.309528112 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:13.515840054 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:13.515919924 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:13.722246885 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:13.724965096 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:13.931380033 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:13.933017015 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:14.139467001 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:14.140997887 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:14.347431898 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:14.347940922 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:14.554300070 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:14.554886103 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:14.761329889 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:14.761437893 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:14.967714071 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:14.967852116 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:15.174918890 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:15.175065994 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:15.381402969 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:15.381515980 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:15.587723017 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:15.587874889 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:15.794327021 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:15.794482946 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:16.000735044 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:16.000849009 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:16.207130909 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:16.316586018 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:16.522900105 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:16.523035049 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:16.730045080 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:16.730274916 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:16.936695099 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:18.462435007 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:18.668821096 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:18.668972015 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:18.875329018 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:18.875544071 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:19.082005978 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:19.082247972 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:19.288566113 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:19.288774014 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:19.495158911 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:19.495253086 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:19.701575994 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:19.701700926 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:19.907911062 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:19.908051968 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:20.114242077 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:20.114315987 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:20.320647001 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:20.320739031 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:20.527123928 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:20.527244091 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:20.733539104 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:20.733762980 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:20.939939022 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:20.940077066 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:21.146306038 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:21.146503925 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:21.352988958 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:21.353179932 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:21.559432983 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:21.559568882 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:21.766057968 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:21.766273975 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:21.972605944 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:21.972764969 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:22.179260969 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:22.179394960 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:22.385607958 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:22.385739088 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:22.592129946 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:22.592344999 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:22.798768044 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:22.798854113 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:23.005201101 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:23.005403996 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:23.212618113 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:23.212690115 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:23.419682980 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:23.419892073 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:23.629147053 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:23.629268885 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:23.837130070 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:23.837222099 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:24.043637037 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:24.043847084 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:24.250507116 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:24.250653982 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:24.457289934 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:24.457396984 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:24.663806915 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:24.663904905 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:24.870610952 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:24.870702982 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:25.077100039 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:25.077184916 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:25.283478022 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:25.283571005 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:25.492559910 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:25.492657900 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:25.700622082 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:25.700737953 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:25.907181978 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:25.907291889 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:26.115231037 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:26.115314960 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:26.321651936 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:26.321763992 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:26.528301001 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:26.528404951 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:26.734882116 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:26.735022068 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:26.944813013 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:26.944966078 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:27.151447058 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:27.151541948 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:27.357853889 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:27.357934952 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:27.564412117 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:27.564667940 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:27.771356106 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:27.771533966 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:27.981117010 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:27.981219053 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:28.187783003 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:28.187941074 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:28.394503117 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:28.394599915 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:28.601280928 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:28.601389885 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:28.807903051 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:28.807991028 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:29.014520884 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:29.014626980 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:29.220937014 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:29.221079111 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:29.427647114 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:29.428050995 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:29.634608030 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:29.634783030 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:29.841295958 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:29.841414928 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:30.047949076 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:30.048135042 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:30.254626036 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:30.254765987 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:30.461827993 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:30.461968899 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:30.668775082 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:30.668912888 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:30.876468897 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:30.876558065 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:31.083039999 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:31.083163023 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:31.289518118 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:31.289648056 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:31.496117115 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:31.496198893 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:31.702677011 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:31.702816010 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:31.909219980 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:31.909388065 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:32.115822077 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:32.115915060 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:32.322360039 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:32.322534084 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:32.528887033 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:32.528995991 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:32.735898018 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:32.735979080 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:32.942154884 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:32.942230940 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:33.152281046 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:33.152393103 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:33.369033098 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:33.369131088 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:33.576632023 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:33.576771021 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:33.783014059 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:33.783226013 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:33.989511967 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:34.033833981 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:34.240119934 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:34.240199089 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:34.446418047 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:34.576956034 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:34.783373117 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:34.783528090 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:34.989964008 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:36.423392057 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:36.629802942 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:36.629914045 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:36.836122036 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:36.836333036 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:37.042574883 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:37.042635918 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:37.248862028 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:37.248934031 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:37.455301046 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:37.455403090 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:37.661576986 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:37.661690950 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:37.867861032 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:37.867933035 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:38.074071884 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:38.076492071 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:38.282614946 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:38.284929991 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:38.491097927 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:38.491163969 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:38.697371960 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:38.697443008 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:38.903558016 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:38.903683901 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:39.109802008 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:39.109880924 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:39.316071987 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:39.316173077 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:39.522322893 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:39.522440910 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:39.728607893 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:39.728708982 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:39.934999943 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:39.935103893 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:40.141377926 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:40.141499996 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:40.347789049 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:40.347893000 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:40.557548046 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:40.557820082 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:40.768435001 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:40.768515110 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:40.974749088 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:40.974951982 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:41.181274891 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:41.181428909 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:41.389956951 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:41.390049934 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:41.597595930 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:41.597753048 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:41.804147005 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:41.804239035 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:42.010566950 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:42.010660887 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:42.217143059 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:42.217540026 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:42.423923016 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:42.423993111 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:42.630192995 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:42.630274057 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:42.836669922 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:42.836797953 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:43.043826103 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:43.043932915 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:43.161653042 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:43.161719084 CET	49710	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:43.250216961 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:43.367850065 CET	12041	49710	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:45.174611092 CET	49711	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:45.379576921 CET	12041	49711	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:45.379733086 CET	49711	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:45.382419109 CET	49711	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:45.587100983 CET	12041	49711	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:45.587235928 CET	49711	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:45.791943073 CET	12041	49711	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:49.704380035 CET	49711	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:49.909182072 CET	12041	49711	3.69.115.178	192.168.2.6
Jan 31, 2024 18:03:57.860488892 CET	49711	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:03:58.068228006 CET	12041	49711	3.69.115.178	192.168.2.6
Jan 31, 2024 18:04:13.088044882 CET	12041	49711	3.69.115.178	192.168.2.6
Jan 31, 2024 18:04:13.088115931 CET	49711	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:04:15.635255098 CET	12041	49711	3.69.115.178	192.168.2.6
Jan 31, 2024 18:04:15.635339022 CET	49711	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:04:17.641540051 CET	49711	12041	192.168.2.6	3.69.115.178
Jan 31, 2024 18:04:17.763516903 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:17.846463919 CET	12041	49711	3.69.115.178	192.168.2.6
Jan 31, 2024 18:04:17.970702887 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:17.970813990 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:17.975768089 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:18.182794094 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:18.182873964 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:18.390026093 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:21.548099041 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:21.755295038 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:36.963793993 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:36.964099884 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:39.454431057 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:39.661676884 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:41.110712051 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:41.317789078 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:45.610511065 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:45.817495108 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:45.876240969 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:46.083256960 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:46.844952106 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:47.052134991 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:47.052253962 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:47.259253025 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:47.577534914 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:47.784687996 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:47.784951925 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:47.992389917 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:47.992615938 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:48.199696064 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:48.199794054 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:48.230387926 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:48.230470896 CET	49712	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:48.407084942 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:48.437495947 CET	12041	49712	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:50.238300085 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:50.442935944 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:50.443037033 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:50.445338011 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:50.646011114 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:50.646104097 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:50.846951008 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:50.847023010 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:51.047754049 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:51.047847986 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:51.248553038 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:51.248641014 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:51.449410915 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:51.449518919 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:51.650374889 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:51.650475979 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:51.851134062 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:51.851334095 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:52.052052975 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:52.052244902 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:52.252867937 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:52.253115892 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:52.453947067 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:52.454019070 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:52.654653072 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:52.654793978 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:52.855489016 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:52.855592966 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:53.056530952 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:53.056776047 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:53.257496119 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:04:53.257585049 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:04:53.458517075 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:05:08.706800938 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:05:08.706971884 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:05:10.563657999 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:05:10.764460087 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:05:18.691447020 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:05:18.892263889 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:05:20.706190109 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:05:20.706271887 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:05:22.719924927 CET	49713	12041	192.168.2.6	18.197.239.109
Jan 31, 2024 18:05:22.847780943 CET	49714	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:22.920859098 CET	12041	49713	18.197.239.109	192.168.2.6
Jan 31, 2024 18:05:23.051953077 CET	12041	49714	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:23.052150965 CET	49714	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:23.054371119 CET	49714	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:23.258429050 CET	12041	49714	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:23.258517027 CET	49714	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:23.462826014 CET	12041	49714	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:26.767024994 CET	49714	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:26.971398115 CET	12041	49714	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:42.022066116 CET	12041	49714	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:42.022135973 CET	49714	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:49.891871929 CET	49714	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:50.096159935 CET	12041	49714	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:51.313699961 CET	49714	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:51.517978907 CET	12041	49714	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:53.311817884 CET	12041	49714	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:53.311953068 CET	49714	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:55.313688993 CET	49714	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:55.316647053 CET	49715	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:55.515499115 CET	12041	49715	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:55.515594959 CET	49715	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:55.517741919 CET	12041	49714	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:55.518414974 CET	49715	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:55.717165947 CET	12041	49715	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:55.717330933 CET	49715	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:55.916188002 CET	12041	49715	3.68.171.119	192.168.2.6
Jan 31, 2024 18:05:55.916285038 CET	49715	12041	192.168.2.6	3.68.171.119
Jan 31, 2024 18:05:56.115215063 CET	12041	49715	3.68.171.119	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 31, 2024 18:02:07.478013039 CET	54871	53	192.168.2.6	1.1.1.1
Jan 31, 2024 18:02:07.598102093 CET	53	54871	1.1.1.1	192.168.2.6
Jan 31, 2024 18:03:12.565818071 CET	49942	53	192.168.2.6	1.1.1.1
Jan 31, 2024 18:03:12.685225010 CET	53	49942	1.1.1.1	192.168.2.6
Jan 31, 2024 18:04:17.642935991 CET	51782	53	192.168.2.6	1.1.1.1
Jan 31, 2024 18:04:17.762331009 CET	53	51782	1.1.1.1	192.168.2.6
Jan 31, 2024 18:05:22.726516962 CET	62376	53	192.168.2.6	1.1.1.1
Jan 31, 2024 18:05:22.845422983 CET	53	62376	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 31, 2024 18:02:07.478013039 CET	192.168.2.6	1.1.1.1	0x8d76	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Jan 31, 2024 18:03:12.565818071 CET	192.168.2.6	1.1.1.1	0x62a2	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Jan 31, 2024 18:04:17.642935991 CET	192.168.2.6	1.1.1.1	0x37c3	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Jan 31, 2024 18:05:22.726516962 CET	192.168.2.6	1.1.1.1	0x7694	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 31, 2024 18:02:07.598102093 CET	1.1.1.1	192.168.2.6	0x8d76	No error (0)	6.tcp.eu.ngrok.io	3.69.115.178	A (IP address)	IN (0x0001)	false
Jan 31, 2024 18:03:12.685225010 CET	1.1.1.1	192.168.2.6	0x62a2	No error (0)	6.tcp.eu.ngrok.io	3.69.115.178	A (IP address)	IN (0x0001)	false
Jan 31, 2024 18:04:17.762331009 CET	1.1.1.1	192.168.2.6	0x37c3	No error (0)	6.tcp.eu.ngrok.io	18.197.239.109	A (IP address)	IN (0x0001)	false
Jan 31, 2024 18:05:22.845422983 CET	1.1.1.1	192.168.2.6	0x7694	No error (0)	6.tcp.eu.ngrok.io	3.68.171.119	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	18:01:50
Start date:	31/01/2024
Path:	C:\Users\user\Desktop\zyx3qItgQK.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\zyx3qItgQK.exe
Imagebase:	0x850000
File size:	37'888 bytes
MD5 hash:	1D641A341DF0631BF135F5767440DF01
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000000.00000000.2051599274.0000000000852000.00000002.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	18:01:56
Start date:	31/01/2024
Path:	C:\Users\user\AppData\Roaming\ESET Service.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ESET Service.exe"
Imagebase:	0x490000
File size:	37'888 bytes
MD5 hash:	1D641A341DF0631BF135F5767440DF01
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000002.00000002.4507767686.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 97%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	18:02:03
Start date:	31/01/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\ESET Service.exe" "ESET Service.exe" ENABLE
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	4
Start time:	18:02:03
Start date:	31/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	18:02:03
Start date:	31/01/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM taskmgr.exe
Imagebase:	0xfe0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	18:02:03
Start date:	31/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	18:02:15
Start date:	31/01/2024
Path:	C:\Users\user\AppData\Roaming\ESET Service.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ESET Service.exe" ..
Imagebase:	0xb60000
File size:	37'888 bytes
MD5 hash:	1D641A341DF0631BF135F5767440DF01
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	18:02:24
Start date:	31/01/2024
Path:	C:\Users\user\AppData\Roaming\ESET Service.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ESET Service.exe" ..
Imagebase:	0xa60000
File size:	37'888 bytes
MD5 hash:	1D641A341DF0631BF135F5767440DF01
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	18:02:32
Start date:	31/01/2024
Path:	C:\Users\user\AppData\Roaming\ESET Service.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ESET Service.exe" ..
Imagebase:	0x30000
File size:	37'888 bytes
MD5 hash:	1D641A341DF0631BF135F5767440DF01
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true