Edit tour

Windows Analysis Report
U22p1GcCSb.exe

Overview

General Information

Sample name:	U22p1GcCSb.exe renamed because original name is a hash value
Original sample name:	0a5ef41dd9cdbad5c5aaf4ca7b177700.exe
Analysis ID:	1406594
MD5:	0a5ef41dd9cdbad5c5aaf4ca7b177700
SHA1:	ab67841aaec06b8527596203c2c426e6f59b0470
SHA256:	72feaca614e6e82fa5efd6d8795d68223fef6054ee898ad9cdaed71194a88c8d
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

Connects to many ports of the same IP (likely port scanning)

Contains functionality to disable the Task Manager (.Net Source)

Contains functionality to spread to USB devices (.Net source)

Creates autorun.inf (USB autostart)

Disables the Windows task manager (taskmgr)

Disables zone checking for all users

Drops PE files to the document folder of the user

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the program root directory (C:\Program Files)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

U22p1GcCSb.exe (PID: 7616 cmdline: C:\Users\user\Desktop\U22p1GcCSb.exe MD5: 0A5EF41DD9CDBAD5C5AAF4CA7B177700)

server.exe (PID: 7740 cmdline: "C:\Users\user\AppData\Roaming\server.exe" MD5: 0A5EF41DD9CDBAD5C5AAF4CA7B177700)

netsh.exe (PID: 7920 cmdline: netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7256 cmdline: netsh firewall delete allowedprogram "C:\Users\user\AppData\Roaming\server.exe" MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7276 cmdline: netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

7330bac122947b8db6af3ae8d6783a41Windows Update.exe (PID: 7536 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe" MD5: 0A5EF41DD9CDBAD5C5AAF4CA7B177700)

7330bac122947b8db6af3ae8d6783a41Windows Update.exe (PID: 1472 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe" MD5: 0A5EF41DD9CDBAD5C5AAF4CA7B177700)

Explower.exe (PID: 7628 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe" MD5: 0A5EF41DD9CDBAD5C5AAF4CA7B177700)

Microsoft Corporation.exe (PID: 7812 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe" MD5: 0A5EF41DD9CDBAD5C5AAF4CA7B177700)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Campaign ID": "HacKed", "Version": "0.7d", "Install Name": "7330bac122947b8db6af3ae8d6783a41", "Install Dir": "system", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
U22p1GcCSb.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
U22p1GcCSb.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
U22p1GcCSb.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
U22p1GcCSb.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
U22p1GcCSb.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\server.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\server.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\system.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\server.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Users\user\AppData\Roaming\server.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Roaming\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\system.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\system.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\system.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\system.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Notepad.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Notepad.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Notepad.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Notepad.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Notepad.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Umbrella.flv.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Umbrella.flv.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Umbrella.flv.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
C:\Umbrella.flv.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR
Click to see the 75 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x113d2:$a1: get_Registry 0x1582d:$a2: SEE_MASK_NOZONECHECKS 0x154cf:$a3: Download ERROR 0x15a7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13a0c:$a5: netsh firewall delete allowedprogram "
00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x1582d:$reg: SEE_MASK_NOZONECHECKS 0x154b3:$msg: Execute ERROR 0x15507:$msg: Execute ERROR 0x15a7f:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115f2:$a1: get_Registry 0x15a4d:$a2: SEE_MASK_NOZONECHECKS 0x156ef:$a3: Download ERROR 0x15c9f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c2c:$a5: netsh firewall delete allowedprogram "
00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a4d:$reg: SEE_MASK_NOZONECHECKS 0x156d3:$msg: Execute ERROR 0x15727:$msg: Execute ERROR 0x15c9f:$ping: cmd.exe /c ping 0 -n 2 & del
Process Memory Space: U22p1GcCSb.exe PID: 7616	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: server.exe PID: 7740	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: 7330bac122947b8db6af3ae8d6783a41Windows Update.exe PID: 1472	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Explower.exe PID: 7628	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Microsoft Corporation.exe PID: 7812	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.U22p1GcCSb.exe.e40000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.U22p1GcCSb.exe.e40000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a2d:$a2: SEE_MASK_NOZONECHECKS 0x156cf:$a3: Download ERROR 0x15c7f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c0c:$a5: netsh firewall delete allowedprogram "
0.0.U22p1GcCSb.exe.e40000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c7f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x13798:$s1: winmgmts:\\.\root\SecurityCenter2 0x156ed:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156cf:$s6: Download ERROR 0x1375a:$s8: Select * From AntiVirusProduct
0.0.U22p1GcCSb.exe.e40000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a2d:$reg: SEE_MASK_NOZONECHECKS 0x156b3:$msg: Execute ERROR 0x15707:$msg: Execute ERROR 0x15c7f:$ping: cmd.exe /c ping 0 -n 2 & del
0.0.U22p1GcCSb.exe.e40000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c0c:$s1: netsh firewall delete allowedprogram 0x13c5e:$s2: netsh firewall add allowedprogram 0x15c7f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156b3:$s4: Execute ERROR 0x15707:$s4: Execute ERROR 0x156cf:$s5: Download ERROR

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\server.exe, ProcessId: 7740, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Snort Signatures

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:55.365233
SID:	2033132
Source Port:	49723
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:57.972581
SID:	2033132
Source Port:	49724
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:10.905781
SID:	2033132
Source Port:	49703
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:48.181665
SID:	2033132
Source Port:	49721
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:52.998127
SID:	2033132
Source Port:	49722
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:58:00.582904
SID:	2033132
Source Port:	49725
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:13.390092
SID:	2033132
Source Port:	49704
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:45.527575
SID:	2033132
Source Port:	49720
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:58:03.810011
SID:	2033132
Source Port:	49727
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:58:06.238601
SID:	2033132
Source Port:	49728
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:17.866686
SID:	2033132
Source Port:	49705
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:20.184506
SID:	2033132
Source Port:	49707
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:43.174186
SID:	2814856
Source Port:	49751
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.68.171.119

Timestamp:	03/11/24-14:00:44.353987
SID:	2814856
Source Port:	49762
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:31.511033
SID:	2814856
Source Port:	49715
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:59:08.861139
SID:	2033132
Source Port:	49744
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:59:11.494367
SID:	2033132
Source Port:	49745
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:40.524865
SID:	2814856
Source Port:	49750
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:59.718993
SID:	2814856
Source Port:	49753
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:37.885075
SID:	2814856
Source Port:	49717
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:59:05.101000
SID:	2033132
Source Port:	49743
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:40.494203
SID:	2814856
Source Port:	49718
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:43.148380
SID:	2814856
Source Port:	49719
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:49.035267
SID:	2033132
Source Port:	49740
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:51.830869
SID:	2033132
Source Port:	49741
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:36.746964
SID:	2814856
Source Port:	49737
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:58.414340
SID:	2033132
Source Port:	49742
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:31.179034
SID:	2814856
Source Port:	49736
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:58:00.884094
SID:	2814856
Source Port:	49725
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:28.707084
SID:	2814856
Source Port:	49714
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:58.274652
SID:	2814856
Source Port:	49724
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:55.667281
SID:	2814856
Source Port:	49723
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.68.171.119

Timestamp:	03/11/24-14:00:33.042782
SID:	2814856
Source Port:	49760
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:26.008083
SID:	2814856
Source Port:	49713
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:30.876607
SID:	2033132
Source Port:	49736
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:48.411158
SID:	2814856
Source Port:	49721
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:23.387503
SID:	2814856
Source Port:	49711
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:36.488277
SID:	2033132
Source Port:	49737
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:39.527868
SID:	2033132
Source Port:	49738
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:45.787003
SID:	2814856
Source Port:	49720
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:45.841985
SID:	2033132
Source Port:	49739
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:25.706252
SID:	2033132
Source Port:	49713
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.68.171.119

Timestamp:	03/11/24-14:00:30.357471
SID:	2814856
Source Port:	49759
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:28.403515
SID:	2033132
Source Port:	49714
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.68.171.119

Timestamp:	03/11/24-14:00:41.703341
SID:	2033132
Source Port:	49761
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:23.086932
SID:	2033132
Source Port:	49711
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:31.210284
SID:	2033132
Source Port:	49715
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.68.171.119

Timestamp:	03/11/24-14:00:44.051573
SID:	2033132
Source Port:	49762
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:37.582749
SID:	2033132
Source Port:	49717
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:35.262290
SID:	2033132
Source Port:	49716
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:40.192791
SID:	2033132
Source Port:	49718
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:28.032861
SID:	2033132
Source Port:	49735
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:13.692255
SID:	2814856
Source Port:	49704
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:17.004618
SID:	2033132
Source Port:	49747
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:20.488277
SID:	2033132
Source Port:	49733
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:23.099308
SID:	2033132
Source Port:	49734
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:21.876862
SID:	2033132
Source Port:	49748
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:17.878508
SID:	2033132
Source Port:	49732
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:31.590664
SID:	2033132
Source Port:	49749
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:58:09.186733
SID:	2814856
Source Port:	49729
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:12.641935
SID:	2033132
Source Port:	49730
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:20.486728
SID:	2814856
Source Port:	49707
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:58:06.541661
SID:	2814856
Source Port:	49728
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:15.255220
SID:	2033132
Source Port:	49731
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.68.171.119

Timestamp:	03/11/24-14:00:32.739203
SID:	2033132
Source Port:	49760
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:22.150528
SID:	2814856
Source Port:	49748
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:40.223106
SID:	2033132
Source Port:	49750
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-14:00:17.380683
SID:	2814856
Source Port:	49757
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:14.671406
SID:	2814856
Source Port:	49746
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:17.306266
SID:	2814856
Source Port:	49747
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:42.872534
SID:	2033132
Source Port:	49751
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:56.068201
SID:	2033132
Source Port:	49752
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:23.402360
SID:	2814856
Source Port:	49734
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:59:11.796875
SID:	2814856
Source Port:	49745
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:15.559318
SID:	2814856
Source Port:	49731
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:58.717130
SID:	2814856
Source Port:	49742
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-14:00:08.210628
SID:	2814856
Source Port:	49755
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-14:00:02.370471
SID:	2814856
Source Port:	49754
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-14:00:10.893695
SID:	2814856
Source Port:	49756
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:20.790475
SID:	2814856
Source Port:	49733
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:59:09.163778
SID:	2814856
Source Port:	49744
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:18.179511
SID:	2814856
Source Port:	49732
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:59:05.403490
SID:	2814856
Source Port:	49743
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-14:00:17.081352
SID:	2033132
Source Port:	49757
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:14.496224
SID:	2033132
Source Port:	49746
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.68.171.119

Timestamp:	03/11/24-14:00:25.827295
SID:	2033132
Source Port:	49758
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:57:42.903315
SID:	2033132
Source Port:	49719
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.66.38.117

Timestamp:	03/11/24-13:58:08.885686
SID:	2033132
Source Port:	49729
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-14:00:07.909379
SID:	2033132
Source Port:	49755
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-14:00:10.590931
SID:	2033132
Source Port:	49756
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:12.944215
SID:	2814856
Source Port:	49730
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:52.029514
SID:	2814856
Source Port:	49741
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 3.68.171.119

Timestamp:	03/11/24-14:00:30.052643
SID:	2033132
Source Port:	49759
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-13:59:59.415669
SID:	2033132
Source Port:	49753
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.10 - Destination IP: 52.28.247.255

Timestamp:	03/11/24-14:00:02.066515
SID:	2033132
Source Port:	49754
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.10 - Destination IP: 18.197.239.109

Timestamp:	03/11/24-13:58:49.337814
SID:	2814856
Source Port:	49740
Destination Port:	13672
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: U22p1GcCSb.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\system.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Notepad.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Umbrella.flv.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\server.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 0.0.U22p1GcCSb.exe.e40000.0.unpack

Malware Configuration Extractor: Njrat {"Campaign ID": "HacKed", "Version": "0.7d", "Install Name": "7330bac122947b8db6af3ae8d6783a41", "Install Dir": "system", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for domain / URL

Source: 6.tcp.eu.ngrok.io

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Notepad.exe	ReversingLabs: Detection: 81%
Source: C:\Notepad.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Program Files (x86)\Explower.exe	ReversingLabs: Detection: 81%
Source: C:\Program Files (x86)\Explower.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Umbrella.flv.exe	ReversingLabs: Detection: 81%
Source: C:\Umbrella.flv.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Local\Explower.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Explower.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Roaming\server.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\server.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\Desktop\Explower.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\Desktop\Explower.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\Documents\Explower.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\Documents\Explower.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\Favorites\Explower.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\Favorites\Explower.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Windows\SysWOW64\Explower.exe	ReversingLabs: Detection: 81%
Source: C:\Windows\SysWOW64\Explower.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\system.exe	ReversingLabs: Detection: 81%
Source: C:\system.exe	Virustotal: Detection: 73%	Perma Link

Multi AV Scanner detection for submitted file

Source: U22p1GcCSb.exe	ReversingLabs: Detection: 81%
Source: U22p1GcCSb.exe	Virustotal: Detection: 73%			Perma Link

Yara detected Njrat

Source: Yara match	File source: U22p1GcCSb.exe, type: SAMPLE
Source: Yara match	File source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: U22p1GcCSb.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 7740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7330bac122947b8db6af3ae8d6783a41Windows Update.exe PID: 1472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED
Source: Yara match	File source: C:\system.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

Machine Learning detection for dropped file

Source: C:\system.exe	Joe Sandbox ML: detected
Source: C:\Notepad.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Umbrella.flv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\server.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: U22p1GcCSb.exe

Joe Sandbox ML: detected

Source: U22p1GcCSb.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\U22p1GcCSb.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: U22p1GcCSb.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Contains functionality to spread to USB devices (.Net source)

Source: U22p1GcCSb.exe, Usb1.cs	.Net Code: infect
Source: server.exe.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe0.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe1.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe2.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe3.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe4.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe5.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe6.2.dr, Usb1.cs	.Net Code: infect

Creates autorun.inf (USB autostart)

Source: C:\Users\user\AppData\Roaming\server.exe

File created: C:\autorun.inf

Jump to behavior

Source: U22p1GcCSb.exe, 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: U22p1GcCSb.exe, 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: U22p1GcCSb.exe, 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: U22p1GcCSb.exe, 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: U22p1GcCSb.exe, 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: U22p1GcCSb.exe, 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf$O
Source: U22p1GcCSb.exe	Binary or memory string: \autorun.inf
Source: U22p1GcCSb.exe	Binary or memory string: [autorun]
Source: U22p1GcCSb.exe	Binary or memory string: autorun.inf
Source: autorun.inf.2.dr	Binary or memory string: [autorun]
Source: system.exe.2.dr	Binary or memory string: \autorun.inf
Source: system.exe.2.dr	Binary or memory string: [autorun]
Source: system.exe.2.dr	Binary or memory string: autorun.inf
Source: Notepad.exe.2.dr	Binary or memory string: \autorun.inf
Source: Notepad.exe.2.dr	Binary or memory string: [autorun]
Source: Notepad.exe.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe7.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe7.2.dr	Binary or memory string: [autorun]
Source: Explower.exe7.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe2.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe2.2.dr	Binary or memory string: [autorun]
Source: Explower.exe2.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe5.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe5.2.dr	Binary or memory string: [autorun]
Source: Explower.exe5.2.dr	Binary or memory string: autorun.inf
Source: Microsoft Corporation.exe.2.dr	Binary or memory string: \autorun.inf
Source: Microsoft Corporation.exe.2.dr	Binary or memory string: [autorun]
Source: Microsoft Corporation.exe.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe4.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe4.2.dr	Binary or memory string: [autorun]
Source: Explower.exe4.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe0.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe0.2.dr	Binary or memory string: [autorun]
Source: Explower.exe0.2.dr	Binary or memory string: autorun.inf
Source: 7330bac122947b8db6af3ae8d6783a41Windows Update.exe.2.dr	Binary or memory string: \autorun.inf
Source: 7330bac122947b8db6af3ae8d6783a41Windows Update.exe.2.dr	Binary or memory string: [autorun]
Source: 7330bac122947b8db6af3ae8d6783a41Windows Update.exe.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe8.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe8.2.dr	Binary or memory string: [autorun]
Source: Explower.exe8.2.dr	Binary or memory string: autorun.inf
Source: Umbrella.flv.exe.2.dr	Binary or memory string: \autorun.inf
Source: Umbrella.flv.exe.2.dr	Binary or memory string: [autorun]
Source: Umbrella.flv.exe.2.dr	Binary or memory string: autorun.inf
Source: server.exe.0.dr	Binary or memory string: \autorun.inf
Source: server.exe.0.dr	Binary or memory string: [autorun]
Source: server.exe.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe1.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe1.2.dr	Binary or memory string: [autorun]
Source: Explower.exe1.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe.2.dr	Binary or memory string: [autorun]
Source: Explower.exe.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe3.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe3.2.dr	Binary or memory string: [autorun]
Source: Explower.exe3.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe6.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe6.2.dr	Binary or memory string: [autorun]
Source: Explower.exe6.2.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49703 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49704 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49704 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49705 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49707 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49707 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49711 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49711 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49713 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49713 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49714 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49714 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49715 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49715 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49716 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49717 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49717 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49718 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49718 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49719 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49719 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49720 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49720 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49721 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49721 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49722 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49723 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49723 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49724 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49724 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49725 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49725 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49727 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49728 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49728 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49729 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49729 -> 3.66.38.117:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49730 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49730 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49731 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49731 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49732 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49732 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49733 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49733 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49734 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49734 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49735 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49736 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49736 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49737 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49737 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49738 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49739 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49740 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49740 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49741 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49741 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49742 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49742 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49743 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49743 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49744 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49744 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49745 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49745 -> 18.197.239.109:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49746 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49746 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49747 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49747 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49748 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49748 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49749 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49750 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49750 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49751 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49751 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49752 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49753 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49753 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49754 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49754 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49755 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49755 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49756 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49756 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49757 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49757 -> 52.28.247.255:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49758 -> 3.68.171.119:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49759 -> 3.68.171.119:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49759 -> 3.68.171.119:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49760 -> 3.68.171.119:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49760 -> 3.68.171.119:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49761 -> 3.68.171.119:13672
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.10:49762 -> 3.68.171.119:13672
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.10:49762 -> 3.68.171.119:13672

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 3.66.38.117 ports 13672,1,2,3,6,7
Source: global traffic	TCP traffic: 52.28.247.255 ports 13672,1,2,3,6,7
Source: global traffic	TCP traffic: 18.197.239.109 ports 13672,1,2,3,6,7
Source: global traffic	TCP traffic: 3.68.171.119 ports 13672,1,2,3,6,7

Source: global traffic	TCP traffic: 192.168.2.10:49703 -> 3.66.38.117:13672
Source: global traffic	TCP traffic: 192.168.2.10:49730 -> 18.197.239.109:13672
Source: global traffic	TCP traffic: 192.168.2.10:49746 -> 52.28.247.255:13672
Source: global traffic	TCP traffic: 192.168.2.10:49758 -> 3.68.171.119:13672

Source: Joe Sandbox View	IP Address: 3.66.38.117 3.66.38.117
Source: Joe Sandbox View	IP Address: 52.28.247.255 52.28.247.255
Source: Joe Sandbox View	IP Address: 18.197.239.109 18.197.239.109
Source: Joe Sandbox View	IP Address: 3.68.171.119 3.68.171.119

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: 6.tcp.eu.ngrok.io

Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: U22p1GcCSb.exe, type: SAMPLE
Source: Yara match	File source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: U22p1GcCSb.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 7740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7330bac122947b8db6af3ae8d6783a41Windows Update.exe PID: 1472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED
Source: Yara match	File source: C:\system.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: U22p1GcCSb.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: U22p1GcCSb.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: U22p1GcCSb.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: U22p1GcCSb.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\system.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\system.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\system.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\system.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Notepad.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\AppData\Roaming\server.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_0074BF22 NtQuerySystemInformation,		2_2_0074BF22
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_0074BEF1 NtQuerySystemInformation,		2_2_0074BEF1

Source: C:\Users\user\AppData\Roaming\server.exe

File created: C:\Windows\SysWOW64\Explower.exe

Jump to behavior

Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_05754298	0_2_05754298
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_057544F1	0_2_057544F1
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_057549F9	0_2_057549F9
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_057550E3	0_2_057550E3
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_0575536F	0_2_0575536F
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_05754269	0_2_05754269
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_057547D4	0_2_057547D4
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_0575505D	0_2_0575505D
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_05755459	0_2_05755459
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_05754B5B	0_2_05754B5B
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_05754544	0_2_05754544
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_05754936	0_2_05754936
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_05754630	0_2_05754630
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_05754F2F	0_2_05754F2F
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_05754F9D	0_2_05754F9D
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_0575499D	0_2_0575499D
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_05755000	0_2_05755000
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_0575470F	0_2_0575470F
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Code function: 0_2_05754C8F	0_2_05754C8F
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE75A8	2_2_00EE75A8
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE4298	2_2_00EE4298
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE50E3	2_2_00EE50E3
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE49F9	2_2_00EE49F9
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE44F1	2_2_00EE44F1
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE47D4	2_2_00EE47D4
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE758E	2_2_00EE758E
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE4C8F	2_2_00EE4C8F
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE499D	2_2_00EE499D
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE4F9D	2_2_00EE4F9D
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE4291	2_2_00EE4291
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE536F	2_2_00EE536F
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE4544	2_2_00EE4544
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE505D	2_2_00EE505D
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE4B5B	2_2_00EE4B5B
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE5459	2_2_00EE5459
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE4F2F	2_2_00EE4F2F
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE4936	2_2_00EE4936
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE4630	2_2_00EE4630
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE470F	2_2_00EE470F
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_00EE5000	2_2_00EE5000

Source: U22p1GcCSb.exe, 00000000.00000002.1256459948.00000000014FE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs U22p1GcCSb.exe

Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: shfolder.dll	Jump to behavior

Source: U22p1GcCSb.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: U22p1GcCSb.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: U22p1GcCSb.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: U22p1GcCSb.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: U22p1GcCSb.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\system.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\system.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\system.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\system.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Notepad.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Notepad.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.spre.phis.troj.adwa.evad.winEXE@16/25@4/4

Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_0074BDA6 AdjustTokenPrivileges,		2_2_0074BDA6
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_0074BD6F AdjustTokenPrivileges,		2_2_0074BD6F

Source: C:\Users\user\AppData\Roaming\server.exe

File created: C:\Program Files (x86)\Explower.exe

Jump to behavior

Source: C:\Users\user\Desktop\U22p1GcCSb.exe

File created: C:\Users\user\AppData\Roaming\app

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7944:120:WilError_03
Source: C:\Users\user\AppData\Roaming\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7300:120:WilError_03
Source: C:\Users\user\AppData\Roaming\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\7330bac122947b8db6af3ae8d6783a41

Source: C:\Users\user\Desktop\U22p1GcCSb.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Jump to behavior

Source: U22p1GcCSb.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: U22p1GcCSb.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\U22p1GcCSb.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\U22p1GcCSb.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: U22p1GcCSb.exe	ReversingLabs: Detection: 81%
Source: U22p1GcCSb.exe	Virustotal: Detection: 73%

Source: C:\Users\user\Desktop\U22p1GcCSb.exe

File read: C:\Users\user\Desktop\U22p1GcCSb.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\U22p1GcCSb.exe C:\Users\user\Desktop\U22p1GcCSb.exe
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process created: C:\Users\user\AppData\Roaming\server.exe "C:\Users\user\AppData\Roaming\server.exe"
Source: C:\Users\user\AppData\Roaming\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\AppData\Roaming\server.exe"
Source: C:\Users\user\AppData\Roaming\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe"
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process created: C:\Users\user\AppData\Roaming\server.exe "C:\Users\user\AppData\Roaming\server.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\AppData\Roaming\server.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE	Jump to behavior

Source: C:\Users\user\AppData\Roaming\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\U22p1GcCSb.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: U22p1GcCSb.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\U22p1GcCSb.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: U22p1GcCSb.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: U22p1GcCSb.exe, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: server.exe.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe0.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe1.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe2.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe3.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe4.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe5.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe6.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_05C30F8B push cs; ret	2_2_05C30F8E
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_05C3077F push es; ret	2_2_05C30782
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_05C3177F push ss; ret	2_2_05C31782
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_05C31F20 push ds; ret	2_2_05C31F22
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 2_2_05C31F25 push ds; ret	2_2_05C31F26
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Code function: 22_2_00DF37E1 push ss; retf 0000h	22_2_00DF37E2

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Roaming\server.exe

File created: C:\Users\user\Documents\Explower.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\system.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\Desktop\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to dropped file
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	File created: C:\Users\user\AppData\Roaming\server.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Notepad.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\Favorites\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Windows\SysWOW64\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\Documents\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Program Files (x86)\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Umbrella.flv.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Local\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\server.exe

File created: C:\Program Files (x86)\Explower.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\server.exe

File created: C:\Windows\SysWOW64\Explower.exe

Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\server.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Jump to behavior

Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Memory allocated: 1940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Memory allocated: 3580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Memory allocated: 5580000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 4860000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 5B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 6B80000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 6EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 7EB0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 8110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 9110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: A110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: B110000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: B5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: C5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: D5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: E5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: F5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 105D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 115D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 125D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 135D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 13F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 14F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 15F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 16F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 17F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 18F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 19F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1AF50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: B250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1BF50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1CF50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1DF50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1EF50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1FF50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 20F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 21F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 22F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 23F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 24F50000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 26240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 27240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 28240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 29240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 2A240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 2B240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 2C240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 2D240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 135D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 145D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 155D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 165D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 175D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 185D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 195D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1A5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1B5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1C5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1D5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1E5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1F5D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 205D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 215D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 225D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 235D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: CE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: DE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: EE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: FE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 10E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 11E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 12E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 13E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 14E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 15E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 16E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 17E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 18E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 19E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1AE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1BE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1CE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1DE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1EE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1FE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 20E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 21E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 22E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 23E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 2E240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 2F240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 30240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 31240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 111D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: DBD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: ED10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 121D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 131D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 141D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 151D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 161D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 171D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 181D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 191D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1A1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1B1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1C1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1D1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1E1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 1F1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 201D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 211D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 221D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 231D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 124D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 134D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 144D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 32240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 33240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 34240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 35240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 36240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Memory allocated: 37240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Memory allocated: A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Memory allocated: 4AA0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: 830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: 4940000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Memory allocated: C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Memory allocated: E20000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\server.exe	Window / User API: threadDelayed 386	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Window / User API: threadDelayed 2310	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Window / User API: threadDelayed 2351	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Window / User API: foregroundWindowGot 362	Jump to behavior

Source: C:\Users\user\Desktop\U22p1GcCSb.exe TID: 7652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe TID: 8180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe TID: 7184	Thread sleep time: -1155000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe TID: 7184	Thread sleep time: -1175500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe TID: 7884	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe TID: 7340	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe TID: 7824	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\U22p1GcCSb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\	Jump to behavior

Source: netsh.exe, 00000007.00000002.1277157562.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000003.1352540513.0000000000761000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
Source: netsh.exe, 0000000A.00000003.1343761186.0000000000C91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: server.exe, 00000002.00000002.3706026943.0000000006E8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\server.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\server.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\U22p1GcCSb.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\U22p1GcCSb.exe

Process created: C:\Users\user\AppData\Roaming\server.exe "C:\Users\user\AppData\Roaming\server.exe"

Jump to behavior

Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:58:36 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 14:07:37 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:04 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:11 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/12 \| 00:05:07 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:31 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:58:29 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 14:43:39 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:24 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/12 \| 01:01:42 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:58:02 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 14:00:33 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 14:01:37 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 16:37:18 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:59:54 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 19:36:55 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:23 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:58:42 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:40 - Program Manager
Source: U22p1GcCSb.exe, 00000000.00000002.1256975107.00000000035B3000.00000004.00000800.00020000.00000000.sdmp, U22p1GcCSb.exe, 00000000.00000002.1256975107.0000000003581000.00000004.00000800.00020000.00000000.sdmp, 7330bac122947b8db6af3ae8d6783a41Windows Update.exe, 00000012.00000002.1456137029.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -jledProgram Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:58:08 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 15:11:26 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:10 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:53 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:43 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:59 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/14 \| 14:03:16 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 14:00:47 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:58:44 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:02 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:42 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:38 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 16:10:15 - Program Manager
Source: U22p1GcCSb.exe, 00000000.00000002.1256975107.00000000035B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:01 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/12 \| 05:38:31 - Program Manager
Source: U22p1GcCSb.exe, 00000000.00000002.1256975107.00000000035B3000.00000004.00000800.00020000.00000000.sdmp, U22p1GcCSb.exe, 00000000.00000002.1256975107.0000000003581000.00000004.00000800.00020000.00000000.sdmp, U22p1GcCSb.exe, 00000000.00000002.1257363082.000000000590B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: U22p1GcCSb.exe, system.exe.2.dr, Notepad.exe.2.dr, Explower.exe7.2.dr, Explower.exe2.2.dr, Explower.exe5.2.dr, Microsoft Corporation.exe.2.dr, Explower.exe4.2.dr, Explower.exe0.2.dr, 7330bac122947b8db6af3ae8d6783a41Windows Update.exe.2.dr, Explower.exe8.2.dr	Binary or memory string: ProgMan
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:58:33 - Program Manager
Source: 7330bac122947b8db6af3ae8d6783a41Windows Update.exe, 00000012.00000002.1456137029.0000000002AD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager\Ojl
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:58:19 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp, 7330bac122947b8db6af3ae8d6783a41Windows Update.exe, 00000012.00000002.1456137029.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:21 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:41 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:47 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:58:05 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:39 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:13 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 17:54:14 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 14:59:06 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:58:38 - Program Manager
Source: U22p1GcCSb.exe, system.exe.2.dr, Notepad.exe.2.dr, Explower.exe7.2.dr, Explower.exe2.2.dr, Explower.exe5.2.dr, Microsoft Corporation.exe.2.dr, Explower.exe4.2.dr, Explower.exe0.2.dr, 7330bac122947b8db6af3ae8d6783a41Windows Update.exe.2.dr, Explower.exe8.2.dr	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: U22p1GcCSb.exe, 00000000.00000002.1257363082.000000000590B000.00000004.00000010.00020000.00000000.sdmp, Microsoft Corporation.exe, 00000016.00000002.1620771348.0000000004E7B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dProgram Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:56 - Program Manager
Source: U22p1GcCSb.exe, system.exe.2.dr, Notepad.exe.2.dr, Explower.exe7.2.dr, Explower.exe2.2.dr, Explower.exe5.2.dr, Microsoft Corporation.exe.2.dr, Explower.exe4.2.dr, Explower.exe0.2.dr, 7330bac122947b8db6af3ae8d6783a41Windows Update.exe.2.dr, Explower.exe8.2.dr	Binary or memory string: Shell_TrayWnd
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 15:17:37 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:05 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:58:01 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/12 \| 03:05:39 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 15:34:56 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:57:25 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/12 \| 07:48:48 - Program Manager
Source: server.exe, 00000002.00000002.3698774456.000000000286E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/11 \| 13:59:42 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Contains functionality to disable the Task Manager (.Net Source)

Source: U22p1GcCSb.exe, Fransesco.cs	.Net Code: INS
Source: server.exe.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe0.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe1.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe2.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe3.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe4.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe5.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe6.2.dr, Fransesco.cs	.Net Code: INS

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\AppData\Roaming\server.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Disables zone checking for all users

Source: C:\Users\user\AppData\Roaming\server.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\AppData\Roaming\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Roaming\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: U22p1GcCSb.exe, type: SAMPLE
Source: Yara match	File source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: U22p1GcCSb.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 7740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7330bac122947b8db6af3ae8d6783a41Windows Update.exe PID: 1472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED
Source: Yara match	File source: C:\system.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: U22p1GcCSb.exe, type: SAMPLE
Source: Yara match	File source: 0.0.U22p1GcCSb.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: U22p1GcCSb.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 7740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7330bac122947b8db6af3ae8d6783a41Windows Update.exe PID: 1472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED
Source: Yara match	File source: C:\system.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	21 Replication Through Removable Media	Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	1 Access Token Manipulation	32 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Process Injection	51 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
U22p1GcCSb.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
U22p1GcCSb.exe	74%	Virustotal		Browse
U22p1GcCSb.exe	100%	Avira	TR/Dropper.Gen
U22p1GcCSb.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\system.exe	100%	Avira	TR/Dropper.Gen
C:\Notepad.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Umbrella.flv.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\server.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\system.exe	100%	Joe Sandbox ML
C:\Notepad.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Umbrella.flv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\server.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Notepad.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Notepad.exe	74%	Virustotal		Browse
C:\Program Files (x86)\Explower.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Program Files (x86)\Explower.exe	74%	Virustotal		Browse
C:\Umbrella.flv.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Umbrella.flv.exe	74%	Virustotal		Browse
C:\Users\user\AppData\Local\Explower.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Explower.exe	74%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	74%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	74%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	74%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe	74%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	74%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	74%	Virustotal		Browse
C:\Users\user\AppData\Roaming\server.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\server.exe	74%	Virustotal		Browse
C:\Users\user\Desktop\Explower.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\Desktop\Explower.exe	74%	Virustotal		Browse
C:\Users\user\Documents\Explower.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\Documents\Explower.exe	74%	Virustotal		Browse
C:\Users\user\Favorites\Explower.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\Favorites\Explower.exe	74%	Virustotal		Browse
C:\Windows\SysWOW64\Explower.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Windows\SysWOW64\Explower.exe	74%	Virustotal		Browse
C:\system.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\system.exe	74%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
6.tcp.eu.ngrok.io	11%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
6.tcp.eu.ngrok.io	3.66.38.117	true	true	11%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.66.38.117	6.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true
52.28.247.255	unknown	United States	16509	AMAZON-02US	true
18.197.239.109	unknown	United States	16509	AMAZON-02US	true
3.68.171.119	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1406594
Start date and time:	2024-03-11 13:56:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	U22p1GcCSb.exe renamed because original name is a hash value
Original Sample Name:	0a5ef41dd9cdbad5c5aaf4ca7b177700.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.adwa.evad.winEXE@16/25@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 139 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:57:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe
13:57:17	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
13:57:26	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
13:57:42	API Interceptor	167570x Sleep call for process: server.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
3.66.38.117	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse
	ziTLBa3N50.exe	Get hash	malicious	Njrat	Browse
	1.exe	Get hash	malicious	Njrat	Browse
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse
	Terraria.exe	Get hash	malicious	Njrat	Browse
	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse
	m5l9v13hIi.exe	Get hash	malicious	Njrat	Browse
	QsKtlzYaKF.exe	Get hash	malicious	Njrat	Browse
	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse
52.28.247.255	M5vARlA2c4.exe	Get hash	malicious	Njrat	Browse
	1.exe	Get hash	malicious	Njrat	Browse
	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse
	QsKtlzYaKF.exe	Get hash	malicious	Njrat	Browse
	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse
	X5eo58PPCB.exe	Get hash	malicious	Njrat	Browse
	ZuXcnAYgVp.exe	Get hash	malicious	Njrat	Browse
	wiUnP1h5Ex.exe	Get hash	malicious	Njrat	Browse
	BqFosj9Wcb.exe	Get hash	malicious	Njrat	Browse
18.197.239.109	Client.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	zyx3qItgQK.exe	Get hash	malicious	Njrat	Browse
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse
	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse
	30b4CoDmKk.exe	Get hash	malicious	Njrat	Browse
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse
	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse
	bRxR.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	ZuXcnAYgVp.exe	Get hash	malicious	Njrat	Browse
3.68.171.119	M5vARlA2c4.exe	Get hash	malicious	Njrat	Browse
	YTYyFVemXR.exe	Get hash	malicious	Njrat	Browse
	zyx3qItgQK.exe	Get hash	malicious	Njrat	Browse
	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse
	m5l9v13hIi.exe	Get hash	malicious	Njrat	Browse
	sCXwkZrcZ3.exe	Get hash	malicious	Njrat	Browse
	X5eo58PPCB.exe	Get hash	malicious	Njrat	Browse
	wiUnP1h5Ex.exe	Get hash	malicious	Njrat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6.tcp.eu.ngrok.io	Client.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	3.69.157.220
	M5vARlA2c4.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	YTYyFVemXR.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	zyx3qItgQK.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	ziTLBa3N50.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	1.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	Terraria.exe	Get hash	malicious	Njrat	Browse	3.66.38.117

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://tbyvhszminlmkuuwnrfkaos.s3.eu-west-2.amazonaws.com/url.html	Get hash	malicious	Phisher	Browse	52.95.148.118
	Qr03qxnwhC.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.249.145.219
	https://sourceforge.net/projects/docfetcher/files/docfetcher/1.1.25/docfetcher_1.1.25_win32_setup.exe/download	Get hash	malicious	Unknown	Browse	13.226.210.86
	g0mgJJSvHD.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.243.160.129
	aLbc2QiwYI.exe	Get hash	malicious	Njrat	Browse	18.192.31.165
	FOS2UmYQkF.exe	Get hash	malicious	Njrat	Browse	18.158.249.75
	CtEeMS3H62.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse	76.223.105.230
	7ssYCeK26Z.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	IDliVBPiHv.elf	Get hash	malicious	Kaiji	Browse	54.171.230.55
	LN1ynNRug5.elf	Get hash	malicious	Mirai, Moobot	Browse	34.249.145.219
AMAZON-02US	https://tbyvhszminlmkuuwnrfkaos.s3.eu-west-2.amazonaws.com/url.html	Get hash	malicious	Phisher	Browse	52.95.148.118
	Qr03qxnwhC.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.249.145.219
	https://sourceforge.net/projects/docfetcher/files/docfetcher/1.1.25/docfetcher_1.1.25_win32_setup.exe/download	Get hash	malicious	Unknown	Browse	13.226.210.86
	g0mgJJSvHD.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.243.160.129
	aLbc2QiwYI.exe	Get hash	malicious	Njrat	Browse	18.192.31.165
	FOS2UmYQkF.exe	Get hash	malicious	Njrat	Browse	18.158.249.75
	CtEeMS3H62.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse	76.223.105.230
	7ssYCeK26Z.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	IDliVBPiHv.elf	Get hash	malicious	Kaiji	Browse	54.171.230.55
	LN1ynNRug5.elf	Get hash	malicious	Mirai, Moobot	Browse	34.249.145.219
AMAZON-02US	https://tbyvhszminlmkuuwnrfkaos.s3.eu-west-2.amazonaws.com/url.html	Get hash	malicious	Phisher	Browse	52.95.148.118
	Qr03qxnwhC.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.249.145.219
	https://sourceforge.net/projects/docfetcher/files/docfetcher/1.1.25/docfetcher_1.1.25_win32_setup.exe/download	Get hash	malicious	Unknown	Browse	13.226.210.86
	g0mgJJSvHD.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.243.160.129
	aLbc2QiwYI.exe	Get hash	malicious	Njrat	Browse	18.192.31.165
	FOS2UmYQkF.exe	Get hash	malicious	Njrat	Browse	18.158.249.75
	CtEeMS3H62.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse	76.223.105.230
	7ssYCeK26Z.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	IDliVBPiHv.elf	Get hash	malicious	Kaiji	Browse	54.171.230.55
	LN1ynNRug5.elf	Get hash	malicious	Mirai, Moobot	Browse	34.249.145.219
AMAZON-02US	https://tbyvhszminlmkuuwnrfkaos.s3.eu-west-2.amazonaws.com/url.html	Get hash	malicious	Phisher	Browse	52.95.148.118
	Qr03qxnwhC.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.249.145.219
	https://sourceforge.net/projects/docfetcher/files/docfetcher/1.1.25/docfetcher_1.1.25_win32_setup.exe/download	Get hash	malicious	Unknown	Browse	13.226.210.86
	g0mgJJSvHD.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.243.160.129
	aLbc2QiwYI.exe	Get hash	malicious	Njrat	Browse	18.192.31.165
	FOS2UmYQkF.exe	Get hash	malicious	Njrat	Browse	18.158.249.75
	CtEeMS3H62.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse	76.223.105.230
	7ssYCeK26Z.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	IDliVBPiHv.elf	Get hash	malicious	Kaiji	Browse	54.171.230.55
	LN1ynNRug5.elf	Get hash	malicious	Mirai, Moobot	Browse	34.249.145.219

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Notepad.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Notepad.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Notepad.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Notepad.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Notepad.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Program Files (x86)\Explower.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Umbrella.flv.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Umbrella.flv.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Umbrella.flv.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Umbrella.flv.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Umbrella.flv.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Explower.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\7330bac122947b8db6af3ae8d6783a41Windows Update.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Explower.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Microsoft Corporation.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\U22p1GcCSb.exe.log

Download File

Process:	C:\Users\user\Desktop\U22p1GcCSb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\app

Download File

Process:	C:\Users\user\Desktop\U22p1GcCSb.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:yn:yn
MD5:	24E9E7D7EEA4DE90C8FC67AE1145ABF2
SHA1:	DD9BB46CCC6340CA892CF17EBE32B9BDBADEE2D1
SHA-256:	BD6C1D15579254E8879ADA07376F93CB2E959F45670374892FDE2EFAF4194F6C
SHA-512:	5572AFD61C7BA666515A987F23AD0A05AB753BDC28CFA492ADB30200207427A4A38699D3B7981E0750414775A4CE72A209511951D38A8673C709B08774FCA01F
Malicious:	false
Preview:	.11

C:\Users\user\AppData\Roaming\server.exe

Download File

Process:	C:\Users\user\Desktop\U22p1GcCSb.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\server.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\server.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\server.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Desktop\Explower.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Documents\Explower.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Favorites\Explower.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Windows\SysWOW64\Explower.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\autorun.inf

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	Microsoft Windows Autorun file
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.474554204780528
Encrypted:	false
SSDEEP:	3:It1KV2PHQCyK0x:e1KAwCyD
MD5:	40B1630BE21F39CB17BD1963CAE5A207
SHA1:	63C14BD151D42820DD45C033363FA5B9E1D34124
SHA-256:	F87E55F1A423B65FD639146F71F6027DBD4D6E69B65D9A17F1744774AA6589E1
SHA-512:	833112ED4A9A3C621D2FFFC78F83502B2937B82A2CF9BC692D75D907CE2AA46C2D97CFE23C402DB3292B2DD2655FF8692C3CD00D5BA4D792C3D8AF24958E1926
Malicious:	true
Preview:	[autorun]..open=C:\Umbrella.flv.exe..shellexecute=C:\..

C:\system.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.557340269197646
Encrypted:	false
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
MD5:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
SHA1:	AB67841AAEC06B8527596203C2C426E6F59B0470
SHA-256:	72FEACA614E6E82FA5EFD6D8795D68223FEF6054EE898AD9CDAED71194A88C8D
SHA-512:	D1B2E87C510BD0DF4C801572DABFE14C6CE04B7FFAC5883B3A26CF21A252369C026E878A3FEE1D5BB0E5402B0D94146149F2DA8418099DE5AFD63B4DC7FCA653
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\system.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\system.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\system.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\system.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\system.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.557340269197646
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	U22p1GcCSb.exe
File size:	95'232 bytes
MD5:	0a5ef41dd9cdbad5c5aaf4ca7b177700
SHA1:	ab67841aaec06b8527596203c2c426e6f59b0470
SHA256:	72feaca614e6e82fa5efd6d8795d68223fef6054ee898ad9cdaed71194a88c8d
SHA512:	d1b2e87c510bd0df4c801572dabfe14c6ce04b7ffac5883b3a26cf21a252369c026e878a3fee1d5bb0e5402b0d94146149f2da8418099de5afd63b4dc7fca653
SSDEEP:	768:uY35sTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3PsGdpKgM:7s7kVbPGHz88Eb71pjEwzGi1dD7DKgS
TLSH:	4A93D84977E56524E1BF5AF75471F2004E34B48B1602E39D88F218AA1A33AC44F99FEB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.................p............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x418efe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64F0D6BD [Thu Aug 31 18:06:53 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18eac	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16f04	0x17000	e687a70f31430dc5bac78782b1fb2d58	False	0.3680579144021739	data	5.5890604802345525	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	02466978873e232bef309f048b95192f	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/11/24-13:57:55.365233	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49723	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:57.972581	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49724	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:10.905781	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49703	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:48.181665	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49721	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:52.998127	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49722	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:00.582904	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49725	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:13.390092	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49704	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:45.527575	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49720	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:03.810011	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49727	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:06.238601	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49728	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:17.866686	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49705	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:20.184506	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49707	13672	192.168.2.10	3.66.38.117
03/11/24-13:59:43.174186	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49751	13672	192.168.2.10	52.28.247.255
03/11/24-14:00:44.353987	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49762	13672	192.168.2.10	3.68.171.119
03/11/24-13:57:31.511033	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49715	13672	192.168.2.10	3.66.38.117
03/11/24-13:59:08.861139	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49744	13672	192.168.2.10	18.197.239.109
03/11/24-13:59:11.494367	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49745	13672	192.168.2.10	18.197.239.109
03/11/24-13:59:40.524865	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49750	13672	192.168.2.10	52.28.247.255
03/11/24-13:59:59.718993	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49753	13672	192.168.2.10	52.28.247.255
03/11/24-13:57:37.885075	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49717	13672	192.168.2.10	3.66.38.117
03/11/24-13:59:05.101000	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49743	13672	192.168.2.10	18.197.239.109
03/11/24-13:57:40.494203	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49718	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:43.148380	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49719	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:49.035267	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49740	13672	192.168.2.10	18.197.239.109
03/11/24-13:58:51.830869	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49741	13672	192.168.2.10	18.197.239.109
03/11/24-13:58:36.746964	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49737	13672	192.168.2.10	18.197.239.109
03/11/24-13:58:58.414340	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49742	13672	192.168.2.10	18.197.239.109
03/11/24-13:58:31.179034	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49736	13672	192.168.2.10	18.197.239.109
03/11/24-13:58:00.884094	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49725	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:28.707084	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49714	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:58.274652	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49724	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:55.667281	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49723	13672	192.168.2.10	3.66.38.117
03/11/24-14:00:33.042782	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49760	13672	192.168.2.10	3.68.171.119
03/11/24-13:57:26.008083	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49713	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:30.876607	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49736	13672	192.168.2.10	18.197.239.109
03/11/24-13:57:48.411158	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49721	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:23.387503	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49711	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:36.488277	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49737	13672	192.168.2.10	18.197.239.109
03/11/24-13:58:39.527868	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49738	13672	192.168.2.10	18.197.239.109
03/11/24-13:57:45.787003	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49720	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:45.841985	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49739	13672	192.168.2.10	18.197.239.109
03/11/24-13:57:25.706252	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49713	13672	192.168.2.10	3.66.38.117
03/11/24-14:00:30.357471	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49759	13672	192.168.2.10	3.68.171.119
03/11/24-13:57:28.403515	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49714	13672	192.168.2.10	3.66.38.117
03/11/24-14:00:41.703341	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49761	13672	192.168.2.10	3.68.171.119
03/11/24-13:57:23.086932	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49711	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:31.210284	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49715	13672	192.168.2.10	3.66.38.117
03/11/24-14:00:44.051573	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49762	13672	192.168.2.10	3.68.171.119
03/11/24-13:57:37.582749	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49717	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:35.262290	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49716	13672	192.168.2.10	3.66.38.117
03/11/24-13:57:40.192791	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49718	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:28.032861	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49735	13672	192.168.2.10	18.197.239.109
03/11/24-13:57:13.692255	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49704	13672	192.168.2.10	3.66.38.117
03/11/24-13:59:17.004618	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49747	13672	192.168.2.10	52.28.247.255
03/11/24-13:58:20.488277	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49733	13672	192.168.2.10	18.197.239.109
03/11/24-13:58:23.099308	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49734	13672	192.168.2.10	18.197.239.109
03/11/24-13:59:21.876862	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49748	13672	192.168.2.10	52.28.247.255
03/11/24-13:58:17.878508	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49732	13672	192.168.2.10	18.197.239.109
03/11/24-13:59:31.590664	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49749	13672	192.168.2.10	52.28.247.255
03/11/24-13:58:09.186733	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49729	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:12.641935	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49730	13672	192.168.2.10	18.197.239.109
03/11/24-13:57:20.486728	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49707	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:06.541661	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49728	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:15.255220	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49731	13672	192.168.2.10	18.197.239.109
03/11/24-14:00:32.739203	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49760	13672	192.168.2.10	3.68.171.119
03/11/24-13:59:22.150528	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49748	13672	192.168.2.10	52.28.247.255
03/11/24-13:59:40.223106	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49750	13672	192.168.2.10	52.28.247.255
03/11/24-14:00:17.380683	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49757	13672	192.168.2.10	52.28.247.255
03/11/24-13:59:14.671406	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49746	13672	192.168.2.10	52.28.247.255
03/11/24-13:59:17.306266	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49747	13672	192.168.2.10	52.28.247.255
03/11/24-13:59:42.872534	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49751	13672	192.168.2.10	52.28.247.255
03/11/24-13:59:56.068201	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49752	13672	192.168.2.10	52.28.247.255
03/11/24-13:58:23.402360	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49734	13672	192.168.2.10	18.197.239.109
03/11/24-13:59:11.796875	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49745	13672	192.168.2.10	18.197.239.109
03/11/24-13:58:15.559318	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49731	13672	192.168.2.10	18.197.239.109
03/11/24-13:58:58.717130	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49742	13672	192.168.2.10	18.197.239.109
03/11/24-14:00:08.210628	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49755	13672	192.168.2.10	52.28.247.255
03/11/24-14:00:02.370471	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49754	13672	192.168.2.10	52.28.247.255
03/11/24-14:00:10.893695	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49756	13672	192.168.2.10	52.28.247.255
03/11/24-13:58:20.790475	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49733	13672	192.168.2.10	18.197.239.109
03/11/24-13:59:09.163778	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49744	13672	192.168.2.10	18.197.239.109
03/11/24-13:58:18.179511	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49732	13672	192.168.2.10	18.197.239.109
03/11/24-13:59:05.403490	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49743	13672	192.168.2.10	18.197.239.109
03/11/24-14:00:17.081352	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49757	13672	192.168.2.10	52.28.247.255
03/11/24-13:59:14.496224	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49746	13672	192.168.2.10	52.28.247.255
03/11/24-14:00:25.827295	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49758	13672	192.168.2.10	3.68.171.119
03/11/24-13:57:42.903315	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49719	13672	192.168.2.10	3.66.38.117
03/11/24-13:58:08.885686	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49729	13672	192.168.2.10	3.66.38.117
03/11/24-14:00:07.909379	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49755	13672	192.168.2.10	52.28.247.255
03/11/24-14:00:10.590931	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49756	13672	192.168.2.10	52.28.247.255
03/11/24-13:58:12.944215	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49730	13672	192.168.2.10	18.197.239.109
03/11/24-13:58:52.029514	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49741	13672	192.168.2.10	18.197.239.109
03/11/24-14:00:30.052643	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49759	13672	192.168.2.10	3.68.171.119
03/11/24-13:59:59.415669	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49753	13672	192.168.2.10	52.28.247.255
03/11/24-14:00:02.066515	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49754	13672	192.168.2.10	52.28.247.255
03/11/24-13:58:49.337814	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49740	13672	192.168.2.10	18.197.239.109

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2024 13:57:09.645006895 CET	49703	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:09.947551966 CET	13672	49703	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:09.947696924 CET	49703	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:10.250400066 CET	13672	49703	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:10.250636101 CET	49703	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:10.905781031 CET	49703	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:11.208283901 CET	13672	49703	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:13.085860014 CET	49704	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:13.388524055 CET	13672	49704	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:13.388621092 CET	49704	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:13.390091896 CET	49704	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:13.692145109 CET	13672	49704	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:13.692255020 CET	49704	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:13.692562103 CET	13672	49704	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:13.994998932 CET	13672	49704	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:15.700782061 CET	49705	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:16.002398014 CET	13672	49705	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:16.002540112 CET	49705	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:16.304155111 CET	13672	49705	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:16.304260969 CET	49705	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:17.866686106 CET	49705	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:18.168008089 CET	13672	49705	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:19.881009102 CET	49707	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:20.183681011 CET	13672	49707	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:20.183769941 CET	49707	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:20.184505939 CET	49707	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:20.486643076 CET	13672	49707	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:20.486727953 CET	49707	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:20.487020969 CET	13672	49707	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:20.790882111 CET	13672	49707	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:22.784390926 CET	49711	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:23.085717916 CET	13672	49711	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:23.085916042 CET	49711	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:23.086931944 CET	49711	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:23.387434959 CET	13672	49711	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:23.387502909 CET	49711	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:23.388139009 CET	13672	49711	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:23.688759089 CET	13672	49711	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:25.403351068 CET	49713	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:25.705478907 CET	13672	49713	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:25.705666065 CET	49713	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:25.706252098 CET	49713	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:26.008016109 CET	13672	49713	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:26.008083105 CET	49713	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:26.008269072 CET	13672	49713	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:26.310225964 CET	13672	49713	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:28.098973036 CET	49714	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:28.402806044 CET	13672	49714	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:28.402898073 CET	49714	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:28.403515100 CET	49714	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:28.706772089 CET	13672	49714	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:28.707003117 CET	13672	49714	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:28.707083941 CET	49714	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:29.010780096 CET	13672	49714	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:30.902940035 CET	49715	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:31.206784010 CET	13672	49715	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:31.206885099 CET	49715	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:31.210283995 CET	49715	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:31.510900974 CET	13672	49715	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:31.511033058 CET	49715	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:31.514084101 CET	13672	49715	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:31.814663887 CET	13672	49715	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:33.837455988 CET	49716	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:34.138740063 CET	13672	49716	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:34.138828993 CET	49716	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:34.440287113 CET	13672	49716	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:34.440396070 CET	49716	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:35.262290001 CET	49716	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:35.563515902 CET	13672	49716	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:37.279566050 CET	49717	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:37.581957102 CET	13672	49717	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:37.582092047 CET	49717	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:37.582748890 CET	49717	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:37.884744883 CET	13672	49717	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:37.885073900 CET	13672	49717	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:37.885075092 CET	49717	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:38.187553883 CET	13672	49717	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:39.890285969 CET	49718	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:40.192110062 CET	13672	49718	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:40.192220926 CET	49718	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:40.192790985 CET	49718	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:40.494117975 CET	13672	49718	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:40.494203091 CET	49718	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:40.494329929 CET	13672	49718	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:40.796051979 CET	13672	49718	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:42.543217897 CET	49719	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:42.845766068 CET	13672	49719	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:42.845854044 CET	49719	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:42.903315067 CET	49719	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:43.148163080 CET	13672	49719	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:43.148380041 CET	49719	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:43.205451012 CET	13672	49719	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:43.450644970 CET	13672	49719	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:45.183165073 CET	49720	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:45.484903097 CET	13672	49720	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:45.484978914 CET	49720	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:45.527575016 CET	49720	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:45.786851883 CET	13672	49720	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:45.787003040 CET	49720	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:45.830986023 CET	13672	49720	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:46.088855028 CET	13672	49720	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:47.807840109 CET	49721	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:48.109126091 CET	13672	49721	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:48.109353065 CET	49721	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:48.181664944 CET	49721	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:48.411067009 CET	13672	49721	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:48.411158085 CET	49721	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:48.483130932 CET	13672	49721	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:48.712657928 CET	13672	49721	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:50.421475887 CET	49722	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:50.723081112 CET	13672	49722	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:50.723298073 CET	49722	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:51.024945021 CET	13672	49722	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:51.025039911 CET	49722	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:52.998126984 CET	49722	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:53.299704075 CET	13672	49722	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:55.061574936 CET	49723	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:55.364404917 CET	13672	49723	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:55.364548922 CET	49723	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:55.365232944 CET	49723	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:55.667160034 CET	13672	49723	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:55.667280912 CET	49723	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:55.667505026 CET	13672	49723	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:55.969821930 CET	13672	49723	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:57.669158936 CET	49724	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:57.971760988 CET	13672	49724	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:57.971893072 CET	49724	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:57.972580910 CET	49724	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:58.274547100 CET	13672	49724	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:58.274652004 CET	49724	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:57:58.274946928 CET	13672	49724	3.66.38.117	192.168.2.10
Mar 11, 2024 13:57:58.577326059 CET	13672	49724	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:00.279340029 CET	49725	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:00.581954956 CET	13672	49725	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:00.582144022 CET	49725	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:00.582904100 CET	49725	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:00.883681059 CET	13672	49725	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:00.884088039 CET	13672	49725	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:00.884094000 CET	49725	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:01.185262918 CET	13672	49725	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:03.014173031 CET	49727	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:03.317982912 CET	13672	49727	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:03.318089008 CET	49727	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:03.622334003 CET	13672	49727	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:03.622405052 CET	49727	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:03.810010910 CET	49727	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:04.113915920 CET	13672	49727	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:05.934539080 CET	49728	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:06.237926006 CET	13672	49728	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:06.238025904 CET	49728	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:06.238600969 CET	49728	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:06.541533947 CET	13672	49728	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:06.541661024 CET	49728	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:06.541709900 CET	13672	49728	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:06.844878912 CET	13672	49728	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:08.583369017 CET	49729	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:08.884912014 CET	13672	49729	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:08.885025978 CET	49729	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:08.885685921 CET	49729	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:09.186614990 CET	13672	49729	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:09.186733007 CET	49729	13672	192.168.2.10	3.66.38.117
Mar 11, 2024 13:58:09.186995029 CET	13672	49729	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:09.488308907 CET	13672	49729	3.66.38.117	192.168.2.10
Mar 11, 2024 13:58:12.338223934 CET	49730	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:12.640997887 CET	13672	49730	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:12.641109943 CET	49730	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:12.641935110 CET	49730	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:12.943979979 CET	13672	49730	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:12.944215059 CET	49730	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:12.944384098 CET	13672	49730	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:13.246992111 CET	13672	49730	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:14.950637102 CET	49731	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:15.254528046 CET	13672	49731	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:15.254653931 CET	49731	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:15.255219936 CET	49731	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:15.559189081 CET	13672	49731	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:15.559252024 CET	13672	49731	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:15.559318066 CET	49731	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:15.863009930 CET	13672	49731	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:17.575287104 CET	49732	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:17.877708912 CET	13672	49732	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:17.877844095 CET	49732	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:17.878508091 CET	49732	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:18.179378986 CET	13672	49732	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:18.179511070 CET	49732	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:18.179759026 CET	13672	49732	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:18.480838060 CET	13672	49732	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:20.184632063 CET	49733	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:20.487030983 CET	13672	49733	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:20.487292051 CET	49733	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:20.488276958 CET	49733	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:20.790370941 CET	13672	49733	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:20.790461063 CET	13672	49733	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:20.790474892 CET	49733	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:21.092624903 CET	13672	49733	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:22.794888020 CET	49734	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:23.098407984 CET	13672	49734	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:23.098567963 CET	49734	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:23.099308014 CET	49734	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:23.402288914 CET	13672	49734	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:23.402359962 CET	49734	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:23.402631998 CET	13672	49734	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:23.706012964 CET	13672	49734	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:25.443025112 CET	49735	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:25.746617079 CET	13672	49735	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:25.746753931 CET	49735	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:26.050605059 CET	13672	49735	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:26.050704956 CET	49735	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:28.032860994 CET	49735	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:28.336569071 CET	13672	49735	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:30.572118998 CET	49736	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:30.875456095 CET	13672	49736	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:30.875658989 CET	49736	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:30.876606941 CET	49736	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:31.178870916 CET	13672	49736	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:31.179033995 CET	49736	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:31.179409981 CET	13672	49736	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:31.481913090 CET	13672	49736	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:36.143305063 CET	49737	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:36.444757938 CET	13672	49737	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:36.444925070 CET	49737	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:36.488276958 CET	49737	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:36.746718884 CET	13672	49737	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:36.746963978 CET	49737	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:36.789741993 CET	13672	49737	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:37.048332930 CET	13672	49737	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:38.808583975 CET	49738	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:39.111543894 CET	13672	49738	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:39.111787081 CET	49738	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:39.414803028 CET	13672	49738	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:39.414874077 CET	49738	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:39.527868032 CET	49738	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:39.830934048 CET	13672	49738	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:41.848782063 CET	49739	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:42.151618958 CET	13672	49739	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:42.151707888 CET	49739	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:42.454761982 CET	13672	49739	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:42.455029964 CET	49739	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:45.841984987 CET	49739	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:46.144819975 CET	13672	49739	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:48.731004000 CET	49740	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:49.034123898 CET	13672	49740	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:49.034250975 CET	49740	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:49.035267115 CET	49740	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:49.337562084 CET	13672	49740	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:49.337814093 CET	49740	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:49.338061094 CET	13672	49740	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:49.640866041 CET	13672	49740	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:51.424014091 CET	49741	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:51.726561069 CET	13672	49741	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:51.726707935 CET	49741	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:51.830868959 CET	49741	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:52.029422998 CET	13672	49741	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:52.029514074 CET	49741	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:52.133250952 CET	13672	49741	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:52.331893921 CET	13672	49741	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:58.109159946 CET	49742	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:58.413026094 CET	13672	49742	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:58.413211107 CET	49742	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:58.414340019 CET	49742	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:58.717036963 CET	13672	49742	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:58.717129946 CET	49742	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:58:58.717698097 CET	13672	49742	18.197.239.109	192.168.2.10
Mar 11, 2024 13:58:59.021668911 CET	13672	49742	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:04.797328949 CET	49743	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:05.100234985 CET	13672	49743	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:05.100347996 CET	49743	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:05.101000071 CET	49743	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:05.403341055 CET	13672	49743	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:05.403490067 CET	49743	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:05.403858900 CET	13672	49743	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:05.706274986 CET	13672	49743	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:08.557496071 CET	49744	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:08.860275030 CET	13672	49744	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:08.860374928 CET	49744	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:08.861139059 CET	49744	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:09.163405895 CET	13672	49744	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:09.163721085 CET	13672	49744	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:09.163778067 CET	49744	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:09.466584921 CET	13672	49744	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:11.190541029 CET	49745	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:11.493544102 CET	13672	49745	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:11.493637085 CET	49745	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:11.494366884 CET	49745	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:11.796794891 CET	13672	49745	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:11.796875000 CET	49745	13672	192.168.2.10	18.197.239.109
Mar 11, 2024 13:59:11.797326088 CET	13672	49745	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:12.099800110 CET	13672	49745	18.197.239.109	192.168.2.10
Mar 11, 2024 13:59:14.062299967 CET	49746	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:14.366671085 CET	13672	49746	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:14.366970062 CET	49746	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:14.496223927 CET	49746	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:14.671315908 CET	13672	49746	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:14.671406031 CET	49746	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:14.800461054 CET	13672	49746	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:14.975611925 CET	13672	49746	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:16.701688051 CET	49747	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:17.003771067 CET	13672	49747	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:17.003935099 CET	49747	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:17.004617929 CET	49747	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:17.306041956 CET	13672	49747	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:17.306240082 CET	13672	49747	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:17.306266069 CET	49747	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:17.608254910 CET	13672	49747	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:21.543081045 CET	49748	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:21.846718073 CET	13672	49748	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:21.847063065 CET	49748	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:21.876862049 CET	49748	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:22.150458097 CET	13672	49748	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:22.150527954 CET	49748	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:22.180015087 CET	13672	49748	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:22.453712940 CET	13672	49748	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:27.320369005 CET	49749	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:27.623827934 CET	13672	49749	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:27.623944998 CET	49749	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:27.927575111 CET	13672	49749	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:27.927844048 CET	49749	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:31.590663910 CET	49749	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:31.894100904 CET	13672	49749	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:39.919795990 CET	49750	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:40.222042084 CET	13672	49750	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:40.222214937 CET	49750	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:40.223105907 CET	49750	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:40.524707079 CET	13672	49750	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:40.524864912 CET	49750	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:40.525063038 CET	13672	49750	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:40.827114105 CET	13672	49750	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:42.568969965 CET	49751	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:42.871674061 CET	13672	49751	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:42.871812105 CET	49751	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:42.872534037 CET	49751	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:43.174077988 CET	13672	49751	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:43.174185991 CET	49751	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:43.174367905 CET	13672	49751	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:43.476387024 CET	13672	49751	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:47.021269083 CET	49752	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:47.324359894 CET	13672	49752	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:47.324455023 CET	49752	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:47.627574921 CET	13672	49752	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:47.627693892 CET	49752	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:56.068201065 CET	49752	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:56.371258020 CET	13672	49752	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:59.111341953 CET	49753	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:59.414920092 CET	13672	49753	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:59.415178061 CET	49753	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:59.415668964 CET	49753	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 13:59:59.718700886 CET	13672	49753	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:59.718816042 CET	13672	49753	52.28.247.255	192.168.2.10
Mar 11, 2024 13:59:59.718992949 CET	49753	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:00.022591114 CET	13672	49753	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:01.761234999 CET	49754	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:02.065705061 CET	13672	49754	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:02.065793037 CET	49754	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:02.066514969 CET	49754	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:02.370208025 CET	13672	49754	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:02.370471001 CET	49754	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:02.370608091 CET	13672	49754	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:02.674849987 CET	13672	49754	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:07.606574059 CET	49755	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:07.908606052 CET	13672	49755	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:07.908718109 CET	49755	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:07.909379005 CET	49755	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:08.210570097 CET	13672	49755	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:08.210628033 CET	49755	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:08.210998058 CET	13672	49755	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:08.512487888 CET	13672	49755	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:10.286257982 CET	49756	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:10.589849949 CET	13672	49756	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:10.590017080 CET	49756	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:10.590930939 CET	49756	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:10.893604994 CET	13672	49756	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:10.893695116 CET	49756	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:10.893893957 CET	13672	49756	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:11.196926117 CET	13672	49756	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:16.771349907 CET	49757	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:17.075843096 CET	13672	49757	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:17.076132059 CET	49757	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:17.081351995 CET	49757	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:17.380568027 CET	13672	49757	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:17.380682945 CET	49757	13672	192.168.2.10	52.28.247.255
Mar 11, 2024 14:00:17.385586023 CET	13672	49757	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:17.687813997 CET	13672	49757	52.28.247.255	192.168.2.10
Mar 11, 2024 14:00:25.521779060 CET	49758	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:25.826143026 CET	13672	49758	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:25.826369047 CET	49758	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:25.827295065 CET	49758	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:26.131145954 CET	13672	49758	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:29.748328924 CET	49759	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:30.051716089 CET	13672	49759	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:30.051840067 CET	49759	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:30.052643061 CET	49759	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:30.357106924 CET	13672	49759	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:30.357153893 CET	13672	49759	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:30.357470989 CET	49759	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:30.660990953 CET	13672	49759	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:32.433968067 CET	49760	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:32.738195896 CET	13672	49760	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:32.738497019 CET	49760	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:32.739202976 CET	49760	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:33.042680979 CET	13672	49760	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:33.042782068 CET	49760	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:33.042843103 CET	13672	49760	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:33.346991062 CET	13672	49760	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:37.575567007 CET	49761	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:37.878402948 CET	13672	49761	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:37.878504038 CET	49761	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:38.181423903 CET	13672	49761	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:38.181652069 CET	49761	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:41.703341007 CET	49761	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:42.006295919 CET	13672	49761	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:43.747519970 CET	49762	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:44.050623894 CET	13672	49762	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:44.050793886 CET	49762	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:44.051573038 CET	49762	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:44.353816032 CET	13672	49762	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:44.353986979 CET	49762	13672	192.168.2.10	3.68.171.119
Mar 11, 2024 14:00:44.354207993 CET	13672	49762	3.68.171.119	192.168.2.10
Mar 11, 2024 14:00:44.657107115 CET	13672	49762	3.68.171.119	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2024 13:57:09.344049931 CET	52636	53	192.168.2.10	1.1.1.1
Mar 11, 2024 13:57:09.610778093 CET	53	52636	1.1.1.1	192.168.2.10
Mar 11, 2024 13:58:12.168956995 CET	53749	53	192.168.2.10	1.1.1.1
Mar 11, 2024 13:58:12.337052107 CET	53	53749	1.1.1.1	192.168.2.10
Mar 11, 2024 13:59:13.897991896 CET	65276	53	192.168.2.10	1.1.1.1
Mar 11, 2024 13:59:14.060705900 CET	53	65276	1.1.1.1	192.168.2.10
Mar 11, 2024 14:00:21.552649021 CET	56213	53	192.168.2.10	1.1.1.1
Mar 11, 2024 14:00:21.715055943 CET	53	56213	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 11, 2024 13:57:09.344049931 CET	192.168.2.10	1.1.1.1	0x104f	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Mar 11, 2024 13:58:12.168956995 CET	192.168.2.10	1.1.1.1	0xf900	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Mar 11, 2024 13:59:13.897991896 CET	192.168.2.10	1.1.1.1	0xa216	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Mar 11, 2024 14:00:21.552649021 CET	192.168.2.10	1.1.1.1	0x5516	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 11, 2024 13:57:09.610778093 CET	1.1.1.1	192.168.2.10	0x104f	No error (0)	6.tcp.eu.ngrok.io	3.66.38.117	A (IP address)	IN (0x0001)	false
Mar 11, 2024 13:58:12.337052107 CET	1.1.1.1	192.168.2.10	0xf900	No error (0)	6.tcp.eu.ngrok.io	18.197.239.109	A (IP address)	IN (0x0001)	false
Mar 11, 2024 13:59:14.060705900 CET	1.1.1.1	192.168.2.10	0xa216	No error (0)	6.tcp.eu.ngrok.io	52.28.247.255	A (IP address)	IN (0x0001)	false
Mar 11, 2024 14:00:21.715055943 CET	1.1.1.1	192.168.2.10	0x5516	No error (0)	6.tcp.eu.ngrok.io	3.68.171.119	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:57:00
Start date:	11/03/2024
Path:	C:\Users\user\Desktop\U22p1GcCSb.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\U22p1GcCSb.exe
Imagebase:	0xe40000
File size:	95'232 bytes
MD5 hash:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1237415316.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.1257055398.0000000004588000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:57:01
Start date:	11/03/2024
Path:	C:\Users\user\AppData\Roaming\server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\server.exe"
Imagebase:	0x210000
File size:	95'232 bytes
MD5 hash:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\server.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\server.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\server.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs Detection: 74%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	13:57:03
Start date:	11/03/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE
Imagebase:	0x1160000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:57:03
Start date:	11/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:57:05
Start date:	11/03/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall delete allowedprogram "C:\Users\user\AppData\Roaming\server.exe"
Imagebase:	0x1160000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:57:05
Start date:	11/03/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE
Imagebase:	0x1160000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:57:06
Start date:	11/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:57:06
Start date:	11/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:57:16
Start date:	11/03/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe"
Imagebase:	0x8d0000
File size:	95'232 bytes
MD5 hash:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs Detection: 74%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:57:20
Start date:	11/03/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7330bac122947b8db6af3ae8d6783a41Windows Update.exe"
Imagebase:	0x470000
File size:	95'232 bytes
MD5 hash:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:57:25
Start date:	11/03/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe"
Imagebase:	0x2d0000
File size:	95'232 bytes
MD5 hash:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 82%, ReversingLabs Detection: 74%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:57:34
Start date:	11/03/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe"
Imagebase:	0x420000
File size:	95'232 bytes
MD5 hash:	0A5EF41DD9CDBAD5C5AAF4CA7B177700
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs Detection: 74%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	58
Total number of Limit Nodes:	4

Executed Functions

Function 05754298 Relevance: 13.2, Strings: 9, Instructions: 1950
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@Cl, xrefs: 05754582
:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5
@, xrefs: 05754C24

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$@$\Ojl$2jl
API String ID: 0-3089121696
Opcode ID: d6821452e015c46dd4c0f679609d49e207f22a079c4d93d5678f79c3773e0b4e
Instruction ID: 482f7b9dba8e18c4f20b6fc6993539aadd6df79f3097c70e2055db6962b17fda
Opcode Fuzzy Hash: d6821452e015c46dd4c0f679609d49e207f22a079c4d93d5678f79c3773e0b4e
Instruction Fuzzy Hash: 03230374A052288FDB25DF60D8A4BADB7B2FB89304F1081E9D909A7390DF355E89DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05754269 Relevance: 13.0, Strings: 9, Instructions: 1772
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@Cl, xrefs: 05754582
:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
, xrefs: 05754BC4
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$2jl
API String ID: 0-3269062517
Opcode ID: c180e97e71123026adfcab781c9db374a915aad376cd027e89d732f472d5bbec
Instruction ID: 57cd8ecd5293ed69c4f8bf52cc5685bde3f85441c04c28d379b5b2c088d2bff0
Opcode Fuzzy Hash: c180e97e71123026adfcab781c9db374a915aad376cd027e89d732f472d5bbec
Instruction Fuzzy Hash: 3E131774A05228CFDB25DF20D8A4BA9B7B2FB89304F1081EAD90967391DF355E89DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05753803 Relevance: 3.0, Strings: 2, Instructions: 497
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2jl, xrefs: 05753C2E
\Ojl, xrefs: 05753885

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: \Ojl$2jl
API String ID: 0-1695366678
Opcode ID: 28dac57e6a72ca711a385f20b84d9a3a3a1e6e4e6d922003579483b1842b7c34
Instruction ID: 3415f742b706fc380ae308a225886b53bb258e91facae144b8a0655f2fe8825a
Opcode Fuzzy Hash: 28dac57e6a72ca711a385f20b84d9a3a3a1e6e4e6d922003579483b1842b7c34
Instruction Fuzzy Hash: CC32F370A00258CFCB14DF74D954BADB7B2FB89304F1045A9D80AAB3A4DB799E89DF50

Uniqueness

Uniqueness Score: -1.00%

Function 057500B8 Relevance: 2.6, Strings: 2, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2jl, xrefs: 057501A8
2jl, xrefs: 05750154

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: 2jl$2jl
API String ID: 0-1801541598
Opcode ID: e4d7debc39a20d43c44b9523ed6dfd4435da1d6085df2bc99427e62767daf85e
Instruction ID: 48a2998df0809b08363622a88b8045aa6e2093cfd6dd6766384e509ae20ef637
Opcode Fuzzy Hash: e4d7debc39a20d43c44b9523ed6dfd4435da1d6085df2bc99427e62767daf85e
Instruction Fuzzy Hash: 9031F8317043449FD704EBB598916ED3B67ABC3218B14846ED501DB392CF759C0983A5

Uniqueness

Uniqueness Score: -1.00%

Function 05750118 Relevance: 2.6, Strings: 2, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2jl, xrefs: 057501A8
2jl, xrefs: 05750154

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: 2jl$2jl
API String ID: 0-1801541598
Opcode ID: 3d7710ead2cbf9d21c13f592d1d624463e720f2af192cefb72b23a948f17f085
Instruction ID: c665898f07b48175042c1a5122d8323252bead016f65a81be353a2f2c1e129e3
Opcode Fuzzy Hash: 3d7710ead2cbf9d21c13f592d1d624463e720f2af192cefb72b23a948f17f085
Instruction Fuzzy Hash: D21106307042509FC314EBB5A4916ED3B57ABC7218358806FD401CB762CFB58C0D93BA

Uniqueness

Uniqueness Score: -1.00%

Function 0149AA75 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0149AB25

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b66e982cfe4a2a6d674137f16336ca60ce409c9855b5f370b9b167a97057e52b
Instruction ID: efe6ef295e5b8da206e867c578c7b8a88cdda98dae2a6a7241f69e1b1fa1c220
Opcode Fuzzy Hash: b66e982cfe4a2a6d674137f16336ca60ce409c9855b5f370b9b167a97057e52b
Instruction Fuzzy Hash: FB317075509380AFEB22CF25CC45F56BFF8EF05210F09889EEA458B252D375E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0149B036 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0149B0DD

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: d150bebbe379a776d532ac266e4caa82abf0d0a1c50d3ec52744182c9a541d73
Instruction ID: 3bf5c30c5ccbe7fbd7fd1136040b175c86c56fd13d65a65746d16a662f1ca063
Opcode Fuzzy Hash: d150bebbe379a776d532ac266e4caa82abf0d0a1c50d3ec52744182c9a541d73
Instruction Fuzzy Hash: 0A3181B55093809FEB12CB25DC45F66BFF8EF06214F09849AE944CB292D375E909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0149A6CE Relevance: 1.6, APIs: 1, Instructions: 85
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0149A77E

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 51e0828dd67091a732f099fb48b282a2d426ff380951249d6d8fdfe7c4e95d37
Instruction ID: 36b9c4fe280d4d7720ba8d87e7dc04204d1f92cb3d926d099100e142dff4a767
Opcode Fuzzy Hash: 51e0828dd67091a732f099fb48b282a2d426ff380951249d6d8fdfe7c4e95d37
Instruction Fuzzy Hash: C031807104E3C06FD3138B259C61B61BFB4EF47610F0A80DBE884CB6A3D2296919D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0149AE77 Relevance: 1.6, APIs: 1, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,EF1360C4,00000000,00000000,00000000,00000000), ref: 0149AF0D

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b7b0471b082130703b270f9af93a1132d1452b4caa8d656b9f37b409da46de8f
Instruction ID: 564a96aa5dbf1a8a1fe255ea4cc80180b6388f5d11e0d201b76e363621c84a76
Opcode Fuzzy Hash: b7b0471b082130703b270f9af93a1132d1452b4caa8d656b9f37b409da46de8f
Instruction Fuzzy Hash: 982194B6409380AFEB22CF11DC44F56BFB8EF46314F09849AE9449F1A2D275A509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0149AAA6 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0149AB25

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e459f445a181e24708629718a026c162b5c52133fa99a3fcc2ba788535ff5773
Instruction ID: fcd793ccde5f07e3b13ec3092d7382ae2dee15fb19f498dd550adbe9ef0e3847
Opcode Fuzzy Hash: e459f445a181e24708629718a026c162b5c52133fa99a3fcc2ba788535ff5773
Instruction Fuzzy Hash: 4C219075504240AFEB21CF65DC45F66FBE8EF08624F18886EEA458B791D375E808CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0149A9BF Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 0149AA44

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 9dc96f1809cc348ce2974489e01f3c1de7d11a7940a2f04cbc7ad4b5d45462ef
Instruction ID: b3ca48230e862f705862a1adc7fb4c7fbba81e6d8d78a188fca652e788f1fe84
Opcode Fuzzy Hash: 9dc96f1809cc348ce2974489e01f3c1de7d11a7940a2f04cbc7ad4b5d45462ef
Instruction Fuzzy Hash: 17214A6540E3C09FDB138B259C64A52BFB4AF57624F0E80DBD9848F6A3D269580CC772

Uniqueness

Uniqueness Score: -1.00%

Function 0149AC37 Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,EF1360C4,00000000,00000000,00000000,00000000), ref: 0149ACBD

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: ac649198dbe937cf5065e958186b75b1bfaf129159122e8cf87995486d66d3a8
Instruction ID: 14c0abef98913aee1c238fc944da5e7ebf8cd608b2b66fa9ac698b4148433411
Opcode Fuzzy Hash: ac649198dbe937cf5065e958186b75b1bfaf129159122e8cf87995486d66d3a8
Instruction Fuzzy Hash: FD21D5B54093C06FE7128B11DC45FA2BFB8EF46324F1980DBEA858F293D264A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 0149B06A Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0149B0DD

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 2d7569f5a194a9544b3e72fd6ce089a69fba3f18208aba0aba906a843a51116c
Instruction ID: dcb57635dfaa6e00b8d29f07ef794a029bf40f1fda7e859aa4eb70a6549d6ef7
Opcode Fuzzy Hash: 2d7569f5a194a9544b3e72fd6ce089a69fba3f18208aba0aba906a843a51116c
Instruction Fuzzy Hash: C221C2B55042409FEB20CF25DC45F66FBE8EF04224F08C46AEA448B391D375E804CB75

Uniqueness

Uniqueness Score: -1.00%

Function 0149AB7C Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0149ABF0

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 43a4d4dfdff84752fcf3646674c8e8fbea3f3962ffc55f128e72889e7b489029
Instruction ID: 05ff73f0f8333e4aa39584f93c3a172885b2c37338936b5161364f813581556f
Opcode Fuzzy Hash: 43a4d4dfdff84752fcf3646674c8e8fbea3f3962ffc55f128e72889e7b489029
Instruction Fuzzy Hash: CC2192755093C09FDB138B25DC95652BFB8AF07220F0984DBDD858F6A3D2659908C762

Uniqueness

Uniqueness Score: -1.00%

Function 0149A61E Relevance: 1.6, APIs: 1, Instructions: 65
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(?), ref: 0149A690

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 219bcaeb4d13118e232eb0cd54bf127f95a1caf0df907fa195deba4fb0448d85
Instruction ID: 79c75c80b7e3f983bbc478bcfd4c998368d80054adacb09584743d300e23463c
Opcode Fuzzy Hash: 219bcaeb4d13118e232eb0cd54bf127f95a1caf0df907fa195deba4fb0448d85
Instruction Fuzzy Hash: 84215B7140D3C05FDB138B259C94652BFB4DF47220F0984DBD9848F2A3D2699908C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0149A573 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0149A5DE

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6569099144a1da0452952fd0035f91a455c51e5c829aefc622ae8bd848e9a77e
Instruction ID: 1c2706a68d4eb54c5c3748562f0808e4ab1c8f652233738c8acf119a0def2736
Opcode Fuzzy Hash: 6569099144a1da0452952fd0035f91a455c51e5c829aefc622ae8bd848e9a77e
Instruction Fuzzy Hash: CD117271409380AFDB228F55DC44A62FFF4EF4A210F0988DEE9858B562D276A818DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0149AEAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,EF1360C4,00000000,00000000,00000000,00000000), ref: 0149AF0D

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 56166391f56f21ee13822f45b0ca6740c9d2ca1c9b3442beeebad9799fdc9d36
Instruction ID: d35731b087e2c5fc57cabad81236004062175231f0c2f40f70917392394a4fd7
Opcode Fuzzy Hash: 56166391f56f21ee13822f45b0ca6740c9d2ca1c9b3442beeebad9799fdc9d36
Instruction Fuzzy Hash: 9411BF76404200AFEB21CF55DC84FA6FBE8EF04324F18C4AAEA458B695D375E508CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0149B424 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0149B480

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: fb261be0018f0fdd6b8d57804b1046b575a68dc07e5c1dfdabfbdbd0391261b3
Instruction ID: caae126a3846f0494da0566daf13ab39d7158f0fbca73404ff715e90e69fe291
Opcode Fuzzy Hash: fb261be0018f0fdd6b8d57804b1046b575a68dc07e5c1dfdabfbdbd0391261b3
Instruction Fuzzy Hash: A1118E755093809FDB12CF25DC84B52BFA8DF06220F0984EBED45CF262D275E808DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0149AC6A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,EF1360C4,00000000,00000000,00000000,00000000), ref: 0149ACBD

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: bf6ce8edc6c18f74d51fb5cb597338d1479ce7f9ce14748b45b914a91e886378
Instruction ID: 22f1d683612d8d5cbf53d5677d081cd45a8e1edfa5080b586b56ecdcaa9113e4
Opcode Fuzzy Hash: bf6ce8edc6c18f74d51fb5cb597338d1479ce7f9ce14748b45b914a91e886378
Instruction Fuzzy Hash: 5D01D275504244AFEB21CB05DC89FB6FBA8DF04624F18C0AAEE058F391D374E908CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0149B446 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0149B480

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 50e168e61d5a5fb97c15e08f5b4c5ebc252c12abf3cb90efd03f199bf258fabd
Instruction ID: 1c8103af28ad453bda0d2ac2be9f9e9c73b3436610221cf3effb282fffe8c3e8
Opcode Fuzzy Hash: 50e168e61d5a5fb97c15e08f5b4c5ebc252c12abf3cb90efd03f199bf258fabd
Instruction Fuzzy Hash: E7012D755042448FDB10CF1AE985BA6BBD4EF44620F08C4ABDD498B752D275E408DA61

Uniqueness

Uniqueness Score: -1.00%

Function 0149A59A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0149A5DE

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1ba1db34ded6e34477f0856eed04471fc7bc996d07d244e1ee00d96ff9ead27b
Instruction ID: 4e9c9496741153b6f106535ed62e2f921c6c704730ef2f470ee72b74865e3f23
Opcode Fuzzy Hash: 1ba1db34ded6e34477f0856eed04471fc7bc996d07d244e1ee00d96ff9ead27b
Instruction Fuzzy Hash: 07015B764006409FDF218F55D844B56FFE0EF48220F18C99AEE894B662D376E418DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0149A72E Relevance: 1.5, APIs: 1, Instructions: 43comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0149A77E

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: a0f0056d9ceb8223e049b55dd2109c647469e6abcb93d3ce9c3f368c20c064f4
Instruction ID: 0ee4896c0ff8ad65eeec664bdf609701b9cc8d7f1053ee1a3b002bb24aa4f2b9
Opcode Fuzzy Hash: a0f0056d9ceb8223e049b55dd2109c647469e6abcb93d3ce9c3f368c20c064f4
Instruction Fuzzy Hash: B501A271500200ABD210DF16CC46F26FBE8FB88A20F148159ED085B741E775F955CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0149ABBE Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0149ABF0

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2dfbd28c6d309ab3cb5aa424b878acff420428f7a27671b430fbd220f59ca16a
Instruction ID: 598066a4eb0a97792d0b74d3faae34dfc6c3565afcf774cc34a1e15074a71ad6
Opcode Fuzzy Hash: 2dfbd28c6d309ab3cb5aa424b878acff420428f7a27671b430fbd220f59ca16a
Instruction Fuzzy Hash: D7018F759042449FDF10CF1AE8857A6FBE4EF04224F18C4ABDD098F752D275E408CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0149A65E Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 0149A690

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 276ce87d14c07278892db31109ad128b8fbe0409041372c89ccee92fbe92c177
Instruction ID: 9295b0258c415c9138f70da0d0b35fca4348c623822fed2f816bcc19b53a12f8
Opcode Fuzzy Hash: 276ce87d14c07278892db31109ad128b8fbe0409041372c89ccee92fbe92c177
Instruction Fuzzy Hash: E4018B758002409FDB10CF1AD884766FBA4EF44220F19C4AADD498F762D279A808CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0149AA12 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0149AA44

Memory Dump Source

Source File: 00000000.00000002.1256101007.000000000149A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_149a000_U22p1GcCSb.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 77e919933f19a1a81e1dc42c0f9e82ebeae14a82482960021a54625df7d2862e
Instruction ID: 47ace33ca7ee6219eeb5b16310884d801dc9040b215f1d2dd138be7d99bbb9d6
Opcode Fuzzy Hash: 77e919933f19a1a81e1dc42c0f9e82ebeae14a82482960021a54625df7d2862e
Instruction Fuzzy Hash: 4EF08C358002449FDB208F05D985B66FFE0EF04624F19C09ADD494B762D279A508CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 057539BF Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

2jl, xrefs: 05753C2E

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: 2jl
API String ID: 0-3618021078
Opcode ID: c23bd609c1f423dfe87e92876323f02170bb14da91814a14abc165d611b8d4be
Instruction ID: 40cd3e914acfbeaf721e119790d31e2544f174f2aa49c9d0f34486e51bae024d
Opcode Fuzzy Hash: c23bd609c1f423dfe87e92876323f02170bb14da91814a14abc165d611b8d4be
Instruction Fuzzy Hash: 1A813630A002588FDB14DFB4C954BECB7B2BF89308F0045AAD50AAB2A4DB759D89DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05753B18 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

2jl, xrefs: 05753C2E

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: 2jl
API String ID: 0-3618021078
Opcode ID: 38a09c626b4c8dd42934ced689dcb99adc9c6bf71f1de916afcb720bb5f0f478
Instruction ID: ed594548482c99a26dfc350078fef649eebadf737731b5c7e0016b8c8e80bd2e
Opcode Fuzzy Hash: 38a09c626b4c8dd42934ced689dcb99adc9c6bf71f1de916afcb720bb5f0f478
Instruction Fuzzy Hash: 36415770A002188FDB14DFB4C854BECB7B2BF89308F4045AAD409AB6A4DB745E88DF61

Uniqueness

Uniqueness Score: -1.00%

Function 05753520 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 057535CD

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: :@Cl
API String ID: 0-1360559020
Opcode ID: 6db0d41390520cf203727d90a00dca7bdd4b56ef26784bae114a58a0baa2a165
Instruction ID: 89a602db9661aa66299a5914f718a1a22afaa9d22389a489a156292fb41260e7
Opcode Fuzzy Hash: 6db0d41390520cf203727d90a00dca7bdd4b56ef26784bae114a58a0baa2a165
Instruction Fuzzy Hash: F631F4307002019FCB04AB75D8557BE77A6EB88208F15843DD806A77A4EF7D9D0AA792

Uniqueness

Uniqueness Score: -1.00%

Function 057536DF Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910948a7c9125b4670ab7681d0d51d59222f3e2b1dd7d139aaa4949fd936b3b1
Instruction ID: 7da8308d74379e41aed5a9568ad9e6e8b2a60c4295af444695fe23dee032d0d2
Opcode Fuzzy Hash: 910948a7c9125b4670ab7681d0d51d59222f3e2b1dd7d139aaa4949fd936b3b1
Instruction Fuzzy Hash: 38318175B002459FEB20CF68C880FBA77E6FF89254F144869D906EB394D770ED019BA0

Uniqueness

Uniqueness Score: -1.00%

Function 057536F0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a70c67c241b4fe2c6bcf33ab506a06ec071319af49a719a800742892c6958d
Instruction ID: 54d7b3f1e09a5ab854ab873e337bdb36ce36811029ea2ccd91100e69dc4d3ee0
Opcode Fuzzy Hash: 42a70c67c241b4fe2c6bcf33ab506a06ec071319af49a719a800742892c6958d
Instruction Fuzzy Hash: 7C218274B002059FEB10CF69C880F6A77E6FF89254F144869E506EB394DB70ED0187A4

Uniqueness

Uniqueness Score: -1.00%

Function 05750007 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba8be17a823dea1c669b9871d25a3d3c7be78e7b56fff0d42f6b54fba231f665
Instruction ID: 596f85479ff7d7046dc9ed4d955044780fcd0af8e22b38252146628d081a8b7e
Opcode Fuzzy Hash: ba8be17a823dea1c669b9871d25a3d3c7be78e7b56fff0d42f6b54fba231f665
Instruction Fuzzy Hash: 5F11BC6580E3C14FC7038B7098686917FB1AA03224B4E80DBD884CF1A3E2AC484AE762

Uniqueness

Uniqueness Score: -1.00%

Function 05753441 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52fb601c8362e438cafac5018522fe120f87f870d6d11718e179a65e5db4ac78
Instruction ID: 7ec28f54cae842611a47fb548fc8fdf5adb3d44225df563acf0a9a539b26798a
Opcode Fuzzy Hash: 52fb601c8362e438cafac5018522fe120f87f870d6d11718e179a65e5db4ac78
Instruction Fuzzy Hash: 73019670A06242DFCB04EF74D0D884CBBE1FF94204709895EE4458B366DF75AC09AB92

Uniqueness

Uniqueness Score: -1.00%

Function 014405E0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1256058247.0000000001440000.00000040.00000020.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1440000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0fc3865b911048f3f7624be572d2cce3a5c174b9ad7e7746cc3ffbf560d3be
Instruction ID: 67bf220f3a3caeb886e03423dbe4747e23e4ba81a7dfd4a07b5f95e32e05dd91
Opcode Fuzzy Hash: 5b0fc3865b911048f3f7624be572d2cce3a5c174b9ad7e7746cc3ffbf560d3be
Instruction Fuzzy Hash: EAF086B65097846FD7118F05EC41863FFF8EF86620709849FFD498B652D225A918CB71

Uniqueness

Uniqueness Score: -1.00%

Function 057500A8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072f9ffcad5af6d2c406154f6a0affb4d638dba43c5d6e5f65645411d6071b4c
Instruction ID: 5af797f35d56caf38bd36258289cb2087368955dca6b9efc03e3a19b3f617e47
Opcode Fuzzy Hash: 072f9ffcad5af6d2c406154f6a0affb4d638dba43c5d6e5f65645411d6071b4c
Instruction Fuzzy Hash: 8BF04C72A04304ABDB04DFB0CC9179E7B63EB82720F1081AED5459B2D1EA719C00C790

Uniqueness

Uniqueness Score: -1.00%

Function 01440606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1256058247.0000000001440000.00000040.00000020.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1440000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03242ebfbd19df730a7c96e194c73b9368fec31c84926b8d7410127e6b40fa8a
Instruction ID: ccaecfa79dfd57cdd3a57c8d1a44b246a4682108cffc5ec8cd3dcbfadaaf627d
Opcode Fuzzy Hash: 03242ebfbd19df730a7c96e194c73b9368fec31c84926b8d7410127e6b40fa8a
Instruction Fuzzy Hash: EDE092B6A006045B9650CF0AEC41452F7D8EB88630708C07FDC0D8B701E676B508CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 057536A8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e502d8676186b18a69686d19457ff2ab426bbd7f5bd2e8c998890873c65c795
Instruction ID: 0164c19c8e6a74b29a15c4da833ce8a67841ba5a91d4d3b366445efcd8a9c90f
Opcode Fuzzy Hash: 2e502d8676186b18a69686d19457ff2ab426bbd7f5bd2e8c998890873c65c795
Instruction Fuzzy Hash: 0DE04F315163448FC71A6B74A42945C3771EB4725838408FEC8078B373EA7A984BDB40

Uniqueness

Uniqueness Score: -1.00%

Function 014923F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1256087096.0000000001492000.00000040.00000800.00020000.00000000.sdmp, Offset: 01492000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1492000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8a80022605c701515ba9d11258420fe0d8a35b5ee1a126c14907d3600f7ea6
Instruction ID: 4ac3a8c4c44c11e1b5b9859719ae9f66dd755c9f8324145ddfabf71b8db87a9e
Opcode Fuzzy Hash: cc8a80022605c701515ba9d11258420fe0d8a35b5ee1a126c14907d3600f7ea6
Instruction Fuzzy Hash: BCD05E792096915FF7169E1CC1A4F963FE4AB61718F4A44FAA8408B773C7A8D581D600

Uniqueness

Uniqueness Score: -1.00%

Function 014923BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1256087096.0000000001492000.00000040.00000800.00020000.00000000.sdmp, Offset: 01492000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1492000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce76ef74f303cc493627c955fd352d44b049df4ab2984fa264d683de9512b72
Instruction ID: b1d8999b03d82e6c8b9c967d052333b05200c6a4a74d14bcce40bdd4df57f391
Opcode Fuzzy Hash: dce76ef74f303cc493627c955fd352d44b049df4ab2984fa264d683de9512b72
Instruction Fuzzy Hash: 3DD05E342442815BEB25DE1CC2D8F5A3BD4AB40B14F0684E9AC108B372C7B8D9C0CA00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 057544F1 Relevance: 12.9, Strings: 9, Instructions: 1624COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 05754582
:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
, xrefs: 05754BC4
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$2jl
API String ID: 0-3269062517
Opcode ID: 821f220b48d99907eb6f3af5490390ae695c331fee248c578235923ce1f5156e
Instruction ID: f3225bc9acc1133de86024e1737ab7472a6ac6eb883a850fca9ec60a7048ae80
Opcode Fuzzy Hash: 821f220b48d99907eb6f3af5490390ae695c331fee248c578235923ce1f5156e
Instruction Fuzzy Hash: DD032774A05228CFDB25DF20D8A4BA9B7B2FB89304F0081EAD90967390DF355E89DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05754544 Relevance: 12.9, Strings: 9, Instructions: 1618COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 05754582
:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
, xrefs: 05754BC4
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$2jl
API String ID: 0-3269062517
Opcode ID: 3aa19fb0b88941d5b38acd7636c174edcad6648fd7b3cc3501fc30c4ff1008a1
Instruction ID: 09e5cee2c8ee71afede6098f44d2a6cd652f055d151d0618f397763bc2ecde9b
Opcode Fuzzy Hash: 3aa19fb0b88941d5b38acd7636c174edcad6648fd7b3cc3501fc30c4ff1008a1
Instruction Fuzzy Hash: 82032774A05228CFDB25DF20D8A4BA9B7B2FB89304F1081EAD90967390DF355E89DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05754630 Relevance: 11.6, Strings: 8, Instructions: 1579COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
, xrefs: 05754BC4
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$2jl
API String ID: 0-74479145
Opcode ID: 905d987c957e368df6a9aae838f6b28dd7de4001d15ba824de19f0c9327488db
Instruction ID: 6c4960ed3d17bf859ec3fe01a796b9caf14a4002c4e81be1d172783370743ea4
Opcode Fuzzy Hash: 905d987c957e368df6a9aae838f6b28dd7de4001d15ba824de19f0c9327488db
Instruction Fuzzy Hash: 20032774A05228CFDB25DF20D8A4BA9B7B2FB89304F1081EAD90967390DF355E89DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0575470F Relevance: 11.5, Strings: 8, Instructions: 1544COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
, xrefs: 05754BC4
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$2jl
API String ID: 0-74479145
Opcode ID: f7887ff7ce9b31c64fe65289d06c97a07df0de2c7d8c345cacf5e1d9b9436571
Instruction ID: b0a89acc2ed13098cecbc5aa189e648dd440d1945b74e695ff3545759a947481
Opcode Fuzzy Hash: f7887ff7ce9b31c64fe65289d06c97a07df0de2c7d8c345cacf5e1d9b9436571
Instruction Fuzzy Hash: BAF22674A05228CFDB25DF20D8A4BA9B7B2FB89304F0081EAD90967390DF355E89DF50

Uniqueness

Uniqueness Score: -1.00%

Function 057547D4 Relevance: 11.5, Strings: 8, Instructions: 1513COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
, xrefs: 05754BC4
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$2jl
API String ID: 0-74479145
Opcode ID: f9165239da4775e5ba1505d28308725e3fc6d2e38083f70e1ef72ef6841a8ab0
Instruction ID: 206c06176af54c5a85c4638dc86cc233035541830605c06abe00cd4ace3dcebb
Opcode Fuzzy Hash: f9165239da4775e5ba1505d28308725e3fc6d2e38083f70e1ef72ef6841a8ab0
Instruction Fuzzy Hash: 2CF22774A05228CFDB25DF20D8A4BA9B7B2FB89304F0081EAD90967390DF355E89DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05754936 Relevance: 11.5, Strings: 8, Instructions: 1456COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
, xrefs: 05754BC4
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$2jl
API String ID: 0-74479145
Opcode ID: 167178093a0aa24d15368786f7e529650d7fb8f84e28296a0bcea2a2476895a3
Instruction ID: 093629a8cca37ae1eaabcd3684224cad9a01dc015c205967dbd18ccce37889f7
Opcode Fuzzy Hash: 167178093a0aa24d15368786f7e529650d7fb8f84e28296a0bcea2a2476895a3
Instruction Fuzzy Hash: A0F22774A05228CFDB25DF20D8A4BA9B7B2FB89304F0081EAD90967394DF355E89DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0575499D Relevance: 11.4, Strings: 8, Instructions: 1447COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
, xrefs: 05754BC4
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$2jl
API String ID: 0-74479145
Opcode ID: 1c9ecf5125b990791080381691822a09585f6b332668cfbbad8acb96564ce560
Instruction ID: e19df8e4d63782a583cf513fd550b214aee5e11fcc2685388a5691506d6ea531
Opcode Fuzzy Hash: 1c9ecf5125b990791080381691822a09585f6b332668cfbbad8acb96564ce560
Instruction Fuzzy Hash: 1AF22774A05228CFDB25DF20D8A4BA9B7B2FB89304F0081EAD90967390DF355E89DF55

Uniqueness

Uniqueness Score: -1.00%

Function 057549F9 Relevance: 11.4, Strings: 8, Instructions: 1440COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
, xrefs: 05754BC4
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$2jl
API String ID: 0-74479145
Opcode ID: 96eac182b449ac60f1b2fc9344f6cbc64ec615e547454fb0c7e1ea9d879a6a77
Instruction ID: 7fc748d01651e93d2c572ed2374b5dd044170d122a1d30e339637e31a018b9f2
Opcode Fuzzy Hash: 96eac182b449ac60f1b2fc9344f6cbc64ec615e547454fb0c7e1ea9d879a6a77
Instruction Fuzzy Hash: 6CF22774A05228CFDB25DF20D8A4BA9B7B2FB89304F0081EAD90967390DF355E89DF55

Uniqueness

Uniqueness Score: -1.00%

Function 05754B5B Relevance: 11.4, Strings: 8, Instructions: 1383COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
, xrefs: 05754BC4
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$2jl
API String ID: 0-74479145
Opcode ID: c0e6005df9da774453829a4b6a87795337bee0988d14a6f047572dac68b91005
Instruction ID: 5259960ab1a43c65d52fe1f409dc7ac3a75530504d1d9c9a03819c89642a7a9c
Opcode Fuzzy Hash: c0e6005df9da774453829a4b6a87795337bee0988d14a6f047572dac68b91005
Instruction Fuzzy Hash: AFE21774A05228CFDB25DF20D8A4BA9B7B2FB89304F1081EAD90967390DF355E89DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05754C8F Relevance: 10.1, Strings: 7, Instructions: 1362COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 05754CF3
\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05754D9A
:@Cl, xrefs: 05754E43
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$2jl
API String ID: 0-3959443473
Opcode ID: 300bc68e0487168a65f771845a17399ad8abc19b06c32f9027191bab1c663491
Instruction ID: 766fae6a913c9ab912699101151f14a24adb93c1509521c1bcea9dc8646ef53b
Opcode Fuzzy Hash: 300bc68e0487168a65f771845a17399ad8abc19b06c32f9027191bab1c663491
Instruction Fuzzy Hash: 24E21874A05228CFDB25DF20D8A4BA9B7B2FB89304F1081EAD90967390DF355E89DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05754F2F Relevance: 6.2, Strings: 4, Instructions: 1245COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl$2jl
API String ID: 0-1381879308
Opcode ID: 26c5bb655539b6bd2cf9c9fd943270a11993a2556c5851872f0c6bbdaa478240
Instruction ID: 331ca39368f84cd3319fe466defe17df96c1c5ebd9504e162ff8e7406cb8f357
Opcode Fuzzy Hash: 26c5bb655539b6bd2cf9c9fd943270a11993a2556c5851872f0c6bbdaa478240
Instruction Fuzzy Hash: 3DD20674A05268CFDB25DF20D8A4BA9B7B1FB89304F1081EAE90967390DF355E89DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05754F9D Relevance: 6.2, Strings: 4, Instructions: 1236COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl$2jl
API String ID: 0-1381879308
Opcode ID: 72eb1f6f12afd93e001c747e9aefdd4d9e7a69da62e2227afee794410e872449
Instruction ID: db97fbfe7fd0e3941325b8a2e8cc7800af86aa21256e8f85a1e67c81a5510761
Opcode Fuzzy Hash: 72eb1f6f12afd93e001c747e9aefdd4d9e7a69da62e2227afee794410e872449
Instruction Fuzzy Hash: 11D20674A05268CFDB25DF20D8A4BA9B7B1FB89304F1081EAE90967390DF355E89DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05755000 Relevance: 6.2, Strings: 4, Instructions: 1230COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl$2jl
API String ID: 0-1381879308
Opcode ID: c0a7382fe5ed227d541fb71360ced0e85dc850795cedb84a89ee0c91b680500f
Instruction ID: e057c82cff393170f2bf00b152919e5335dcc80e84a507fb501009fb3d0d83a8
Opcode Fuzzy Hash: c0a7382fe5ed227d541fb71360ced0e85dc850795cedb84a89ee0c91b680500f
Instruction Fuzzy Hash: C0D20674A05228CFDB25DF20D8A4BA9B7B1FB89304F1081EAE90967390DF355E89DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0575505D Relevance: 6.2, Strings: 4, Instructions: 1225COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl$2jl
API String ID: 0-1381879308
Opcode ID: ca76468330e6afb65e6583e01630a816c3e7f80297efe90bb4979d7fffc7429e
Instruction ID: 006b234925baf2e2cfb018d3fd2326b43d90ad0f785a529f04757b31bf65872f
Opcode Fuzzy Hash: ca76468330e6afb65e6583e01630a816c3e7f80297efe90bb4979d7fffc7429e
Instruction Fuzzy Hash: F0D20674A05228CFDB25DF20D8A4BA9B7B1FB89304F1081EAE90967390DF355E89DF51

Uniqueness

Uniqueness Score: -1.00%

Function 057550E3 Relevance: 6.2, Strings: 4, Instructions: 1210COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl$2jl
API String ID: 0-1381879308
Opcode ID: bba97ae57cda4808e7d9c9c35b6797e2838d2e280ab97b286a5592275c11e5bf
Instruction ID: 42b7331605d675a652dfcb52357046f5aecd0de15f2664d71d7a28f513b956fb
Opcode Fuzzy Hash: bba97ae57cda4808e7d9c9c35b6797e2838d2e280ab97b286a5592275c11e5bf
Instruction Fuzzy Hash: 55D20774A05228CFDB25DF20D8A4BA9B7B1FB89304F1081EAE90967390DF355E89DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0575536F Relevance: 6.1, Strings: 4, Instructions: 1071COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05755541
2jl, xrefs: 0575541D
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl$2jl
API String ID: 0-1381879308
Opcode ID: 6004d42ba5a51938a703882de7af4a4ba804571444fa7d86d7da8ff6d538cfb3
Instruction ID: 598f925dc466f4d8fed8b6d4b558ba33e1742375e5ca7827439864e6fb8446db
Opcode Fuzzy Hash: 6004d42ba5a51938a703882de7af4a4ba804571444fa7d86d7da8ff6d538cfb3
Instruction Fuzzy Hash: CDC21574A05228CFDB25DF20D8A4BA9B7B2FB89304F1091E9D90967390DF365E89DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05755459 Relevance: 4.8, Strings: 3, Instructions: 1040COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 05756AF9
:@Cl, xrefs: 05755541
:@Cl, xrefs: 05756CF5

Memory Dump Source

Source File: 00000000.00000002.1257261953.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_U22p1GcCSb.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl
API String ID: 0-3276783887
Opcode ID: 9641eea0dd33267a02f7345df0b4ab87f479087bcf9b2feffe1038a6160f0b99
Instruction ID: eb93b21a791d7cd5db2a4bd1fe2e80d4143e288dda92fa1aaa87fbcf0371bc33
Opcode Fuzzy Hash: 9641eea0dd33267a02f7345df0b4ab87f479087bcf9b2feffe1038a6160f0b99
Instruction Fuzzy Hash: 65C21674A05228CFDB25DF20D8A4BA9B7B2FB89304F1091E9D90967390DF365E89DF50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: server.exePID: 7740, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	41.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.2%
Total number of Nodes:	112
Total number of Limit Nodes:	7

Executed Functions

Function 00EE4298 Relevance: 14.4, Strings: 10, Instructions: 1950COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE4CF3
\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE4D9A
:@Cl, xrefs: 00EE5541
:@Cl, xrefs: 00EE6CF5
@, xrefs: 00EE4C24
2jl, xrefs: 00EE541D
:@Cl, xrefs: 00EE4E43
:@Cl, xrefs: 00EE4582

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$@$\Ojl$|tu$2jl
API String ID: 0-1673784574
Opcode ID: 04dacc743da47445ba598de1b15fe7b79d67960e6d55843b8b1fdef653ea5d3f
Instruction ID: 42727dbed4732dfd01b822be7a020bebc030c44efb87c123242931d00b0a8a55
Opcode Fuzzy Hash: 04dacc743da47445ba598de1b15fe7b79d67960e6d55843b8b1fdef653ea5d3f
Instruction Fuzzy Hash: D4235874A01268CFDB25EF21D8A4BEDB7B2BB89308F1091E9D409A7395CB355E84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00EE4291 Relevance: 14.2, Strings: 10, Instructions: 1745COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE4CF3
\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE4D9A
:@Cl, xrefs: 00EE5541
, xrefs: 00EE4BC4
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D
:@Cl, xrefs: 00EE4E43
:@Cl, xrefs: 00EE4582

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-3556841449
Opcode ID: 564c1214aac93539578e8cecc92482eb29731ec8b23a9754f2413e45873f74e4
Instruction ID: ff61c7b078c7bd51e9fc493a08e7fdc3e033d135e5f79e08e551fb7903fe1090
Opcode Fuzzy Hash: 564c1214aac93539578e8cecc92482eb29731ec8b23a9754f2413e45873f74e4
Instruction Fuzzy Hash: 96135774A01628CFDB25EF21D8A4BEDB7B2BB89308F1091E9D509673A5CB355E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE44F1 Relevance: 14.1, Strings: 10, Instructions: 1624COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE4CF3
\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE4D9A
:@Cl, xrefs: 00EE5541
, xrefs: 00EE4BC4
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D
:@Cl, xrefs: 00EE4E43
:@Cl, xrefs: 00EE4582

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-3556841449
Opcode ID: 752af8242974522d81025b997d30bf1d6a4327ef2a8f9722b283d62839285232
Instruction ID: 0323522e68b69fa0e875e82b740002affe783764f668125c93bbcc5199af8443
Opcode Fuzzy Hash: 752af8242974522d81025b997d30bf1d6a4327ef2a8f9722b283d62839285232
Instruction Fuzzy Hash: 38034774A01628CFDB25EF21D8A4BEDB7B2BB89308F1091E9D509673A5CB355E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE4544 Relevance: 14.1, Strings: 10, Instructions: 1618COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE4CF3
\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE4D9A
:@Cl, xrefs: 00EE5541
, xrefs: 00EE4BC4
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D
:@Cl, xrefs: 00EE4E43
:@Cl, xrefs: 00EE4582

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-3556841449
Opcode ID: d7888ba002cd0d0959fbfd3b350244914a249124289cd3483499f83170d5dde2
Instruction ID: 84ecd3037a2d4722c2e6faedfa7e1bdcefb6712f9327bbe4422dccd3409999e3
Opcode Fuzzy Hash: d7888ba002cd0d0959fbfd3b350244914a249124289cd3483499f83170d5dde2
Instruction Fuzzy Hash: 0A035674A01628CFDB25EF21D8A4BEDB7B2BB89308F1091E9D509673A5CB355E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE47D4 Relevance: 12.8, Strings: 9, Instructions: 1513COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE4CF3
\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE4D9A
:@Cl, xrefs: 00EE5541
, xrefs: 00EE4BC4
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D
:@Cl, xrefs: 00EE4E43

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-2866431145
Opcode ID: 7bafdeb97b15ac0bd8190118d076640e46d3dceb2e5dfe007e94e2b64f81d01a
Instruction ID: c6c0aa596cc1bb83daadfa7ce8810aa5fe8c2f2af6d113d8a8ff22a9c7a8524e
Opcode Fuzzy Hash: 7bafdeb97b15ac0bd8190118d076640e46d3dceb2e5dfe007e94e2b64f81d01a
Instruction Fuzzy Hash: CAF25774A01668CFDB25EF21D8A4BEDB7B2BB89308F1091E9D409673A5CB355E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE499D Relevance: 12.7, Strings: 9, Instructions: 1447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@Cl, xrefs: 00EE4CF3
\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE4D9A
:@Cl, xrefs: 00EE5541
, xrefs: 00EE4BC4
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D
:@Cl, xrefs: 00EE4E43

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-2866431145
Opcode ID: cd3396e9d36145542c7dfdb0a236ec17d3d633a5babba77511ad1b3b75c79865
Instruction ID: b592c5b0b0341e7505897b66f14d2bd55531ae68fa30058a01fb08d0355c30fe
Opcode Fuzzy Hash: cd3396e9d36145542c7dfdb0a236ec17d3d633a5babba77511ad1b3b75c79865
Instruction Fuzzy Hash: 87F26774A01668CFDB25EF21D8A4BEDB7B2BB89308F1091E9D409673A5CB355E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE49F9 Relevance: 12.7, Strings: 9, Instructions: 1440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@Cl, xrefs: 00EE4CF3
\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE4D9A
:@Cl, xrefs: 00EE5541
, xrefs: 00EE4BC4
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D
:@Cl, xrefs: 00EE4E43

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-2866431145
Opcode ID: 509ed83be19a46a588f185ec7c1e1009439c5a9f4bc162ed5fef4a46750bc3a2
Instruction ID: 18b431f95259db6fca1a868a30085b7a4414a364d52f39d74e52e8603c639100
Opcode Fuzzy Hash: 509ed83be19a46a588f185ec7c1e1009439c5a9f4bc162ed5fef4a46750bc3a2
Instruction Fuzzy Hash: 99F26774A01668CFDB25EF21D8A4BEDB7B2BB89308F1091E9D409673A5CB355E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE4B5B Relevance: 12.6, Strings: 9, Instructions: 1383
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@Cl, xrefs: 00EE4CF3
\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE4D9A
:@Cl, xrefs: 00EE5541
, xrefs: 00EE4BC4
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D
:@Cl, xrefs: 00EE4E43

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: $:@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-2866431145
Opcode ID: d7ab42e49f071a9d5e9e6aee88781a7f13a898d2ee83873e2dfde6cbae195dc8
Instruction ID: 09bd04b024e76d2444934f4349ed89d503c19feac75857c1e25bcc0f6ef9bc05
Opcode Fuzzy Hash: d7ab42e49f071a9d5e9e6aee88781a7f13a898d2ee83873e2dfde6cbae195dc8
Instruction Fuzzy Hash: 60E26874A01668CFDB25EF21D8A4BEDB7B2BB89308F1091E9D409673A5CB355E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE4C8F Relevance: 11.4, Strings: 8, Instructions: 1362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@Cl, xrefs: 00EE4CF3
\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE4D9A
:@Cl, xrefs: 00EE5541
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D
:@Cl, xrefs: 00EE4E43

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$:@Cl$:@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-577486089
Opcode ID: 68ef42d7891026783b7bb9437584cc3f016c1eee6a01efde226e9b32d9c91315
Instruction ID: dc0e00f73c7e39bd2f75fc99f27f15c6d5baecca757948d9b299c3616eafea95
Opcode Fuzzy Hash: 68ef42d7891026783b7bb9437584cc3f016c1eee6a01efde226e9b32d9c91315
Instruction Fuzzy Hash: 74E26874A01628CFDB25EF21D8A4BEDB7B2BB89308F1091E9D509673A5CB355E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE4F9D Relevance: 7.5, Strings: 5, Instructions: 1236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE5541
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-1415125539
Opcode ID: b0cfd07c314e108751342dac66b1682664de2d3a15c59f8e7f0f75ec0ad05596
Instruction ID: 5b839d994f3dde957ece359992a92c7f32e6a866e8bd2fa78f07d8cc28e67579
Opcode Fuzzy Hash: b0cfd07c314e108751342dac66b1682664de2d3a15c59f8e7f0f75ec0ad05596
Instruction Fuzzy Hash: ADD24774A01668CFDB25EF21D8A4BEDB7B1BB89308F1091E9D409A73A5DB355E84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE505D Relevance: 7.5, Strings: 5, Instructions: 1225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE5541
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-1415125539
Opcode ID: b0c34302426faf9fd781ebb0d3ad211451b1e30f6f7903115e56d19ddc3e4209
Instruction ID: b7df049e2dc2af3817b67d0cc28dab823ad960a0bf54ee3216e24c01df824f9f
Opcode Fuzzy Hash: b0c34302426faf9fd781ebb0d3ad211451b1e30f6f7903115e56d19ddc3e4209
Instruction Fuzzy Hash: 3ED24774A01668CFDB25EF21D8A4BEDB7B1BB89308F1091E9D409A73A5DB315E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE50E3 Relevance: 7.5, Strings: 5, Instructions: 1210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE5541
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-1415125539
Opcode ID: 232cc12b388810c3ad85f72cfb6eeaab284afa4658d874b09f1b10e2ee0eb4eb
Instruction ID: d5c8397320f13a0f1f2b2c75cc6de74a2be75373e9a69886d65b7b25e850086e
Opcode Fuzzy Hash: 232cc12b388810c3ad85f72cfb6eeaab284afa4658d874b09f1b10e2ee0eb4eb
Instruction Fuzzy Hash: F1D24874A01668CFDB25EF21D8A4BEDB7B2BB89308F1091E9D409673A5DB315E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE536F Relevance: 7.3, Strings: 5, Instructions: 1071
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ojl, xrefs: 00EE6AF9
|tu, xrefs: 00EE53CE
:@Cl, xrefs: 00EE5541
:@Cl, xrefs: 00EE6CF5
2jl, xrefs: 00EE541D

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl$|tu$2jl
API String ID: 0-1415125539
Opcode ID: 37b5297e356bfad1fdf02f0c19c1d15ac360ce0d9e74fd96caf0c10e526faa34
Instruction ID: 40701a3f7819d4269b07d9a44b2c0fe40194ee7ee7108afc6bbe8e0738e9ba17
Opcode Fuzzy Hash: 37b5297e356bfad1fdf02f0c19c1d15ac360ce0d9e74fd96caf0c10e526faa34
Instruction Fuzzy Hash: 31C20574A01628CFDB25EF20D8A4BEDB7B6BB89308F1091E9D50967795CB325E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5459 Relevance: 4.8, Strings: 3, Instructions: 1040
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ojl, xrefs: 00EE6AF9
:@Cl, xrefs: 00EE5541
:@Cl, xrefs: 00EE6CF5

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl$\Ojl
API String ID: 0-3276783887
Opcode ID: 7aa050d9e0e76e31ce02763f7a4266b7de3979b2feca5f1bee57ea432511aa85
Instruction ID: 5927bbfa8c861d9a03602bb3075479385fb4af923a97ee330c2b339c6bc01a4f
Opcode Fuzzy Hash: 7aa050d9e0e76e31ce02763f7a4266b7de3979b2feca5f1bee57ea432511aa85
Instruction Fuzzy Hash: ECC20474A01628CFDB25EF20D8A4BEDB7B6BB89308F1091E9D50967795CB325E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE75A8 Relevance: 2.0, Strings: 1, Instructions: 757COMMON

Download Yara Rule

Strings

2jl, xrefs: 00EE7F08

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: 2jl
API String ID: 0-3618021078
Opcode ID: 819bd064015febd4dd040d2a6f6a5636314a992f65323532458b377eb46c3233
Instruction ID: d7a235550f97737b5806ace1bf6f9fc3dc3155d729fe1bddb8dcd0950c00a025
Opcode Fuzzy Hash: 819bd064015febd4dd040d2a6f6a5636314a992f65323532458b377eb46c3233
Instruction Fuzzy Hash: 2A4266326097A9CBCB28DB32D84057CB3A2BF803597259575D491AB3D0EF39EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0074BD6F Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0074BDEF

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 44b8200a74e7996c6c39288d922ce8f96834402c89f540873bd0ae10b74bfadd
Instruction ID: c22b50acd013b42376e576ee7971ceebdc894722065efaf1897026d9437f55e2
Opcode Fuzzy Hash: 44b8200a74e7996c6c39288d922ce8f96834402c89f540873bd0ae10b74bfadd
Instruction Fuzzy Hash: DF21AD755097809FDB228F25DC44B92BFB4EF06310F0984DAE9848B563D375E808DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0074BEF1 Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 0074BF5D

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 7a7986ea98ec00e2845cf97effc6cf72feee4ce0174f545c4534126fa03baf63
Instruction ID: c6246121edc3f2e51fcaebddfe839f1b44689482e5b6d470c1fd0f270b4053fe
Opcode Fuzzy Hash: 7a7986ea98ec00e2845cf97effc6cf72feee4ce0174f545c4534126fa03baf63
Instruction Fuzzy Hash: B1118E714093C09FDB228B14DC45A52FFB4EF16314F0984DAE9844F563D369A91CCB62

Uniqueness

Uniqueness Score: -1.00%

Function 0074BDA6 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0074BDEF

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 8a421cf1a782875d137ffebe3ed150f087d95623417fbb86c0d0b0b2991a6a52
Instruction ID: 880a7c83c6ac03da3ee4838ae61d6ae8e1b7e0d2aee5a9cc117b707a40afb014
Opcode Fuzzy Hash: 8a421cf1a782875d137ffebe3ed150f087d95623417fbb86c0d0b0b2991a6a52
Instruction Fuzzy Hash: 081170755006009FDB20CF55D884BA6FBE4EF44720F08C4AAED458B651D379E858DF61

Uniqueness

Uniqueness Score: -1.00%

Function 0074BF22 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 0074BF5D

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 4b81c0845643a458ff3b6702df138af706bbac0ba3731d3f0a52a0fcea0f0039
Instruction ID: a6699a3ca15905d22b1a558e3e9083dc43ab6139b4223a21259be245b6870f2e
Opcode Fuzzy Hash: 4b81c0845643a458ff3b6702df138af706bbac0ba3731d3f0a52a0fcea0f0039
Instruction Fuzzy Hash: 37018B354006409FDB208F05DC84B61FBE0EF08720F08C09AED894BA62D379E818DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EE36F0 Relevance: 5.1, Strings: 4, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Nu, xrefs: 00EE37BA
Nu, xrefs: 00EE3780
Nu, xrefs: 00EE375D
Nu, xrefs: 00EE3719

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: Nu$Nu$Nu$Nu
API String ID: 0-2751682506
Opcode ID: 5888e60691c8d6acd9bd81f4bd9a74d7809f00a3f35b70f46109f8b337b87b51
Instruction ID: b041a8a98d321998ae507428ecaeabeab921809244acb18ecc0a6e2ac48d0f89
Opcode Fuzzy Hash: 5888e60691c8d6acd9bd81f4bd9a74d7809f00a3f35b70f46109f8b337b87b51
Instruction Fuzzy Hash: 6D2194747002499FEB10CB69C840BAB77E5FF89348F144429E505EB384D770ED008794

Uniqueness

Uniqueness Score: -1.00%

Function 00EE01E1 Relevance: 3.8, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HQu, xrefs: 00EE023B
XRu, xrefs: 00EE0260
Pu, xrefs: 00EE0216

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: HQu$XRu$Pu
API String ID: 0-3267648291
Opcode ID: 90fc1810f226f52d56f8ae85eef4d9275acb4e321a2272e0d89782c80abb319a
Instruction ID: 1a840d6a96d1299dc642aa8176d10f3521b52a4b718c805e239ad639c7173a38
Opcode Fuzzy Hash: 90fc1810f226f52d56f8ae85eef4d9275acb4e321a2272e0d89782c80abb319a
Instruction Fuzzy Hash: 2601613070A785CFCB00EB74D45849C7BE1EF84309B49886DE445CB266EBB99C499B42

Uniqueness

Uniqueness Score: -1.00%

Function 00EE80A1 Relevance: 3.7, Strings: 2, Instructions: 1243COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE8316
:@Cl, xrefs: 00EE8305

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl
API String ID: 0-977473982
Opcode ID: c7b7b0526ee27229696ae3f8cddb33fb68b2025005c969d640099c79a8d7fa77
Instruction ID: 41ec494cb4b84d9abe21e280027563d81e5b2bbadac7b5377549c1a74df64ffd
Opcode Fuzzy Hash: c7b7b0526ee27229696ae3f8cddb33fb68b2025005c969d640099c79a8d7fa77
Instruction Fuzzy Hash: 79C2AF34700A98CBDF119B76E9507B977F6AB88304F0490ABD809A3799CF759E44DF22

Uniqueness

Uniqueness Score: -1.00%

Function 00EE8185 Relevance: 3.6, Strings: 2, Instructions: 1075COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE8316
:@Cl, xrefs: 00EE8305

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$:@Cl
API String ID: 0-977473982
Opcode ID: b0a2e36ccfc4bbd7beaed861dc92e2e116626d6d3f2fd62fed5d214205e109e3
Instruction ID: ede6b7c6a8dd735af4f49d74ad2604a294c0ccde52e3355e36a3bae40c2717ad
Opcode Fuzzy Hash: b0a2e36ccfc4bbd7beaed861dc92e2e116626d6d3f2fd62fed5d214205e109e3
Instruction Fuzzy Hash: 6F92D5347006988BDF115BB6D8607BD77E7AB88308F14909BD849A3799CF758E44EF22

Uniqueness

Uniqueness Score: -1.00%

Function 00EE57A1 Relevance: 3.4, Strings: 2, Instructions: 906COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 00EE6AF9
:@Cl, xrefs: 00EE6CF5

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$\Ojl
API String ID: 0-1796497847
Opcode ID: 2315cbf2a9cf65bf23806f28bc1c28dbd852a3ba32f207b712c19968777aaf8c
Instruction ID: 56058c2ace658561841e80b9722ba3488e55974ee0aaacb01e4eb4b24a269ae8
Opcode Fuzzy Hash: 2315cbf2a9cf65bf23806f28bc1c28dbd852a3ba32f207b712c19968777aaf8c
Instruction Fuzzy Hash: 97A21574A01628CFDB25EF20D8A4BEDB7B6BB89308F1091E9D50967795CB319E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5A8F Relevance: 3.3, Strings: 2, Instructions: 792COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 00EE6AF9
:@Cl, xrefs: 00EE6CF5

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$\Ojl
API String ID: 0-1796497847
Opcode ID: 3463a79fa739de6f273eb3f086f7b8c0dfe9e687a562df66cfd0c131161494a5
Instruction ID: a6950608393b5e39498526797ea076f85deebeafb90d8fbf4726ff40c6370a48
Opcode Fuzzy Hash: 3463a79fa739de6f273eb3f086f7b8c0dfe9e687a562df66cfd0c131161494a5
Instruction Fuzzy Hash: CA921674A01668CFDB25EF20D864BEDB7B6BB89308F1091E9D90967395DB319E84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5D7D Relevance: 3.2, Strings: 2, Instructions: 678COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 00EE6AF9
:@Cl, xrefs: 00EE6CF5

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$\Ojl
API String ID: 0-1796497847
Opcode ID: 110816e400eaf06a0b78b7ce90a3237ce987bb6662bbc26cc9b23398a38a081c
Instruction ID: a81f3e795347adead4737d4de11767cf8e352371ccb144c1677fb874c7b6d33a
Opcode Fuzzy Hash: 110816e400eaf06a0b78b7ce90a3237ce987bb6662bbc26cc9b23398a38a081c
Instruction Fuzzy Hash: 13722674A01668CFDB25EF20D954BE9B7B6FB89308F1091E9D909A7395CB319E84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5EF4 Relevance: 3.1, Strings: 2, Instructions: 621COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 00EE6AF9
:@Cl, xrefs: 00EE6CF5

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$\Ojl
API String ID: 0-1796497847
Opcode ID: f33fe1d0be7c9bd6e453c4b6d88accbf9a74cfd05a8ced307c0fa2c63926fc42
Instruction ID: 0205b395b3d3c576f73dae1fc58866d2d46b504bb103720dc4c005c890d8f323
Opcode Fuzzy Hash: f33fe1d0be7c9bd6e453c4b6d88accbf9a74cfd05a8ced307c0fa2c63926fc42
Instruction Fuzzy Hash: 26622674A00668CFDB25EF20D994BEDB7B6BB89304F1091E9D909A7395DB319E84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE606B Relevance: 3.1, Strings: 2, Instructions: 564COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 00EE6AF9
:@Cl, xrefs: 00EE6CF5

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$\Ojl
API String ID: 0-1796497847
Opcode ID: 6facb358caf43e59f7874067cf019efa9846ca6bae5120b3fb3520c603426f6b
Instruction ID: 3137869debab2279031b4ef93d0e6c14f01bc720ff6b1274739daef1992393bf
Opcode Fuzzy Hash: 6facb358caf43e59f7874067cf019efa9846ca6bae5120b3fb3520c603426f6b
Instruction Fuzzy Hash: B1522674A01668CFDB25EF24D994BECB7B6BB89304F1091E9D909A7395DB319E84CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00EE61E2 Relevance: 3.0, Strings: 2, Instructions: 507COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 00EE6AF9
:@Cl, xrefs: 00EE6CF5

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$\Ojl
API String ID: 0-1796497847
Opcode ID: 2de20d1a72db3ebc5b6b45ce7f02b13b3bb94af813c3a7cb0b45fd54bfbefaf5
Instruction ID: 7f87da7dd2e865758a514c0294b77b765c7d4e6b52930b2875bd972ffb7a4bb8
Opcode Fuzzy Hash: 2de20d1a72db3ebc5b6b45ce7f02b13b3bb94af813c3a7cb0b45fd54bfbefaf5
Instruction Fuzzy Hash: 1D422774A01668CFDB25EF24D954BADB7B5BB89304F1091E9D909A7395DB31AE80CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00EE6483 Relevance: 2.9, Strings: 2, Instructions: 427COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 00EE6AF9
:@Cl, xrefs: 00EE6CF5

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$\Ojl
API String ID: 0-1796497847
Opcode ID: 2f9c095c157212ec65d25940c5c3cfd2dee2fc67760f9a36941265b4a4b7f13d
Instruction ID: ec38a23342dd704f422f2f3e5a77149de5f090cd8f7fefb77b6a027bfd0ef76c
Opcode Fuzzy Hash: 2f9c095c157212ec65d25940c5c3cfd2dee2fc67760f9a36941265b4a4b7f13d
Instruction Fuzzy Hash: A9223774A00668CFCB25EF34D994BA9B7B5FB89304F1091E9D909A7395DB35AE81CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00EE67A9 Relevance: 2.8, Strings: 2, Instructions: 343COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 00EE6AF9
:@Cl, xrefs: 00EE6CF5

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$\Ojl
API String ID: 0-1796497847
Opcode ID: f70617caf18dd6fe20e417814b9a1680ddf0e99ffa7abbf9b454e813b4061259
Instruction ID: 4d4d8e1a85678acbe93543965b77cb27e14ab20953a4fefb0973a7c5786709b6
Opcode Fuzzy Hash: f70617caf18dd6fe20e417814b9a1680ddf0e99ffa7abbf9b454e813b4061259
Instruction Fuzzy Hash: C5023774A00668CFCB25EF34D994BADB7B5BB89308F1091E9D909A7395DB359E81CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00EE96B7 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE9B93
Ku, xrefs: 00EE96C4

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$Ku
API String ID: 0-4230133869
Opcode ID: 9ff792361eba96125a7c851f17ee8f63d2ec34750f5d6af5c382b656b9908310
Instruction ID: a7b1162a5145f82a4dd28e0b71beca3f256ced3ab56b589f51c57104fe3dcf65
Opcode Fuzzy Hash: 9ff792361eba96125a7c851f17ee8f63d2ec34750f5d6af5c382b656b9908310
Instruction Fuzzy Hash: EAA16D30A00604DFCB09EF75F854AAD77B6EFC8348B6194A9E806A77A9DF359C05CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE6A6B Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

\Ojl, xrefs: 00EE6AF9
:@Cl, xrefs: 00EE6CF5

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl$\Ojl
API String ID: 0-1796497847
Opcode ID: 7925aabe1ff5421c77f00348426fe8bb73cb3792d29995aecdfa272ab88485cb
Instruction ID: fb1be6477be42bf4569060cb75db65dd3d3a0661ffd14d54d13dd303e37b710a
Opcode Fuzzy Hash: 7925aabe1ff5421c77f00348426fe8bb73cb3792d29995aecdfa272ab88485cb
Instruction Fuzzy Hash: 46B14870A01268CFDB29EB35D950BEDB7B2AF89308F5041E9D509AB394DB359E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE00B8 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

2jl, xrefs: 00EE0154
2jl, xrefs: 00EE01A8

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: 2jl$2jl
API String ID: 0-1801541598
Opcode ID: d761523da4cf2171d45aa435e936eeaa01ce872c72bb8ac4846d65d3c85ee35c
Instruction ID: c690557e50b64f2d0cc713882d885427b25e21e58b63c38ddc65e7daa6244d22
Opcode Fuzzy Hash: d761523da4cf2171d45aa435e936eeaa01ce872c72bb8ac4846d65d3c85ee35c
Instruction Fuzzy Hash: EE31E0317043449FD705AB7498257AE3BAA9BC3318F5884AAD405CF7D2CFB99C09C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 0074B126 Relevance: 1.6, APIs: 1, Instructions: 108registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 0074B1F5

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 7b174c47cb83f148ad3d4da27674cca3dd70950e0d0a3979c7b12af4355d0d79
Instruction ID: dc69b59631e03219ab1f2a13d31570662801fef53fa46839d247dc1e72f57523
Opcode Fuzzy Hash: 7b174c47cb83f148ad3d4da27674cca3dd70950e0d0a3979c7b12af4355d0d79
Instruction Fuzzy Hash: E1318F7240D3C46FE7238B608C54BA6BFB8AF17214F0984DBE9808B1A3D264A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 0074AA75 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0074AB25

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8fb1d5aad021fd555624fa3de9874744c956a6116458c40e44207cffaeadc3bb
Instruction ID: 557378fdb6bba29d8426948c345063ff6a310688e02f8999bd267c93320fac53
Opcode Fuzzy Hash: 8fb1d5aad021fd555624fa3de9874744c956a6116458c40e44207cffaeadc3bb
Instruction Fuzzy Hash: 57318275509380AFE721CF25CC85F56BBF8EF05310F09849EE9458B252D365E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0074AF76 Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0074B01D

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: c345dd2096eaddd4cd6dca34e07937a86c79551b3af022ee6bf84dfd6cb5b7bb
Instruction ID: 4a574a031920e12cad5d0a63a49296bf6494944a492dbe4ca6eb967f6ccc8cf0
Opcode Fuzzy Hash: c345dd2096eaddd4cd6dca34e07937a86c79551b3af022ee6bf84dfd6cb5b7bb
Instruction Fuzzy Hash: 8B318175509380AFE711CB25DC85F56BFF8EF06314F09849AE944CB292D365E909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0074B23D Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,B99B0101,00000000,00000000,00000000,00000000), ref: 0074B2F8

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1d2b4974dd8e9df596a1f6e97bd61e86873ac2a035bb5fe51a791524e2589300
Instruction ID: 7cb80af5177d54b7379fbe6216e7d0b9d62a07430c0f75d302098b53d4d58db7
Opcode Fuzzy Hash: 1d2b4974dd8e9df596a1f6e97bd61e86873ac2a035bb5fe51a791524e2589300
Instruction Fuzzy Hash: DD3191761093849FE722CF21CC45FA6BFBCEF06724F09849AE9858B152D364E948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0074A6CE Relevance: 1.6, APIs: 1, Instructions: 85comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0074A77E

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 9cc6b1ecb82c915963ce86c93a2dede817dadb62be4dea15da79ab7a9a9153b2
Instruction ID: ceba26c05c32c5c11ef9a7bbb54519db0ebb6ec758a1517272476ed4d92fca2f
Opcode Fuzzy Hash: 9cc6b1ecb82c915963ce86c93a2dede817dadb62be4dea15da79ab7a9a9153b2
Instruction Fuzzy Hash: 2831717104D3C06FD3138B259C61B61BFB4EF47610F0A80DBD884CB5A3D2696919D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00EE96C8 Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE9B93

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl
API String ID: 0-1360559020
Opcode ID: f529cbb7c473b74ec8d8c70adfbbed7d5a52f6834df893003bb2c4c189c1fd13
Instruction ID: 0dcc61dee100a7d343f7b68ff0ac8e4ffdf4e30ec333f6c9f0095bde96481623
Opcode Fuzzy Hash: f529cbb7c473b74ec8d8c70adfbbed7d5a52f6834df893003bb2c4c189c1fd13
Instruction Fuzzy Hash: 77D15E30A00618DFCB09EFB5F854A9D77B6EF88348B2195A9D406A73A9DF359C05CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0074B42C Relevance: 1.6, APIs: 1, Instructions: 82windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 0074B4D5

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 6d9f66b566760adc9d4e7b9e17526ccd0720de1aaa8b8c987b9f73b03632fe81
Instruction ID: 3296b38aecce587fa5fd1ad0ec6fdde3555d7d502e16af76c3b25b5c32bbf920
Opcode Fuzzy Hash: 6d9f66b566760adc9d4e7b9e17526ccd0720de1aaa8b8c987b9f73b03632fe81
Instruction Fuzzy Hash: 0F21A575504780AFEB228F11DC44FA6FFB8EF46310F08849AEA844B562D375A919CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0074B34E Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,B99B0101,00000000,00000000,00000000,00000000), ref: 0074B3E4

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 242bd46c0fc5661ed349194c7f0e2377398d63e45033f77bce71b36bff35971f
Instruction ID: 6c9d4c8f2f69f6e2ca2a2bd5f5be8daf041b46eb91c884b6c9f2c97135dee637
Opcode Fuzzy Hash: 242bd46c0fc5661ed349194c7f0e2377398d63e45033f77bce71b36bff35971f
Instruction Fuzzy Hash: DB21A476508380AFE7228F15DC45F67BFB8EF46710F08849AE9858B252D364E848C771

Uniqueness

Uniqueness Score: -1.00%

Function 0074AAA6 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0074AB25

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c339ea50f589887dcb404b70978edad70281c777829dd3d010195af5ce59394d
Instruction ID: faba4324cd7d310675b3e1f3e65fb80f8b535d2e9babe1c6d0ba2577c1b6ec9b
Opcode Fuzzy Hash: c339ea50f589887dcb404b70978edad70281c777829dd3d010195af5ce59394d
Instruction Fuzzy Hash: C421A1B5544240AFEB21CF65DC85F66FBE9EF08720F08846EEA458B651D375E804CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0074B176 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 0074B1F5

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: ffdc7e8b81b0b09cd24da6c93d538fc559172558acd032f861e7c343a80b27e2
Instruction ID: 982b432c7374d135c7a0ee177b0fe46dee6e969020c263e038d3fe76f67d7b82
Opcode Fuzzy Hash: ffdc7e8b81b0b09cd24da6c93d538fc559172558acd032f861e7c343a80b27e2
Instruction Fuzzy Hash: 9A21A172504204AFF7219F55DC84FABFBECEF08724F04845AEA458B651D374E9088A71

Uniqueness

Uniqueness Score: -1.00%

Function 0074ADCE Relevance: 1.6, APIs: 1, Instructions: 73fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,B99B0101,00000000,00000000,00000000,00000000), ref: 0074AE4D

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 0635437f653db0b9e3040c5e898d4ccbf56df9260d583d9f4cc9d3e68163f4ff
Instruction ID: 5d9cc7cc2417f63c8102dddcf5f0b5f0df3da97866f3838ff649afa45ce6931f
Opcode Fuzzy Hash: 0635437f653db0b9e3040c5e898d4ccbf56df9260d583d9f4cc9d3e68163f4ff
Instruction Fuzzy Hash: 8E219F76404340AFEB22CF51DC44FA7BBA8EF45720F0584AAFA448B152D265A908CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0074AC37 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,B99B0101,00000000,00000000,00000000,00000000), ref: 0074ACBD

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 4e9c3ce82efccd81375f8761557127eec8f818b78b98805b14806fec2d0a014b
Instruction ID: e11da54ecb2c15e5cca620a37e5cd6586b769b4e3a604bc107f589228b5b81c0
Opcode Fuzzy Hash: 4e9c3ce82efccd81375f8761557127eec8f818b78b98805b14806fec2d0a014b
Instruction Fuzzy Hash: 572193B54097806FE7128B119C95BA2BFB8DF47724F0980DAE9848B193D268A909D772

Uniqueness

Uniqueness Score: -1.00%

Function 0074A9BF Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0074AA44

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b12ebb5768386894519228a369c7554cba642d777f4d7690a3b6ac2f5852e444
Instruction ID: a937d84967ffd497c90008ecd781c9d965a80e64d8f1c48caf020c335327e742
Opcode Fuzzy Hash: b12ebb5768386894519228a369c7554cba642d777f4d7690a3b6ac2f5852e444
Instruction Fuzzy Hash: 0421486544E3C0AFDB138B259C64A51BFB4EF53624F0E80DBD9C48F5A3D2699848CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0074A140 Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 0074A1C1

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: ecf5b3e431d316b2e387e88ea362c38a2b6855dbb924dcb39d6a70a58eb70305
Instruction ID: 0c135cb5234a6c06208354d655f3e9f6932fe1a962029b865d251fbf0364e76f
Opcode Fuzzy Hash: ecf5b3e431d316b2e387e88ea362c38a2b6855dbb924dcb39d6a70a58eb70305
Instruction Fuzzy Hash: 2821A13140D3C0AFD7238B218C94B52BFB4EF07210F0984DBE9848F5A3D269A819D772

Uniqueness

Uniqueness Score: -1.00%

Function 0074AFAA Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0074B01D

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 155e448813ca4fd2a1161a969b4d50f8247ae874ffbec57207b8ecefbbfe5cce
Instruction ID: b268f35fef87065016bc54a5a05aff7eb87dfe3c43fdb9887173a7ccb66228b0
Opcode Fuzzy Hash: 155e448813ca4fd2a1161a969b4d50f8247ae874ffbec57207b8ecefbbfe5cce
Instruction Fuzzy Hash: 0D219275605240AFE720CF25DD85FA6FBE8EF04724F08846AE944CB651D379E904CB75

Uniqueness

Uniqueness Score: -1.00%

Function 0074AB7C Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0074ABF0

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 5633a7d3a90b9c32f5d174991a0cec9ae99afefd237bcccfbf7df6dc56e60b65
Instruction ID: e7223b43818bb4550440e9858df81069669144ee5b5e54bde7cd08fab23ed711
Opcode Fuzzy Hash: 5633a7d3a90b9c32f5d174991a0cec9ae99afefd237bcccfbf7df6dc56e60b65
Instruction Fuzzy Hash: 6521A4755093C09FDB128B25DC95752BFA8EF07320F0984DAED858F6A3D2699908C762

Uniqueness

Uniqueness Score: -1.00%

Function 0074B27E Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,B99B0101,00000000,00000000,00000000,00000000), ref: 0074B2F8

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4d14e82cdc98fc4d71e38d54ae01d0ca210b99a551d7caf3b33db1d8e40fcf3d
Instruction ID: 55fbf35c1301f2937acea96ac00b23fc9d759791070c4393888c24e2f5f0f0fc
Opcode Fuzzy Hash: 4d14e82cdc98fc4d71e38d54ae01d0ca210b99a551d7caf3b33db1d8e40fcf3d
Instruction Fuzzy Hash: C42190756002049FEB20CF16DC85F6AF7ECEF04720F08856AE9458B651D778ED48CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0074B719 Relevance: 1.6, APIs: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 0074B78E

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: a54b55e95ef1f1d3fc7583f7b33997a74e7ffb7b72c5b7c81dc1f3f195dc5e53
Instruction ID: adf245d7c07bd8bb8767dcffb42438e944f44ab21fc0b4b373b451c8a4710b4f
Opcode Fuzzy Hash: a54b55e95ef1f1d3fc7583f7b33997a74e7ffb7b72c5b7c81dc1f3f195dc5e53
Instruction Fuzzy Hash: E9213B715093809FEB228F25DC54B52BFE8EF56610F08849AE985CB652D369E808DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0074BE3C Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0074BEA8

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1f722ea38487c58dd6457b492a23aa09db4733cedcde06441fd465cdc8b9e27b
Instruction ID: 4a313a01ccea61193b52d392e4891dc5ab64c0f327719282dc6e4aafa549ec9d
Opcode Fuzzy Hash: 1f722ea38487c58dd6457b492a23aa09db4733cedcde06441fd465cdc8b9e27b
Instruction Fuzzy Hash: DB21F0725093C05FDB02CB25DC94792BFB4AF43320F0D84DAE9848F663D269A808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0074B897 Relevance: 1.6, APIs: 1, Instructions: 68fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 0074B908

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b7c357e298cf9376b6ff3326151fa8f15ed7421f1e6f23f3e34beab0ae216819
Instruction ID: 1dd69efc892a5427bf24bbb855e653dfd1790dcd6c4960fe7a5a848edaf7616a
Opcode Fuzzy Hash: b7c357e298cf9376b6ff3326151fa8f15ed7421f1e6f23f3e34beab0ae216819
Instruction Fuzzy Hash: DA21A1B65093809FDB12CB25DC44B52BFB8DF06314F0984DAED84CF193D269E908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0074B45A Relevance: 1.6, APIs: 1, Instructions: 66windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 0074B4D5

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 243621f787ff2d2c78fb3120f5cf751446a853d975d7096f721011af55c72635
Instruction ID: 919eb98cc8e3003ecd86ebbbc54c43faad65892ac44adb771c3957d92a2df4e0
Opcode Fuzzy Hash: 243621f787ff2d2c78fb3120f5cf751446a853d975d7096f721011af55c72635
Instruction Fuzzy Hash: 9521DF75400200AFEB218F11DC40F66FBA8EF44720F18849AFE454B691D379E918DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0074B372 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,B99B0101,00000000,00000000,00000000,00000000), ref: 0074B3E4

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1ff01fefa0660e9e136b3745ae514b6a2b703e5e22c6aedeb6a2a6a6d356ce90
Instruction ID: 20cc02717ac81ea1f9a0a00b4c0fba4a7c915b52993f15c3872c1ae5626f24b4
Opcode Fuzzy Hash: 1ff01fefa0660e9e136b3745ae514b6a2b703e5e22c6aedeb6a2a6a6d356ce90
Instruction Fuzzy Hash: AB118176504600AFEB218E16DC45F66BBECEF44720F18C56AE9459B652D368E804CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0074B94F Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 0074B9BF

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: aea64d6f92a9ff435ec86c2f36fdc9751166893a45cfaa2c233c1aa4890c4fc8
Instruction ID: 8b565a44b2c602e656a4669f45e96918856854f6d4d042f2a906261836b3a8c4
Opcode Fuzzy Hash: aea64d6f92a9ff435ec86c2f36fdc9751166893a45cfaa2c233c1aa4890c4fc8
Instruction Fuzzy Hash: 692181755093C09FDB128B25DC85B56BFE8EF46320F0984DAE985CF262D379E848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0074BC06 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0074BC6E

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 28b8232cc9dd80c45b2d2e90859cdb4d2af8ad744e923d1ee413dd160f748b7d
Instruction ID: 92cf6ca040fa633c21ca4a5410ab0a204879f5734e287e5f6c9b7df928388c20
Opcode Fuzzy Hash: 28b8232cc9dd80c45b2d2e90859cdb4d2af8ad744e923d1ee413dd160f748b7d
Instruction Fuzzy Hash: DF1151715053809FDB21CF25DC85B62BFE8EF56620F0984AAED45CB652D379E804CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0074A61E Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0074A690

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 94c4c34bfbdeccb7c458c2b289279a925027a3b7161d5e97f081fafb5dc0ad19
Instruction ID: 3d3dc95a309fc069c94f10f500006021913c7679f43ab9a8d4c79d5c2d93b3e9
Opcode Fuzzy Hash: 94c4c34bfbdeccb7c458c2b289279a925027a3b7161d5e97f081fafb5dc0ad19
Instruction Fuzzy Hash: 9F2138754093C09FDB128B259894792BFB4DF47220F0A84DBE9849F1A3D2699908DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0074A573 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0074A5DE

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 36fbd7cd8d7e8deea68614e91320ba9e267af996f52b5276bfbb0c1e7f2e5e63
Instruction ID: 50fee2bf995b817e93fdb89471a54e7512e5fe0b3c921f78c18a4654ca371ea3
Opcode Fuzzy Hash: 36fbd7cd8d7e8deea68614e91320ba9e267af996f52b5276bfbb0c1e7f2e5e63
Instruction Fuzzy Hash: CA117571449380AFDB228F55DC44A52FFF4EF46310F0988DAE9858B562D376A818DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0074ADEE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,B99B0101,00000000,00000000,00000000,00000000), ref: 0074AE4D

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4165c876cc75a20697c2659f9070cb831b24821ba5b4d40ddd88229e7c9fc93d
Instruction ID: b4d3284dc9fdaaf3a5c4c5c23f70245885eb7ac567ed13c174e741bacb176740
Opcode Fuzzy Hash: 4165c876cc75a20697c2659f9070cb831b24821ba5b4d40ddd88229e7c9fc93d
Instruction Fuzzy Hash: 7C11B275404200AFEB21CF51DC45FA6FBA8EF44724F14C46AEA458B651D379A4048BB2

Uniqueness

Uniqueness Score: -1.00%

Function 0074B746 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 0074B78E

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: c4e46fe4a6fea5d7f621dbb430ecfc56b2e0c6f321cd494b804bf4779b6ff180
Instruction ID: 39bd2fa9eec306c0fb0fd9168127af957614e5ed3d7dbd6da1139cd00de9f0ab
Opcode Fuzzy Hash: c4e46fe4a6fea5d7f621dbb430ecfc56b2e0c6f321cd494b804bf4779b6ff180
Instruction Fuzzy Hash: 85118E756002409FEB61CF2AD885B56FBE8EF55720F08C4ABED49CB642D379E804CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0074BC26 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0074BC6E

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c4e46fe4a6fea5d7f621dbb430ecfc56b2e0c6f321cd494b804bf4779b6ff180
Instruction ID: 3ee0c722f928a8be873dbed7702f7f860d7bbfe1da199e2da6cf925e07b7736d
Opcode Fuzzy Hash: c4e46fe4a6fea5d7f621dbb430ecfc56b2e0c6f321cd494b804bf4779b6ff180
Instruction Fuzzy Hash: 2B117C756002008FEB10CF2AD8C5B66BBE8EF54320F0884AAED49CB651D779E804CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0074AC6A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,B99B0101,00000000,00000000,00000000,00000000), ref: 0074ACBD

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 20462aaaddd031a936085164ae0f219e634625e0f801875692e1b7b7ee681615
Instruction ID: dc091758d25911ebd4e0a8b900642264bdd17277a38cff1a712312f8af884b66
Opcode Fuzzy Hash: 20462aaaddd031a936085164ae0f219e634625e0f801875692e1b7b7ee681615
Instruction Fuzzy Hash: E201D675544200AFE710CB05DC85FB6F798DF44724F18C09AEE048B641D378E948CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 0074BAAC Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0074BB00

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: bddfd1b718b21121a59b51d14b587817375f91f69f508171b5c0440383eab4da
Instruction ID: eb37206fc39e4c8a3d95c8b1be3ddbcf05def9bf9f6c93530da26c41928bd022
Opcode Fuzzy Hash: bddfd1b718b21121a59b51d14b587817375f91f69f508171b5c0440383eab4da
Instruction Fuzzy Hash: 1211A1755093C09FDB128B25DC84B52FFB4DF47220F0980DBED858F6A2D279A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0074B67C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 0074B6D3

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: cb835d51a9ffb4019c126d4d9d0972c85f6aa6faf4e9775cf61b236d0307fc6e
Instruction ID: e4c69003bad4fe887d8bd83471fc3e4c197cea184775ace81365a4d6a005eb29
Opcode Fuzzy Hash: cb835d51a9ffb4019c126d4d9d0972c85f6aa6faf4e9775cf61b236d0307fc6e
Instruction Fuzzy Hash: C9115E754093809FDB12CF55DC85B52BFE4EF46320F09849BED458F262D379A848CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0074B982 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 0074B9BF

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b85fea25dec4ea15c3112baa1aacefa3684d94dd9bf72796ec557fe918af04ed
Instruction ID: f9566d99030fe37fd2bb3fc8a95fbe62ced052b7fce74a15c8fb1ffe87d63472
Opcode Fuzzy Hash: b85fea25dec4ea15c3112baa1aacefa3684d94dd9bf72796ec557fe918af04ed
Instruction Fuzzy Hash: EA018C75605240CFEB50CF2AD885766FBE8EF05320F08C4AAED49CB752D379E844CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0074B8CE Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 0074B908

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 9e33a5dd6df198aaf4b3f0fe543e8e8b10962d383da6fb5909cdd7112ec0b6f4
Instruction ID: ac7cc73148e466bceaaeb5199d06948ea194f1ced994a8aac74e928d2a6ee46c
Opcode Fuzzy Hash: 9e33a5dd6df198aaf4b3f0fe543e8e8b10962d383da6fb5909cdd7112ec0b6f4
Instruction Fuzzy Hash: 80014C75A042408FEB14CF2AD885766BBD8DF45720F18C4AADE49CB652D379E8448AA2

Uniqueness

Uniqueness Score: -1.00%

Function 0074A59A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0074A5DE

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a5760e71d73bf3609a3d43527824a55a1570d497366d5328f005d5f402603d0c
Instruction ID: e2ebb18c4e977e901a0219ebe87a869f6cf5b88d47aa0c1faa6ba6a4240caba9
Opcode Fuzzy Hash: a5760e71d73bf3609a3d43527824a55a1570d497366d5328f005d5f402603d0c
Instruction Fuzzy Hash: EC016D76400640AFDB21CF55D984B56FFE0EF48720F08C99AEE494B651D37AE428DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0074BE76 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0074BEA8

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 47fd9925ce4c379d90033bf77f4e61d4354a89fd50b0374c2d65184e1d56fe2b
Instruction ID: e6cd5df7e3a37bd35d138d1b5bc3fb34aad87a8f8c4bfda5f1b539eea696de4d
Opcode Fuzzy Hash: 47fd9925ce4c379d90033bf77f4e61d4354a89fd50b0374c2d65184e1d56fe2b
Instruction Fuzzy Hash: D001DF755042408FDB10CF1AD884796FBE4EF84320F08C4AAED498F652D379E808DAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0074ABBE Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0074ABF0

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 306346afbe98752833f16c06b8e55ca3f42ccb935736c43833320f75e248e42b
Instruction ID: 849d7c012fdb66af7e78140c6b43009190637bf3950888332bfb55f593aaec06
Opcode Fuzzy Hash: 306346afbe98752833f16c06b8e55ca3f42ccb935736c43833320f75e248e42b
Instruction Fuzzy Hash: A4018F759042409FEB50CF16E8857A6FBE4DF45320F08C4ABDD498F652D379E848DAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0074A72E Relevance: 1.5, APIs: 1, Instructions: 43comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0074A77E

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 985a9aa38061d6a2d6ffdd4f719f7ffacbaa9e426afbd05ed13e05b91b3c82ad
Instruction ID: c3140e8cbb5996560f60cb69b009392c582fce14b1fd8105dd5d406e756fbad2
Opcode Fuzzy Hash: 985a9aa38061d6a2d6ffdd4f719f7ffacbaa9e426afbd05ed13e05b91b3c82ad
Instruction Fuzzy Hash: AC01A271600200ABD210DF16CC86B26FBE8FB89A20F14815AED085B741E775F955CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0074A186 Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 0074A1C1

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 3d31c074565b11a319a29ed4211b6d8694118c309693a2447c30d4153460be40
Instruction ID: 875aecec156f9409e6aad8ced51d7df4aa74b02ef51981bc98f93d48d7eeef09
Opcode Fuzzy Hash: 3d31c074565b11a319a29ed4211b6d8694118c309693a2447c30d4153460be40
Instruction Fuzzy Hash: 17019E354042449FDB20CF55D884B66FBE0EF44320F08C49AED494B611D379E458DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0074B69E Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 0074B6D3

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: 7e1504c4554ed95003da52f8b055f9569fb1a31cd4345e624e9b8ba455ad649e
Instruction ID: 9d428810b7fa3e65a166dce4ac16b78bdea6bff734d5399b1fd2b1f6b29e8f04
Opcode Fuzzy Hash: 7e1504c4554ed95003da52f8b055f9569fb1a31cd4345e624e9b8ba455ad649e
Instruction Fuzzy Hash: C00178758042409FEB10CF15D884B65FBE4EF44320F09C4AADD488F652D3BAE808DAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0074A65E Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0074A690

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7aa981cbad59465da6a252f0424a7a841272904673d81e4b539cfecb676a7dc4
Instruction ID: bb7d8bd7db77dad1614c68935552e6ad98674f0557ce9359e3549da8745948d5
Opcode Fuzzy Hash: 7aa981cbad59465da6a252f0424a7a841272904673d81e4b539cfecb676a7dc4
Instruction Fuzzy Hash: F1018B758042409FEB10CF16D884766FBA4EF45320F0EC4AADD488F652D379A408CAA3

Uniqueness

Uniqueness Score: -1.00%

Function 0074BACE Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0074BB00

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: b461841ee6c605f1d3a652bef56055c08a6a425aa03f4f0621f256f2676283a8
Instruction ID: 10ecda63987f6c703d5705efaf86da8320a4eb548c23dcc5776e71056d7b67de
Opcode Fuzzy Hash: b461841ee6c605f1d3a652bef56055c08a6a425aa03f4f0621f256f2676283a8
Instruction Fuzzy Hash: 0201A4756042408FDB148F16D8857A6FBE4DF05720F08C0EADD458FB56D3B9E848CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 0074AA12 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0074AA44

Memory Dump Source

Source File: 00000002.00000002.3689011732.000000000074A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74a000_server.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: aa0858dff072d74de5e210cc1b7c072e9a970987bc981d5df18f5ef565e0e378
Instruction ID: 3a54222fc096e2510dc11fd4a11d500ad3d9cc1fa2d0fba6cee66d266edbb84b
Opcode Fuzzy Hash: aa0858dff072d74de5e210cc1b7c072e9a970987bc981d5df18f5ef565e0e378
Instruction Fuzzy Hash: D2F08C75A44240AFDB208F05D984765FBE0EF45724F08C09ADD494B752D3B9A948CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EE97CD Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE9B93

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl
API String ID: 0-1360559020
Opcode ID: 929cbfd26e18820209d7f1934a5307bd41adc6a29802b818433f0852ffb74032
Instruction ID: 0093da8b22d199fea4d176d5f3d52138b49785694594ebb5b50ee10fec842a83
Opcode Fuzzy Hash: 929cbfd26e18820209d7f1934a5307bd41adc6a29802b818433f0852ffb74032
Instruction Fuzzy Hash: 58914D34A00604DFCB09AF75F854AAD77B2EF88348B6095A9D816A77A9DF369C05CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE987B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE9B93

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl
API String ID: 0-1360559020
Opcode ID: dbefe73231f8d6a93052565850cf2a83213ea8460bc206865957e70e937c6e7f
Instruction ID: e466fd1fa01b195c0a5fc88437697e5739a99026bd014da9c9d509341c941810
Opcode Fuzzy Hash: dbefe73231f8d6a93052565850cf2a83213ea8460bc206865957e70e937c6e7f
Instruction Fuzzy Hash: CD815B34A00614DFCB09EF75E854AAD73B2EFC8348B6095A9E815A77A9DF369C01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE98FD Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE9B93

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl
API String ID: 0-1360559020
Opcode ID: 1b71725cf441eec756521f984716cd02813fba6ff63ac57b2113371fbf4ab895
Instruction ID: 0a1d862f3db1b3a76e4543bc04e546f9436802e523c78145acdfb04246e0bc1f
Opcode Fuzzy Hash: 1b71725cf441eec756521f984716cd02813fba6ff63ac57b2113371fbf4ab895
Instruction Fuzzy Hash: C9717B34A01604DFCB09AF75F855AAD73B2EFC8348B6095A9D806A77A9DF369C11CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE39BF Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

2jl, xrefs: 00EE3C2E

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: 2jl
API String ID: 0-3618021078
Opcode ID: 49f82d2bc8b2b1dc8aaf05a5fd017c9d68b3574a9894f2d150c762d7eac17e6b
Instruction ID: b0583c470aac285babe84f38a44a79fbe8802b0f33c3b9355e865add9fb69e73
Opcode Fuzzy Hash: 49f82d2bc8b2b1dc8aaf05a5fd017c9d68b3574a9894f2d150c762d7eac17e6b
Instruction Fuzzy Hash: 2A817C30A00258CFCB14EFB4D855BECB7B2AF89308F5084A9D00AAB394DB759E84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00EE6C46 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE6CF5

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl
API String ID: 0-1360559020
Opcode ID: 31134a7af345723d0a244593796fe721e7b15fbf591cc73ad0b57fffab5eb7bb
Instruction ID: b7f24c090cc030be3710109633f54728132a6733402d5fc9277c89953d2034fc
Opcode Fuzzy Hash: 31134a7af345723d0a244593796fe721e7b15fbf591cc73ad0b57fffab5eb7bb
Instruction Fuzzy Hash: B5613870A01268CFDB25EB35D994BEDB7B2AB89308F5042E9D5096B394DF359E85CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00EE99ED Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE9B93

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl
API String ID: 0-1360559020
Opcode ID: cbf889c42a61190063e71bd567602facecb6c86a8c7bfcac5efd220af371167d
Instruction ID: f58d9a56052bab3e5a0c3d1a02f67465557774a943ece49d37ac09328ed64af4
Opcode Fuzzy Hash: cbf889c42a61190063e71bd567602facecb6c86a8c7bfcac5efd220af371167d
Instruction Fuzzy Hash: 8951BF30B00618DFCB18AFB1E8516AD73A6EFC8348F209569D816A77A9DF35AC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00EE02C0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

:@Cl, xrefs: 00EE036D

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID: :@Cl
API String ID: 0-1360559020
Opcode ID: d0e35d41daeba16086c615b9591d060a13a3a4f60c9fa3146bfadc1d807cc6a6
Instruction ID: dd222fc1878fad8258a7a954d2368da8a21594b141b4e4b1931ad133d9e58a0c
Opcode Fuzzy Hash: d0e35d41daeba16086c615b9591d060a13a3a4f60c9fa3146bfadc1d807cc6a6
Instruction Fuzzy Hash: 6D310630B006059FCB04BB75D8117BE33A6DB88308F148479D405D77A9EF799D49C792

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3DCC Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387e73f17e49071574b319b8b28add83fe8aa71738ef69a5838922f5fc75b6ef
Instruction ID: 7a09004fc4ed8b05e6613b157bdbb6eea6253d395c43c4e5e563995c29b7a947
Opcode Fuzzy Hash: 387e73f17e49071574b319b8b28add83fe8aa71738ef69a5838922f5fc75b6ef
Instruction Fuzzy Hash: C5A1D174A01228CFCB24EF75D944AECB7B2BB89309F1051E9D809AB795DB359E80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE7FDE Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81ed974ae7745189c9365d52f5e77c5131afc05712bc7fc3fe6db26fa94fd16
Instruction ID: 9ac413bd0497d4dd7efd37ef608b91ec7e68652f7e82649d5b0dc6f95534d278
Opcode Fuzzy Hash: b81ed974ae7745189c9365d52f5e77c5131afc05712bc7fc3fe6db26fa94fd16
Instruction Fuzzy Hash: 6641E6306086858FD714DF3798057BC72E6AF45358F2895A4E451EB2E1EF38CD46CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00EE9FC8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2831dbaaeceac15869aa36373d71d835d3cc9985088120cd4e2784b2af294a11
Instruction ID: 8564ae442e62771cfd191c698227aba3866b7c2c7b4f53688aaf8b73ff8a8ed0
Opcode Fuzzy Hash: 2831dbaaeceac15869aa36373d71d835d3cc9985088120cd4e2784b2af294a11
Instruction Fuzzy Hash: 9B31B534B002099FDB04DB75D8547AEBBF6AF88354F284079E405EB3A1DF71AD048B91

Uniqueness

Uniqueness Score: -1.00%

Function 00EE9CE7 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c780a45238249bee03f6eba9aa9dc30d93999b2f563519dd4d25c4ee94f5b3
Instruction ID: 5b66393ded61b85adacb12cfce167d40fe52c1cb05d6673261dcbe7997a39b10
Opcode Fuzzy Hash: a6c780a45238249bee03f6eba9aa9dc30d93999b2f563519dd4d25c4ee94f5b3
Instruction Fuzzy Hash: 4411BF71E00219CF8F44EBB9E8052ADBBF6EF8A25472114B9C90AF7395DB315E01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C322B8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3704766320.0000000005C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5c30000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664327727c726345981fdd3aa6268ae7ce29ddb9429d1fec682e602ffe595fb2
Instruction ID: 8ded2172c638986f377432ee0dac1dec2e3ba7cf087046ee9f9687553df01e7f
Opcode Fuzzy Hash: 664327727c726345981fdd3aa6268ae7ce29ddb9429d1fec682e602ffe595fb2
Instruction Fuzzy Hash: 1511BAB5908341AFD340CF19D880A5BFBE4FBC9664F04895EF998D7311D275E9148FA2

Uniqueness

Uniqueness Score: -1.00%

Function 05C3215C Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3704766320.0000000005C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5c30000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61ecaf7b08fdfc426000c4bcf2cd21010d12c70141c48a5aa291551dc0870fb
Instruction ID: 58a5d216c8cbca498cee707651ce389812e2663852bd8719d70863dd2615200d
Opcode Fuzzy Hash: b61ecaf7b08fdfc426000c4bcf2cd21010d12c70141c48a5aa291551dc0870fb
Instruction Fuzzy Hash: ED11FEB5508301AFD750CF09DC80E57FBE8EB88660F04881EF95897311D275E9088FA2

Uniqueness

Uniqueness Score: -1.00%

Function 0075B454 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689246026.000000000075A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0075A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_75a000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1c8e541aef1c6148a6665ecce3245fa058368bfcb09fab4cbf08891b7ae5ba
Instruction ID: 2399724d4e134533e765a4be0a697cf6461c57c43e5a01bc2bce07ac2abba143
Opcode Fuzzy Hash: 2d1c8e541aef1c6148a6665ecce3245fa058368bfcb09fab4cbf08891b7ae5ba
Instruction Fuzzy Hash: 0311FEB5508301AFD350CF09DC80E57FBE8EB88660F04891EF95897311D375E9088FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3C66 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a599f9296e0822d85e72061f708e835ce3a96c0614bc95c33520eca068001c
Instruction ID: b1e1a6b19837bc513c74a8b69ef494a8f36ec363b118d9a335a68b01af333a6b
Opcode Fuzzy Hash: 33a599f9296e0822d85e72061f708e835ce3a96c0614bc95c33520eca068001c
Instruction Fuzzy Hash: 45113A74E01258CFEB24EBB5D914BECF7B1AF88305F5081AAC419AB280D7784A84DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00EE00A8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80b9f005dbe06bccc00df01b7a3347ec0e27f56ab04cdc72f7c2a3e9b8b8812
Instruction ID: 07129a66575064f0d784fd8f3dc5bee69e310444f277910bc112ba72da5bd68c
Opcode Fuzzy Hash: a80b9f005dbe06bccc00df01b7a3347ec0e27f56ab04cdc72f7c2a3e9b8b8812
Instruction Fuzzy Hash: C4F0C232A00348AFEB049FB1CC1279E7F66EB81724F1481AAE5459B2D1EA759945C790

Uniqueness

Uniqueness Score: -1.00%

Function 00EE74E0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fea2cf9ab4747448309fe5274f56f438c1cb648df13759ea79e85b8b5932a78e
Instruction ID: 88d9acf4c5719e45f730d4587f503f5239be89a1c385ddb630fb7367852cefb0
Opcode Fuzzy Hash: fea2cf9ab4747448309fe5274f56f438c1cb648df13759ea79e85b8b5932a78e
Instruction Fuzzy Hash: 10F090343047908BC7176734942416C3726EBC231BB9544FAD8429F397DB3A9C0687A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE9F88 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513b0098ca95fb9b35858943e2c2731fbe1b8454abca036784a4b759bbe81bd2
Instruction ID: a830bb6ab7c4f59c2bf9e9f5821b3597ea316806a8435665a7267a90e2ce39a7
Opcode Fuzzy Hash: 513b0098ca95fb9b35858943e2c2731fbe1b8454abca036784a4b759bbe81bd2
Instruction Fuzzy Hash: 20F0A731A0938C9FCF02CBB298050FCBFB5EB42365B1950E7D415E7162DA355D09D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 05C31BCF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3704766320.0000000005C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5c30000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e11950f010ac233d344957c6662dcaf3923875a4db635b855a402c3216ed5d
Instruction ID: 2920146c09e3d91335ac5deaa170db3cee6be4d406005aae8a87aac5b63a7551
Opcode Fuzzy Hash: 55e11950f010ac233d344957c6662dcaf3923875a4db635b855a402c3216ed5d
Instruction Fuzzy Hash: 82E0D8B250020467D250DE069C85F63FBD8DB80A30F08C457ED081F701E1B6B514C9E1

Uniqueness

Uniqueness Score: -1.00%

Function 05C321AB Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3704766320.0000000005C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5c30000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d547c8b596ff09b2502ff3f3ac1594caf4e00fe93409b138c90311cf09bb9f12
Instruction ID: 4f1728daa51eff87aa95a313d3c967fd70eea8381b4658cfd2ac5670e240177a
Opcode Fuzzy Hash: d547c8b596ff09b2502ff3f3ac1594caf4e00fe93409b138c90311cf09bb9f12
Instruction Fuzzy Hash: 08E0D8B25002046BD650DE069C85F63FBD8DB80A30F08C457ED081F702E1B6B51489F1

Uniqueness

Uniqueness Score: -1.00%

Function 05C32323 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3704766320.0000000005C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5c30000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7785d1801273d3bb1cd2653843b51f435ed2fe6157ebed501355effb4b74ef26
Instruction ID: 073a8ba6e9a47d3ca5f7ebeacb312dc414afec15dbe0ac3ebbc00683eac7c46a
Opcode Fuzzy Hash: 7785d1801273d3bb1cd2653843b51f435ed2fe6157ebed501355effb4b74ef26
Instruction Fuzzy Hash: D9E0D8B254020067D650CE069C85F62FBD8DB94A30F48C467ED081F741E1B6B5148AE1

Uniqueness

Uniqueness Score: -1.00%

Function 0075B4A3 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689246026.000000000075A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0075A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_75a000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9215d46285ae5bcfee7f18f9f3ec23aba8e243e15cf0b6f3913b544225983a
Instruction ID: 251d4b242fe7f26116a39160fdcdf378a95c448cd317ca1b2d88ff1cbe2914a1
Opcode Fuzzy Hash: 4c9215d46285ae5bcfee7f18f9f3ec23aba8e243e15cf0b6f3913b544225983a
Instruction Fuzzy Hash: E3E0D8B254020467D2508F069C85F52FBD8DB80A30F08C557ED085F701E2B6B51489F1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE8048 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f3186986a276e469b570b934a8f472eb3c24a247570930c995498de0f5a8c9
Instruction ID: c33d3628bf6bf19f73eec21c5f79ada6298cd7c0649230bfe9dfed21bcb309a9
Opcode Fuzzy Hash: 20f3186986a276e469b570b934a8f472eb3c24a247570930c995498de0f5a8c9
Instruction Fuzzy Hash: 08E01A71D042199E8B40EFBA98055DFBBF8EA48224B10043AC218E7201E73942058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE36A8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3698229161.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ee0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9748de411cbc678b4a3c2f521c77e802db47d8ca4dd0532db04f040bffe1808f
Instruction ID: 63e7f3035169293510d589c0b5eefbb39f1dc454b5b908ad8d2ae6a1e4eb507c
Opcode Fuzzy Hash: 9748de411cbc678b4a3c2f521c77e802db47d8ca4dd0532db04f040bffe1808f
Instruction Fuzzy Hash: 1DE0EC301573C8CFCB166B34A45945C3B75EB473097D604FDC8568F2A6EA7A9C46CB50

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report U22p1GcCSb.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Notepad.exe

C:\Program Files (x86)\Explower.exe

C:\Umbrella.flv.exe

C:\Users\user\AppData\Local\Explower.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\7330bac122947b8db6af3ae8d6783a41Windows Update.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Explower.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Microsoft Corporation.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\U22p1GcCSb.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe

Windows Analysis Report
U22p1GcCSb.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre