Edit tour

Windows Analysis Report
a1K847qsM0.exe

Overview

General Information

Sample name:	a1K847qsM0.exe renamed because original name is a hash value
Original sample name:	55e2016fcb659bdf0f46a24ef2876609.exe
Analysis ID:	1580216
MD5:	55e2016fcb659bdf0f46a24ef2876609
SHA1:	5afb69f26ddf1884372643a2b00d16a481fc7c26
SHA256:	3825fe6fd9e8754b3d4a374b8c73884647c6898d5e1220a0fe89b1a3dc8e35c4
Tags:	exenjratRATuser-abuse_ch
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to disable the Task Manager (.Net Source)

Contains functionality to spread to USB devices (.Net source)

Disables zone checking for all users

Drops PE files to the document folder of the user

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the program root directory (C:\Program Files)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

a1K847qsM0.exe (PID: 1276 cmdline: "C:\Users\user\Desktop\a1K847qsM0.exe" MD5: 55E2016FCB659BDF0F46A24EF2876609)

server.exe (PID: 384 cmdline: "C:\Users\user\AppData\Local\Temp\server.exe" MD5: 55E2016FCB659BDF0F46A24EF2876609)

netsh.exe (PID: 5040 cmdline: netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 904 cmdline: netsh firewall delete allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7064 cmdline: netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 1576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

24983f03fb74576bbc5af6aa1085b23dWindows Update.exe (PID: 5560 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe" MD5: 55E2016FCB659BDF0F46A24EF2876609)

24983f03fb74576bbc5af6aa1085b23dWindows Update.exe (PID: 2752 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe" MD5: 55E2016FCB659BDF0F46A24EF2876609)

Explower.exe (PID: 6568 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe" MD5: 55E2016FCB659BDF0F46A24EF2876609)

Microsoft Corporation.exe (PID: 3116 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe" MD5: 55E2016FCB659BDF0F46A24EF2876609)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Campaign ID": "Owned", "Version": "0.7d", "Install Name": "24983f03fb74576bbc5af6aa1085b23d", "Install Dir": "system", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
a1K847qsM0.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
a1K847qsM0.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
a1K847qsM0.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
a1K847qsM0.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x1547b:$: set cdaudio door closed 0x1543f:$: set cdaudio door open 0x15c9f:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
a1K847qsM0.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a37:$reg: SEE_MASK_NOZONECHECKS 0x156bd:$msg: Execute ERROR 0x15711:$msg: Execute ERROR 0x15c89:$ping: cmd.exe /c ping 0 -n 2 & del
a1K847qsM0.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
Click to see the 1 entries

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x1547b:$: set cdaudio door closed 0x1543f:$: set cdaudio door open 0x15c9f:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a37:$reg: SEE_MASK_NOZONECHECKS 0x156bd:$msg: Execute ERROR 0x15711:$msg: Execute ERROR 0x15c89:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x1547b:$: set cdaudio door closed 0x1543f:$: set cdaudio door open 0x15c9f:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a37:$reg: SEE_MASK_NOZONECHECKS 0x156bd:$msg: Execute ERROR 0x15711:$msg: Execute ERROR 0x15c89:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Notepad.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Notepad.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Notepad.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Notepad.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Notepad.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
C:\Notepad.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Notepad.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Notepad.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Notepad.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a37:$reg: SEE_MASK_NOZONECHECKS 0x156bd:$msg: Execute ERROR 0x15711:$msg: Execute ERROR 0x15c89:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Notepad.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Local\Temp\server.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Local\Temp\server.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Local\Temp\server.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Local\Temp\server.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x1547b:$: set cdaudio door closed 0x1543f:$: set cdaudio door open 0x15c9f:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
C:\Users\user\AppData\Local\Temp\server.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a37:$reg: SEE_MASK_NOZONECHECKS 0x156bd:$msg: Execute ERROR 0x15711:$msg: Execute ERROR 0x15c89:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Local\Temp\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135ec:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\Users\user\AppData\Local\Temp\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135ec:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\Users\user\AppData\Local\Temp\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135ec:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\Users\user\AppData\Local\Temp\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135ec:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\Users\user\AppData\Local\Temp\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135ec:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\Users\user\AppData\Local\Temp\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135ec:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\Users\user\AppData\Local\Temp\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135ec:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\Users\user\AppData\Local\Temp\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135ec:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\Users\user\AppData\Local\Temp\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135ec:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\Users\user\AppData\Local\Temp\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135ec:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x1547b:$: set cdaudio door closed 0x1543f:$: set cdaudio door open 0x15c9f:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x1547b:$: set cdaudio door closed 0x1543f:$: set cdaudio door open 0x15c9f:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x1547b:$: set cdaudio door closed 0x1543f:$: set cdaudio door open 0x15c9f:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x1547b:$: set cdaudio door closed 0x1543f:$: set cdaudio door open 0x15c9f:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x1547b:$: set cdaudio door closed 0x1543f:$: set cdaudio door open 0x15c9f:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
Click to see the 79 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115f2:$a1: get_Registry 0x15a57:$a2: SEE_MASK_NOZONECHECKS 0x156f9:$a3: Download ERROR 0x15ca9:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c36:$a5: netsh firewall delete allowedprogram "
00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a57:$reg: SEE_MASK_NOZONECHECKS 0x156dd:$msg: Execute ERROR 0x15731:$msg: Execute ERROR 0x15ca9:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x113d2:$a1: get_Registry 0x15837:$a2: SEE_MASK_NOZONECHECKS 0x154d9:$a3: Download ERROR 0x15a89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13a16:$a5: netsh firewall delete allowedprogram "
00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15837:$reg: SEE_MASK_NOZONECHECKS 0x154bd:$msg: Execute ERROR 0x15511:$msg: Execute ERROR 0x15a89:$ping: cmd.exe /c ping 0 -n 2 & del
00000002.00000002.4534386921.00000000026E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: a1K847qsM0.exe PID: 1276	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: server.exe PID: 384	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.a1K847qsM0.exe.d20000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.a1K847qsM0.exe.d20000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
0.0.a1K847qsM0.exe.d20000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
0.0.a1K847qsM0.exe.d20000.0.unpack	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x1547b:$: set cdaudio door closed 0x1543f:$: set cdaudio door open 0x15c9f:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
0.0.a1K847qsM0.exe.d20000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a37:$reg: SEE_MASK_NOZONECHECKS 0x156bd:$msg: Execute ERROR 0x15711:$msg: Execute ERROR 0x15c89:$ping: cmd.exe /c ping 0 -n 2 & del
0.0.a1K847qsM0.exe.d20000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\server.exe, ProcessId: 384, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Suricata Signatures

ET MALWARE Bladabindi/njRAT CnC Command (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T03:42:31.917473+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49704	167.71.56.116	22342	TCP
2024-12-24T03:42:34.840507+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49705	167.71.56.116	22342	TCP
2024-12-24T03:42:38.042047+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49707	167.71.56.116	22342	TCP
2024-12-24T03:42:41.244863+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49714	167.71.56.116	22342	TCP
2024-12-24T03:42:44.450837+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49722	167.71.56.116	22342	TCP
2024-12-24T03:42:47.651430+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49729	167.71.56.116	22342	TCP
2024-12-24T03:42:50.838855+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49739	167.71.56.116	22342	TCP
2024-12-24T03:42:54.026484+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49746	167.71.56.116	22342	TCP
2024-12-24T03:42:57.213455+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49752	167.71.56.116	22342	TCP
2024-12-24T03:43:00.404749+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49763	167.71.56.116	22342	TCP
2024-12-24T03:43:03.604465+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49769	167.71.56.116	22342	TCP
2024-12-24T03:43:06.791787+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49780	167.71.56.116	22342	TCP
2024-12-24T03:43:09.995359+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49786	167.71.56.116	22342	TCP
2024-12-24T03:43:13.182429+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49797	167.71.56.116	22342	TCP
2024-12-24T03:43:16.416324+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49803	167.71.56.116	22342	TCP
2024-12-24T03:43:19.765068+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49809	167.71.56.116	22342	TCP
2024-12-24T03:43:22.960273+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49821	167.71.56.116	22342	TCP
2024-12-24T03:43:26.026530+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49827	167.71.56.116	22342	TCP
2024-12-24T03:43:28.964168+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49838	167.71.56.116	22342	TCP
2024-12-24T03:43:31.792461+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49844	167.71.56.116	22342	TCP
2024-12-24T03:43:34.495186+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49850	167.71.56.116	22342	TCP
2024-12-24T03:43:37.140390+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49855	167.71.56.116	22342	TCP
2024-12-24T03:43:39.651284+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49864	167.71.56.116	22342	TCP
2024-12-24T03:43:42.091237+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49872	167.71.56.116	22342	TCP
2024-12-24T03:43:44.432817+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49878	167.71.56.116	22342	TCP
2024-12-24T03:43:46.714076+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49884	167.71.56.116	22342	TCP
2024-12-24T03:43:48.940559+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49890	167.71.56.116	22342	TCP
2024-12-24T03:43:51.028647+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49896	167.71.56.116	22342	TCP
2024-12-24T03:43:53.088885+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49902	167.71.56.116	22342	TCP
2024-12-24T03:43:55.091466+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49908	167.71.56.116	22342	TCP
2024-12-24T03:43:57.059790+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49911	167.71.56.116	22342	TCP
2024-12-24T03:43:58.997569+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49915	167.71.56.116	22342	TCP
2024-12-24T03:44:00.883734+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49921	167.71.56.116	22342	TCP
2024-12-24T03:44:02.699785+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49927	167.71.56.116	22342	TCP
2024-12-24T03:44:04.487222+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49932	167.71.56.116	22342	TCP
2024-12-24T03:44:06.250790+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49935	167.71.56.116	22342	TCP
2024-12-24T03:44:07.924340+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49940	167.71.56.116	22342	TCP
2024-12-24T03:44:09.619729+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49945	167.71.56.116	22342	TCP
2024-12-24T03:44:11.468913+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49948	167.71.56.116	22342	TCP
2024-12-24T03:44:13.088468+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49954	167.71.56.116	22342	TCP
2024-12-24T03:44:14.670029+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49959	167.71.56.116	22342	TCP
2024-12-24T03:44:16.458588+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49961	167.71.56.116	22342	TCP
2024-12-24T03:44:17.978837+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49967	167.71.56.116	22342	TCP
2024-12-24T03:44:19.527186+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49973	167.71.56.116	22342	TCP
2024-12-24T03:44:21.012032+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49974	167.71.56.116	22342	TCP
2024-12-24T03:44:22.479197+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49980	167.71.56.116	22342	TCP
2024-12-24T03:44:23.916274+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49986	167.71.56.116	22342	TCP
2024-12-24T03:44:25.354344+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49987	167.71.56.116	22342	TCP
2024-12-24T03:44:26.775852+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49993	167.71.56.116	22342	TCP
2024-12-24T03:44:28.169642+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49999	167.71.56.116	22342	TCP
2024-12-24T03:44:29.558902+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50000	167.71.56.116	22342	TCP
2024-12-24T03:44:30.947858+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50006	167.71.56.116	22342	TCP
2024-12-24T03:44:32.322518+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50008	167.71.56.116	22342	TCP
2024-12-24T03:44:33.666668+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50013	167.71.56.116	22342	TCP
2024-12-24T03:44:35.014287+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50018	167.71.56.116	22342	TCP
2024-12-24T03:44:36.339745+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50020	167.71.56.116	22342	TCP
2024-12-24T03:44:37.666445+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50025	167.71.56.116	22342	TCP
2024-12-24T03:44:38.989552+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50029	167.71.56.116	22342	TCP
2024-12-24T03:44:40.293839+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50033	167.71.56.116	22342	TCP
2024-12-24T03:44:41.588169+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50035	167.71.56.116	22342	TCP
2024-12-24T03:44:42.869517+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50036	167.71.56.116	22342	TCP
2024-12-24T03:44:44.228764+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50037	167.71.56.116	22342	TCP
2024-12-24T03:44:45.519523+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50038	167.71.56.116	22342	TCP
2024-12-24T03:44:46.791499+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50039	167.71.56.116	22342	TCP
2024-12-24T03:44:48.060465+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50040	167.71.56.116	22342	TCP
2024-12-24T03:44:49.344442+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50041	167.71.56.116	22342	TCP
2024-12-24T03:44:50.604430+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50042	167.71.56.116	22342	TCP
2024-12-24T03:44:51.853881+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50043	167.71.56.116	22342	TCP
2024-12-24T03:44:53.104831+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50044	167.71.56.116	22342	TCP
2024-12-24T03:44:54.353767+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50045	167.71.56.116	22342	TCP
2024-12-24T03:44:55.605732+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50046	167.71.56.116	22342	TCP
2024-12-24T03:44:56.875912+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50047	167.71.56.116	22342	TCP
2024-12-24T03:44:58.104743+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50048	167.71.56.116	22342	TCP
2024-12-24T03:44:59.338648+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50049	167.71.56.116	22342	TCP
2024-12-24T03:45:00.577961+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50050	167.71.56.116	22342	TCP
2024-12-24T03:45:01.811232+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50051	167.71.56.116	22342	TCP
2024-12-24T03:45:03.041537+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50052	167.71.56.116	22342	TCP
2024-12-24T03:45:04.278874+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50053	167.71.56.116	22342	TCP
2024-12-24T03:45:05.512107+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50054	167.71.56.116	22342	TCP
2024-12-24T03:45:06.733096+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50055	167.71.56.116	22342	TCP
2024-12-24T03:45:07.963717+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50056	167.71.56.116	22342	TCP
2024-12-24T03:45:09.262684+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50057	167.71.56.116	22342	TCP
2024-12-24T03:45:10.482980+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50058	167.71.56.116	22342	TCP
2024-12-24T03:45:11.706340+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50059	167.71.56.116	22342	TCP
2024-12-24T03:45:12.916823+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50060	167.71.56.116	22342	TCP
2024-12-24T03:45:14.160163+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50061	167.71.56.116	22342	TCP
2024-12-24T03:45:15.498213+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50062	167.71.56.116	22342	TCP
2024-12-24T03:45:16.715585+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50063	167.71.56.116	22342	TCP
2024-12-24T03:45:17.916878+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50064	167.71.56.116	22342	TCP
2024-12-24T03:45:19.124611+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50065	167.71.56.116	22342	TCP
2024-12-24T03:45:20.327950+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50066	167.71.56.116	22342	TCP
2024-12-24T03:45:21.525678+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50067	167.71.56.116	22342	TCP
2024-12-24T03:45:22.769407+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50068	167.71.56.116	22342	TCP
2024-12-24T03:45:23.979395+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50069	167.71.56.116	22342	TCP
2024-12-24T03:45:25.260034+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50070	167.71.56.116	22342	TCP
2024-12-24T03:45:26.467431+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50071	167.71.56.116	22342	TCP
2024-12-24T03:45:27.666433+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50072	167.71.56.116	22342	TCP
2024-12-24T03:45:28.870498+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50073	167.71.56.116	22342	TCP
2024-12-24T03:45:30.073173+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50074	167.71.56.116	22342	TCP
2024-12-24T03:45:31.275705+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50075	167.71.56.116	22342	TCP
2024-12-24T03:45:32.479054+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50076	167.71.56.116	22342	TCP
2024-12-24T03:45:33.681805+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50077	167.71.56.116	22342	TCP
2024-12-24T03:45:34.885340+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50078	167.71.56.116	22342	TCP
2024-12-24T03:45:36.088415+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50079	167.71.56.116	22342	TCP
2024-12-24T03:45:37.314723+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50080	167.71.56.116	22342	TCP
2024-12-24T03:45:38.559296+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50081	167.71.56.116	22342	TCP
2024-12-24T03:45:39.762035+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50082	167.71.56.116	22342	TCP
2024-12-24T03:45:40.965123+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50083	167.71.56.116	22342	TCP
2024-12-24T03:45:42.167155+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50084	167.71.56.116	22342	TCP
2024-12-24T03:45:43.369376+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50085	167.71.56.116	22342	TCP
2024-12-24T03:45:44.556778+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50086	167.71.56.116	22342	TCP
2024-12-24T03:45:45.775907+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50087	167.71.56.116	22342	TCP
2024-12-24T03:45:46.978825+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50088	167.71.56.116	22342	TCP
2024-12-24T03:45:48.183546+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50089	167.71.56.116	22342	TCP
2024-12-24T03:45:49.462884+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50090	167.71.56.116	22342	TCP
2024-12-24T03:45:50.670000+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50091	167.71.56.116	22342	TCP
2024-12-24T03:45:51.878338+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50092	167.71.56.116	22342	TCP
2024-12-24T03:45:53.072427+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50093	167.71.56.116	22342	TCP
2024-12-24T03:45:54.285286+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50094	167.71.56.116	22342	TCP
2024-12-24T03:45:55.478700+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50095	167.71.56.116	22342	TCP
2024-12-24T03:45:56.666629+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50096	167.71.56.116	22342	TCP
2024-12-24T03:45:57.853580+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50097	167.71.56.116	22342	TCP
2024-12-24T03:45:59.041215+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50098	167.71.56.116	22342	TCP
2024-12-24T03:46:00.251802+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50099	167.71.56.116	22342	TCP
2024-12-24T03:46:01.433418+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50100	167.71.56.116	22342	TCP
2024-12-24T03:46:02.638499+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50101	167.71.56.116	22342	TCP
2024-12-24T03:46:03.838310+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50102	167.71.56.116	22342	TCP
2024-12-24T03:46:05.041530+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50103	167.71.56.116	22342	TCP
2024-12-24T03:46:06.244540+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50104	167.71.56.116	22342	TCP
2024-12-24T03:46:07.447305+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50105	167.71.56.116	22342	TCP
2024-12-24T03:46:08.650805+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50106	167.71.56.116	22342	TCP
2024-12-24T03:46:09.886639+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50107	167.71.56.116	22342	TCP
2024-12-24T03:46:11.088603+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50108	167.71.56.116	22342	TCP
2024-12-24T03:46:12.291593+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50109	167.71.56.116	22342	TCP
2024-12-24T03:46:13.513078+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50110	167.71.56.116	22342	TCP
2024-12-24T03:46:14.691428+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50111	167.71.56.116	22342	TCP
2024-12-24T03:46:15.879354+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50112	167.71.56.116	22342	TCP
2024-12-24T03:46:17.070069+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50113	167.71.56.116	22342	TCP
2024-12-24T03:46:18.266432+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50114	167.71.56.116	22342	TCP
2024-12-24T03:46:19.447944+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50115	167.71.56.116	22342	TCP
2024-12-24T03:46:20.637359+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50116	167.71.56.116	22342	TCP
2024-12-24T03:46:21.827327+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50117	167.71.56.116	22342	TCP
2024-12-24T03:46:23.012600+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50118	167.71.56.116	22342	TCP
2024-12-24T03:46:24.207497+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50119	167.71.56.116	22342	TCP
2024-12-24T03:46:25.402623+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50120	167.71.56.116	22342	TCP
2024-12-24T03:46:26.619599+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50121	167.71.56.116	22342	TCP
2024-12-24T03:46:27.807153+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50122	167.71.56.116	22342	TCP
2024-12-24T03:46:28.994042+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	50123	167.71.56.116	22342	TCP

ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T03:42:31.917473+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49704	167.71.56.116	22342	TCP
2024-12-24T03:42:34.840507+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49705	167.71.56.116	22342	TCP
2024-12-24T03:42:38.042047+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49707	167.71.56.116	22342	TCP
2024-12-24T03:42:41.244863+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49714	167.71.56.116	22342	TCP
2024-12-24T03:42:44.450837+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49722	167.71.56.116	22342	TCP
2024-12-24T03:42:47.651430+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49729	167.71.56.116	22342	TCP
2024-12-24T03:42:50.838855+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49739	167.71.56.116	22342	TCP
2024-12-24T03:42:54.026484+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49746	167.71.56.116	22342	TCP
2024-12-24T03:42:57.213455+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49752	167.71.56.116	22342	TCP
2024-12-24T03:43:00.404749+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49763	167.71.56.116	22342	TCP
2024-12-24T03:43:03.604465+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49769	167.71.56.116	22342	TCP
2024-12-24T03:43:06.791787+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49780	167.71.56.116	22342	TCP
2024-12-24T03:43:09.995359+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49786	167.71.56.116	22342	TCP
2024-12-24T03:43:13.182429+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49797	167.71.56.116	22342	TCP
2024-12-24T03:43:16.416324+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49803	167.71.56.116	22342	TCP
2024-12-24T03:43:19.765068+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49809	167.71.56.116	22342	TCP
2024-12-24T03:43:22.960273+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49821	167.71.56.116	22342	TCP
2024-12-24T03:43:26.026530+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49827	167.71.56.116	22342	TCP
2024-12-24T03:43:28.964168+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49838	167.71.56.116	22342	TCP
2024-12-24T03:43:31.792461+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49844	167.71.56.116	22342	TCP
2024-12-24T03:43:34.495186+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49850	167.71.56.116	22342	TCP
2024-12-24T03:43:37.140390+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49855	167.71.56.116	22342	TCP
2024-12-24T03:43:39.651284+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49864	167.71.56.116	22342	TCP
2024-12-24T03:43:42.091237+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49872	167.71.56.116	22342	TCP
2024-12-24T03:43:44.432817+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49878	167.71.56.116	22342	TCP
2024-12-24T03:43:46.714076+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49884	167.71.56.116	22342	TCP
2024-12-24T03:43:48.940559+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49890	167.71.56.116	22342	TCP
2024-12-24T03:43:51.028647+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49896	167.71.56.116	22342	TCP
2024-12-24T03:43:53.088885+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49902	167.71.56.116	22342	TCP
2024-12-24T03:43:55.091466+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49908	167.71.56.116	22342	TCP
2024-12-24T03:43:57.059790+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49911	167.71.56.116	22342	TCP
2024-12-24T03:43:58.997569+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49915	167.71.56.116	22342	TCP
2024-12-24T03:44:00.883734+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49921	167.71.56.116	22342	TCP
2024-12-24T03:44:02.699785+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49927	167.71.56.116	22342	TCP
2024-12-24T03:44:04.487222+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49932	167.71.56.116	22342	TCP
2024-12-24T03:44:06.250790+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49935	167.71.56.116	22342	TCP
2024-12-24T03:44:07.924340+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49940	167.71.56.116	22342	TCP
2024-12-24T03:44:09.619729+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49945	167.71.56.116	22342	TCP
2024-12-24T03:44:11.468913+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49948	167.71.56.116	22342	TCP
2024-12-24T03:44:13.088468+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49954	167.71.56.116	22342	TCP
2024-12-24T03:44:14.670029+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49959	167.71.56.116	22342	TCP
2024-12-24T03:44:16.458588+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49961	167.71.56.116	22342	TCP
2024-12-24T03:44:17.978837+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49967	167.71.56.116	22342	TCP
2024-12-24T03:44:19.527186+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49973	167.71.56.116	22342	TCP
2024-12-24T03:44:21.012032+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49974	167.71.56.116	22342	TCP
2024-12-24T03:44:22.479197+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49980	167.71.56.116	22342	TCP
2024-12-24T03:44:23.916274+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49986	167.71.56.116	22342	TCP
2024-12-24T03:44:25.354344+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49987	167.71.56.116	22342	TCP
2024-12-24T03:44:26.775852+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49993	167.71.56.116	22342	TCP
2024-12-24T03:44:28.169642+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49999	167.71.56.116	22342	TCP
2024-12-24T03:44:29.558902+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50000	167.71.56.116	22342	TCP
2024-12-24T03:44:30.947858+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50006	167.71.56.116	22342	TCP
2024-12-24T03:44:32.322518+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50008	167.71.56.116	22342	TCP
2024-12-24T03:44:33.666668+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50013	167.71.56.116	22342	TCP
2024-12-24T03:44:35.014287+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50018	167.71.56.116	22342	TCP
2024-12-24T03:44:36.339745+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50020	167.71.56.116	22342	TCP
2024-12-24T03:44:37.666445+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50025	167.71.56.116	22342	TCP
2024-12-24T03:44:38.989552+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50029	167.71.56.116	22342	TCP
2024-12-24T03:44:40.293839+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50033	167.71.56.116	22342	TCP
2024-12-24T03:44:41.588169+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50035	167.71.56.116	22342	TCP
2024-12-24T03:44:42.869517+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50036	167.71.56.116	22342	TCP
2024-12-24T03:44:44.228764+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50037	167.71.56.116	22342	TCP
2024-12-24T03:44:45.519523+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50038	167.71.56.116	22342	TCP
2024-12-24T03:44:46.791499+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50039	167.71.56.116	22342	TCP
2024-12-24T03:44:48.060465+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50040	167.71.56.116	22342	TCP
2024-12-24T03:44:49.344442+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50041	167.71.56.116	22342	TCP
2024-12-24T03:44:50.604430+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50042	167.71.56.116	22342	TCP
2024-12-24T03:44:51.853881+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50043	167.71.56.116	22342	TCP
2024-12-24T03:44:53.104831+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50044	167.71.56.116	22342	TCP
2024-12-24T03:44:54.353767+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50045	167.71.56.116	22342	TCP
2024-12-24T03:44:55.605732+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50046	167.71.56.116	22342	TCP
2024-12-24T03:44:56.875912+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50047	167.71.56.116	22342	TCP
2024-12-24T03:44:58.104743+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50048	167.71.56.116	22342	TCP
2024-12-24T03:44:59.338648+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50049	167.71.56.116	22342	TCP
2024-12-24T03:45:00.577961+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50050	167.71.56.116	22342	TCP
2024-12-24T03:45:01.811232+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50051	167.71.56.116	22342	TCP
2024-12-24T03:45:03.041537+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50052	167.71.56.116	22342	TCP
2024-12-24T03:45:04.278874+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50053	167.71.56.116	22342	TCP
2024-12-24T03:45:05.512107+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50054	167.71.56.116	22342	TCP
2024-12-24T03:45:06.733096+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50055	167.71.56.116	22342	TCP
2024-12-24T03:45:07.963717+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50056	167.71.56.116	22342	TCP
2024-12-24T03:45:09.262684+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50057	167.71.56.116	22342	TCP
2024-12-24T03:45:10.482980+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50058	167.71.56.116	22342	TCP
2024-12-24T03:45:11.706340+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50059	167.71.56.116	22342	TCP
2024-12-24T03:45:12.916823+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50060	167.71.56.116	22342	TCP
2024-12-24T03:45:14.160163+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50061	167.71.56.116	22342	TCP
2024-12-24T03:45:15.498213+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50062	167.71.56.116	22342	TCP
2024-12-24T03:45:16.715585+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50063	167.71.56.116	22342	TCP
2024-12-24T03:45:17.916878+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50064	167.71.56.116	22342	TCP
2024-12-24T03:45:19.124611+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50065	167.71.56.116	22342	TCP
2024-12-24T03:45:20.327950+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50066	167.71.56.116	22342	TCP
2024-12-24T03:45:21.525678+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50067	167.71.56.116	22342	TCP
2024-12-24T03:45:22.769407+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50068	167.71.56.116	22342	TCP
2024-12-24T03:45:23.979395+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50069	167.71.56.116	22342	TCP
2024-12-24T03:45:25.260034+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50070	167.71.56.116	22342	TCP
2024-12-24T03:45:26.467431+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50071	167.71.56.116	22342	TCP
2024-12-24T03:45:27.666433+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50072	167.71.56.116	22342	TCP
2024-12-24T03:45:28.870498+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50073	167.71.56.116	22342	TCP
2024-12-24T03:45:30.073173+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50074	167.71.56.116	22342	TCP
2024-12-24T03:45:31.275705+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50075	167.71.56.116	22342	TCP
2024-12-24T03:45:32.479054+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50076	167.71.56.116	22342	TCP
2024-12-24T03:45:33.681805+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50077	167.71.56.116	22342	TCP
2024-12-24T03:45:34.885340+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50078	167.71.56.116	22342	TCP
2024-12-24T03:45:36.088415+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50079	167.71.56.116	22342	TCP
2024-12-24T03:45:37.314723+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50080	167.71.56.116	22342	TCP
2024-12-24T03:45:38.559296+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50081	167.71.56.116	22342	TCP
2024-12-24T03:45:39.762035+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50082	167.71.56.116	22342	TCP
2024-12-24T03:45:40.965123+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50083	167.71.56.116	22342	TCP
2024-12-24T03:45:42.167155+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50084	167.71.56.116	22342	TCP
2024-12-24T03:45:43.369376+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50085	167.71.56.116	22342	TCP
2024-12-24T03:45:44.556778+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50086	167.71.56.116	22342	TCP
2024-12-24T03:45:45.775907+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50087	167.71.56.116	22342	TCP
2024-12-24T03:45:46.978825+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50088	167.71.56.116	22342	TCP
2024-12-24T03:45:48.183546+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50089	167.71.56.116	22342	TCP
2024-12-24T03:45:49.462884+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50090	167.71.56.116	22342	TCP
2024-12-24T03:45:50.670000+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50091	167.71.56.116	22342	TCP
2024-12-24T03:45:51.878338+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50092	167.71.56.116	22342	TCP
2024-12-24T03:45:53.072427+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50093	167.71.56.116	22342	TCP
2024-12-24T03:45:54.285286+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50094	167.71.56.116	22342	TCP
2024-12-24T03:45:55.478700+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50095	167.71.56.116	22342	TCP
2024-12-24T03:45:56.666629+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50096	167.71.56.116	22342	TCP
2024-12-24T03:45:57.853580+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50097	167.71.56.116	22342	TCP
2024-12-24T03:45:59.041215+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50098	167.71.56.116	22342	TCP
2024-12-24T03:46:00.251802+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50099	167.71.56.116	22342	TCP
2024-12-24T03:46:01.433418+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50100	167.71.56.116	22342	TCP
2024-12-24T03:46:02.638499+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50101	167.71.56.116	22342	TCP
2024-12-24T03:46:03.838310+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50102	167.71.56.116	22342	TCP
2024-12-24T03:46:05.041530+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50103	167.71.56.116	22342	TCP
2024-12-24T03:46:06.244540+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50104	167.71.56.116	22342	TCP
2024-12-24T03:46:07.447305+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50105	167.71.56.116	22342	TCP
2024-12-24T03:46:08.650805+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50106	167.71.56.116	22342	TCP
2024-12-24T03:46:09.886639+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50107	167.71.56.116	22342	TCP
2024-12-24T03:46:11.088603+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50108	167.71.56.116	22342	TCP
2024-12-24T03:46:12.291593+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50109	167.71.56.116	22342	TCP
2024-12-24T03:46:13.513078+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50110	167.71.56.116	22342	TCP
2024-12-24T03:46:14.691428+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50111	167.71.56.116	22342	TCP
2024-12-24T03:46:15.879354+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50112	167.71.56.116	22342	TCP
2024-12-24T03:46:17.070069+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50113	167.71.56.116	22342	TCP
2024-12-24T03:46:18.266432+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50114	167.71.56.116	22342	TCP
2024-12-24T03:46:19.447944+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50115	167.71.56.116	22342	TCP
2024-12-24T03:46:20.637359+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50116	167.71.56.116	22342	TCP
2024-12-24T03:46:21.827327+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50117	167.71.56.116	22342	TCP
2024-12-24T03:46:23.012600+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50118	167.71.56.116	22342	TCP
2024-12-24T03:46:24.207497+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50119	167.71.56.116	22342	TCP
2024-12-24T03:46:25.402623+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50120	167.71.56.116	22342	TCP
2024-12-24T03:46:26.619599+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50121	167.71.56.116	22342	TCP
2024-12-24T03:46:27.807153+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50122	167.71.56.116	22342	TCP
2024-12-24T03:46:28.994042+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	50123	167.71.56.116	22342	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T03:42:54.315776+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49746	167.71.56.116	22342	TCP
2024-12-24T03:43:20.004427+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49809	167.71.56.116	22342	TCP
2024-12-24T03:44:27.437639+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49993	167.71.56.116	22342	TCP
2024-12-24T03:44:35.345084+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50018	167.71.56.116	22342	TCP
2024-12-24T03:44:41.827411+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50035	167.71.56.116	22342	TCP
2024-12-24T03:44:46.548271+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50038	167.71.56.116	22342	TCP
2024-12-24T03:44:53.468710+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50044	167.71.56.116	22342	TCP
2024-12-24T03:44:57.342983+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50047	167.71.56.116	22342	TCP
2024-12-24T03:44:58.673978+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50048	167.71.56.116	22342	TCP
2024-12-24T03:44:59.718681+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50049	167.71.56.116	22342	TCP
2024-12-24T03:45:02.573559+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50051	167.71.56.116	22342	TCP
2024-12-24T03:45:03.282063+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50052	167.71.56.116	22342	TCP
2024-12-24T03:45:20.567494+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50066	167.71.56.116	22342	TCP
2024-12-24T03:45:45.125637+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50086	167.71.56.116	22342	TCP
2024-12-24T03:45:52.359880+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50092	167.71.56.116	22342	TCP
2024-12-24T03:46:02.176704+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50100	167.71.56.116	22342	TCP
2024-12-24T03:46:10.523203+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50107	167.71.56.116	22342	TCP
2024-12-24T03:46:18.506143+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50114	167.71.56.116	22342	TCP
2024-12-24T03:46:21.163215+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50116	167.71.56.116	22342	TCP
2024-12-24T03:46:27.442555+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	50121	167.71.56.116	22342	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: a1K847qsM0.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Notepad.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Temp\server.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 0.0.a1K847qsM0.exe.d20000.0.unpack

Malware Configuration Extractor: Njrat {"Campaign ID": "Owned", "Version": "0.7d", "Install Name": "24983f03fb74576bbc5af6aa1085b23d", "Install Dir": "system", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for dropped file

Source: C:\Notepad.exe	ReversingLabs: Detection: 86%
Source: C:\Notepad.exe	Virustotal: Detection: 78%	Perma Link
Source: C:\Program Files (x86)\Explower.exe	ReversingLabs: Detection: 86%
Source: C:\Program Files (x86)\Explower.exe	Virustotal: Detection: 78%	Perma Link
Source: C:\Users\user\AppData\Local\Explower.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Explower.exe	Virustotal: Detection: 78%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	Virustotal: Detection: 78%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\server.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\Desktop\Explower.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\Documents\Explower.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\Favorites\Explower.exe	ReversingLabs: Detection: 86%
Source: C:\Windows\SysWOW64\Explower.exe	ReversingLabs: Detection: 86%

Multi AV Scanner detection for submitted file

Source: a1K847qsM0.exe	ReversingLabs: Detection: 86%
Source: a1K847qsM0.exe	Virustotal: Detection: 78%			Perma Link

Yara detected Njrat

Source: Yara match	File source: a1K847qsM0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4534386921.00000000026E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a1K847qsM0.exe PID: 1276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 384, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Joe Sandbox ML: detected
Source: C:\Notepad.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\server.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: a1K847qsM0.exe

Joe Sandbox ML: detected

Source: a1K847qsM0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\a1K847qsM0.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: a1K847qsM0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Contains functionality to spread to USB devices (.Net source)

Source: a1K847qsM0.exe, Usb1.cs	.Net Code: infect
Source: server.exe.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe0.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe1.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe2.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe3.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe4.2.dr, Usb1.cs	.Net Code: infect
Source: Notepad.exe.2.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe5.2.dr, Usb1.cs	.Net Code: infect
Source: Microsoft Corporation.exe.2.dr, Usb1.cs	.Net Code: infect

Source: a1K847qsM0.exe, 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: a1K847qsM0.exe, 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: a1K847qsM0.exe, 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: a1K847qsM0.exe, 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: a1K847qsM0.exe, 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: a1K847qsM0.exe, 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: a1K847qsM0.exe	Binary or memory string: \autorun.inf
Source: a1K847qsM0.exe	Binary or memory string: [autorun]
Source: a1K847qsM0.exe	Binary or memory string: autorun.inf
Source: 24983f03fb74576bbc5af6aa1085b23dWindows Update.exe.2.dr	Binary or memory string: \autorun.inf
Source: 24983f03fb74576bbc5af6aa1085b23dWindows Update.exe.2.dr	Binary or memory string: [autorun]
Source: 24983f03fb74576bbc5af6aa1085b23dWindows Update.exe.2.dr	Binary or memory string: autorun.inf
Source: Notepad.exe.2.dr	Binary or memory string: \autorun.inf
Source: Notepad.exe.2.dr	Binary or memory string: [autorun]
Source: Notepad.exe.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe7.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe7.2.dr	Binary or memory string: [autorun]
Source: Explower.exe7.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe2.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe2.2.dr	Binary or memory string: [autorun]
Source: Explower.exe2.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe5.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe5.2.dr	Binary or memory string: [autorun]
Source: Explower.exe5.2.dr	Binary or memory string: autorun.inf
Source: Microsoft Corporation.exe.2.dr	Binary or memory string: \autorun.inf
Source: Microsoft Corporation.exe.2.dr	Binary or memory string: [autorun]
Source: Microsoft Corporation.exe.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe4.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe4.2.dr	Binary or memory string: [autorun]
Source: Explower.exe4.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe0.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe0.2.dr	Binary or memory string: [autorun]
Source: Explower.exe0.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe8.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe8.2.dr	Binary or memory string: [autorun]
Source: Explower.exe8.2.dr	Binary or memory string: autorun.inf
Source: server.exe.0.dr	Binary or memory string: \autorun.inf
Source: server.exe.0.dr	Binary or memory string: [autorun]
Source: server.exe.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe1.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe1.2.dr	Binary or memory string: [autorun]
Source: Explower.exe1.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe.2.dr	Binary or memory string: [autorun]
Source: Explower.exe.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe3.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe3.2.dr	Binary or memory string: [autorun]
Source: Explower.exe3.2.dr	Binary or memory string: autorun.inf
Source: Explower.exe6.2.dr	Binary or memory string: \autorun.inf
Source: Explower.exe6.2.dr	Binary or memory string: [autorun]
Source: Explower.exe6.2.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49705 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49705 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49707 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49714 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49714 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49704 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49704 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49707 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49722 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49722 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49729 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49729 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49739 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49739 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49746 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49746 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49746 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49752 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49752 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49763 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49763 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49769 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49769 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49780 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49780 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49786 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49786 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49797 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49797 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49809 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49809 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49803 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49803 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49821 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49821 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49838 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49838 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49809 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49827 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49827 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49844 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49844 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49850 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49850 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49855 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49855 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49864 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49864 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49872 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49872 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49884 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49884 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49890 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49890 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49896 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49896 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49902 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49902 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49878 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49878 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49908 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49908 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49911 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49911 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49915 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49915 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49921 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49921 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49927 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49927 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49932 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49932 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49935 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49935 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49940 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49940 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49945 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49945 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49948 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49948 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49959 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49959 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49967 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49967 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49961 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49973 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49961 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49973 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49954 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49954 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49974 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49974 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49980 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49980 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49993 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49987 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49993 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49987 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49986 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49993 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49986 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50000 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50000 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49999 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49999 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50008 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50008 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50018 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50020 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50020 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50018 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50025 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50025 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50018 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50013 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50013 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50033 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50029 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50033 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50029 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50043 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50043 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50045 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50045 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50035 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50035 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50051 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50038 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50051 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50041 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50057 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50038 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50046 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50050 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50046 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50050 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50039 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50039 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50006 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50058 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50052 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50057 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50041 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50058 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50035 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50052 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50067 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50042 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50067 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50042 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50055 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50048 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50038 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50055 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50061 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50048 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50061 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50056 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50060 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50051 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50060 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50052 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50056 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50068 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50068 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50006 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50036 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50054 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50065 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50048 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50065 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50064 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50036 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50054 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50062 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50062 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50049 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50049 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50053 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50063 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50053 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50063 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50049 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50069 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50069 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50064 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50037 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50037 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50040 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50040 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50047 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50047 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50047 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50059 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50059 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50044 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50044 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50044 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50066 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50066 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50066 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50070 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50070 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50073 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50078 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50078 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50077 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50077 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50073 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50075 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50075 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50072 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50080 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50072 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50085 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50080 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50074 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50074 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50091 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50091 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50083 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50083 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50086 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50071 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50086 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50071 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50088 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50088 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50076 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50093 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50093 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50084 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50085 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50082 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50081 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50082 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50081 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50099 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50099 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50096 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50096 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50102 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50105 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50105 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50102 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50086 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50095 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50084 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50095 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50109 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50115 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50097 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50115 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50104 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50097 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50076 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50090 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50119 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50092 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50119 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50108 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50092 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50117 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50112 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50098 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50112 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50104 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50092 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50109 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50100 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50089 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50120 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50089 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50079 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50108 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50103 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50117 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50090 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50101 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50101 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50122 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50100 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50110 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50120 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50116 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50122 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50116 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50100 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50118 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50094 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50079 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50121 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50098 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50087 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50110 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50087 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50118 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50094 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50113 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50123 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50113 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50123 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50107 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50107 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50114 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50116 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50114 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50106 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50106 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50107 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50114 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50103 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50121 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:50121 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:50111 -> 167.71.56.116:22342
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:50111 -> 167.71.56.116:22342

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 167.71.56.116:22342

Source: Joe Sandbox View

IP Address: 167.71.56.116 167.71.56.116

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116

Source: C:\Users\user\Desktop\a1K847qsM0.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: a1K847qsM0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4534386921.00000000026E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a1K847qsM0.exe PID: 1276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 384, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: a1K847qsM0.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: a1K847qsM0.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: a1K847qsM0.exe, type: SAMPLE	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: a1K847qsM0.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: a1K847qsM0.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Notepad.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_008FBDCA NtQuerySystemInformation,		2_2_008FBDCA
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_008FBD99 NtQuerySystemInformation,		2_2_008FBD99

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Windows\SysWOW64\Explower.exe

Jump to behavior

Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_013F26E7	0_2_013F26E7
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E4298	0_2_018E4298
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E470F	0_2_018E470F
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E499D	0_2_018E499D
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E4936	0_2_018E4936
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E4630	0_2_018E4630
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E4544	0_2_018E4544
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E4B5B	0_2_018E4B5B
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E47D4	0_2_018E47D4
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E4269	0_2_018E4269
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E49F9	0_2_018E49F9
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E44F1	0_2_018E44F1
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E4C8F	0_2_018E4C8F
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E5000	0_2_018E5000
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E4F9D	0_2_018E4F9D
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E4F2F	0_2_018E4F2F
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E505D	0_2_018E505D
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E5459	0_2_018E5459
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E536F	0_2_018E536F
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_018E50E3	0_2_018E50E3
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_008F26E7	2_2_008F26E7
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C4298	2_2_048C4298
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C7418	2_2_048C7418
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C499D	2_2_048C499D
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C47D4	2_2_048C47D4
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C73FE	2_2_048C73FE
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C49F9	2_2_048C49F9
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C44F1	2_2_048C44F1
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C470F	2_2_048C470F
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C4936	2_2_048C4936
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C4630	2_2_048C4630
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C4544	2_2_048C4544
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C4B5B	2_2_048C4B5B
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C4269	2_2_048C4269
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C4C8F	2_2_048C4C8F
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C4F9D	2_2_048C4F9D
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C50E3	2_2_048C50E3
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C5000	2_2_048C5000
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C4F2F	2_2_048C4F2F
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C505D	2_2_048C505D
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C5459	2_2_048C5459
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_048C536F	2_2_048C536F
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Code function: 13_2_012226E7	13_2_012226E7
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Code function: 14_2_013126E7	14_2_013126E7
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Code function: 15_2_015A26E7	15_2_015A26E7

Source: a1K847qsM0.exe, 00000000.00000002.2089394653.000000000145E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs a1K847qsM0.exe

Source: a1K847qsM0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: a1K847qsM0.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: a1K847qsM0.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: a1K847qsM0.exe, type: SAMPLE	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: a1K847qsM0.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: a1K847qsM0.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Notepad.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Notepad.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Notepad.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Notepad.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Notepad.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.spre.phis.troj.adwa.evad.winEXE@16/22@0/1

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_008FBC4E AdjustTokenPrivileges,		2_2_008FBC4E
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_008FBC17 AdjustTokenPrivileges,		2_2_008FBC17

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Program Files (x86)\Explower.exe

Jump to behavior

Source: C:\Users\user\Desktop\a1K847qsM0.exe

File created: C:\Users\user\AppData\Roaming\app

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\24983f03fb74576bbc5af6aa1085b23d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6396:120:WilError_03

Source: C:\Users\user\Desktop\a1K847qsM0.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Jump to behavior

Source: a1K847qsM0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: a1K847qsM0.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\a1K847qsM0.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\a1K847qsM0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: a1K847qsM0.exe	ReversingLabs: Detection: 86%
Source: a1K847qsM0.exe	Virustotal: Detection: 78%

Source: C:\Users\user\Desktop\a1K847qsM0.exe

File read: C:\Users\user\Desktop\a1K847qsM0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\a1K847qsM0.exe "C:\Users\user\Desktop\a1K847qsM0.exe"
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process created: C:\Users\user\AppData\Local\Temp\server.exe "C:\Users\user\AppData\Local\Temp\server.exe"
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe"
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe"
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process created: C:\Users\user\AppData\Local\Temp\server.exe "C:\Users\user\AppData\Local\Temp\server.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: shfolder.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\a1K847qsM0.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: a1K847qsM0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\a1K847qsM0.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: a1K847qsM0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: a1K847qsM0.exe, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: server.exe.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe0.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe1.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe2.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe3.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe4.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Notepad.exe.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe5.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Microsoft Corporation.exe.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_013F28F7 push eax; iretd	0_2_013F290E
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_013F26E7 push edi; iretd	0_2_013F2866
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Code function: 0_2_013F27CB push edi; iretd	0_2_013F2866
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_008F27CB push edi; iretd	2_2_008F2866
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_008F2F5C push eax; iretd	2_2_008F2F5E
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_008F30AD push edi; iretd	2_2_008F30AE
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_008F2EAB push edi; iretd	2_2_008F2ECE
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_008F26E7 push edi; iretd	2_2_008F2866
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_008F2F23 push eax; iretd	2_2_008F2F2E
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Code function: 13_2_012226E7 push edi; iretd	13_2_01222866
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Code function: 13_2_012228F7 push eax; iretd	13_2_0122290E
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Code function: 13_2_012227CB push edi; iretd	13_2_01222866
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Code function: 14_2_013128F7 push eax; iretd	14_2_0131290E
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Code function: 14_2_013126E7 push edi; iretd	14_2_01312866
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Code function: 14_2_013127CB push edi; iretd	14_2_01312866
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Code function: 15_2_015A27CB push edi; iretd	15_2_015A2866
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Code function: 15_2_015A28F7 push eax; iretd	15_2_015A290E
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Code function: 15_2_015A26E7 push edi; iretd	15_2_015A2866

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Users\user\Documents\Explower.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\Desktop\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Notepad.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Windows\SysWOW64\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Program Files (x86)\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Local\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a1K847qsM0.exe	File created: C:\Users\user\AppData\Local\Temp\server.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\Favorites\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\Documents\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Program Files (x86)\Explower.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Windows\SysWOW64\Explower.exe

Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Jump to behavior

Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\a1K847qsM0.exe	Memory allocated: 16B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Memory allocated: 3450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\a1K847qsM0.exe	Memory allocated: 1A10000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 26E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 46E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 56A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 66A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 6910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 4D20000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 7910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 7910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 6910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Memory allocated: 2C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Memory allocated: 3280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Memory allocated: 5280000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: 16E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: 32F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: 52F0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Memory allocated: 1860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Memory allocated: 34D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Memory allocated: 54D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Code function: 15_2_05680006 sldt word ptr [eax]

15_2_05680006

Source: C:\Users\user\Desktop\a1K847qsM0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: threadDelayed 898	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: threadDelayed 1140	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: threadDelayed 3632	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: foregroundWindowGot 672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: foregroundWindowGot 687	Jump to behavior

Source: C:\Users\user\Desktop\a1K847qsM0.exe TID: 6128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe TID: 2316	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe TID: 4980	Thread sleep time: -1140000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe TID: 4980	Thread sleep time: -3632000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe TID: 6204	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe TID: 5568	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe TID: 5364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe TID: 4072	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\a1K847qsM0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior

Source: server.exe, 00000002.00000002.4533296745.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW <add nam
Source: server.exe, 00000002.00000002.4533296745.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000003.00000003.2124388933.0000000003211000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000006.00000003.2153394359.00000000031F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: netsh.exe, 00000005.00000003.2134957244.0000000003131000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\a1K847qsM0.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\a1K847qsM0.exe

Process created: C:\Users\user\AppData\Local\Temp\server.exe "C:\Users\user\AppData\Local\Temp\server.exe"

Jump to behavior

Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:06:58 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:17:30 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:16:17 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 16:52:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:20:23 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 10:34:33 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 10:09:37 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 01:47:42 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 10:03:50 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 20:09:33 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:49:07 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:57:34 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:05:13 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:58:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:07:01 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 15:55:46 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:27:52 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 03:27:49 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 06:34:55 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 14:35:23 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 18:33:59 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 00:41:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:55:55 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:57:43 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/11 \| 14:07:25 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 04:44:16 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 15:25:48 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:49:30 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:54:58 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 11:47:51 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 18:12:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:15:53 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 14:47:42 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 14:50:39 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 02:50:42 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 18:01:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:37:33 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:10:31 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:42:39 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 03:26:19 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 18:11:15 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 17:43:01 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:37:40 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 12:32:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:01:21 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:59:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 22:06:51 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:04:29 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 13:56:28 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/02 \| 23:58:11 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:55:40 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 12:22:12 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 17:22:53 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 12:12:53 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:25:30 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 18:00:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 21:21:38 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:25:12 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 02:33:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 09:34:46 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:59:41 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 16:09:31 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:17:36 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:44:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 16:22:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:40:17 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 11:35:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 20:56:23 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/11 \| 13:46:11 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 18:40:16 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 12:26:09 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 15:42:07 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 14:03:49 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:36:10 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 13:22:41 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:18:57 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 22:48:23 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 11:14:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 08:58:55 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 16:56:19 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 17:06:46 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:41:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 16:06:25 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:58:48 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:58:57 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 03:25:23 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/02 \| 23:51:49 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 15:02:48 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 10:13:25 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 15:57:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/11 \| 13:57:00 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 10:51:10 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 03:46:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 15:39:00 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:22:50 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:07:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 01:51:43 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 05:07:14 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:49:52 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:59:11 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:28:59 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 11:40:13 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 21:07:02 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 16:28:03 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:20:14 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 19:29:16 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 17:04:41 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 18:21:52 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 10:22:14 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 20:34:45 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 19:19:57 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 01:55:14 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 11:50:48 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 08:08:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 04:16:50 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:20:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 18:03:30 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:32:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:29:55 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:30:49 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 21:42:33 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 16:49:19 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 20:18:38 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 08:10:39 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:00:39 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 04:35:11 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:06:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 14:33:51 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 13:36:24 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:02:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 09:33:53 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:23:42 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 16:20:48 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 00:42:48 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:33:01 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:59:19 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 11:08:36 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 02:20:16 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 18:50:20 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 15:12:44 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 02:24:00 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 15:47:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 15:22:03 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 05:53:11 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 15:20:31 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 10:31:55 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 11:39:19 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:34:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:32:24 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 16:26:19 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 15:29:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 08:59:49 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:05:11 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:42:01 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 22:41:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 16:27:49 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 01:37:20 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:38:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 13:30:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 20:46:01 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 10:02:59 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:31:03 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:48:39 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 09:59:18 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 10:12:18 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:21:44 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:51:54 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 09:27:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 14:25:19 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:29:08 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 06:24:20 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 22:25:15 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 09:24:11 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:46:45 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 05:43:52 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 12:34:31 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 06:02:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:16:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:45:08 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 13:31:46 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 03:59:23 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 00:58:25 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:00:42 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/11 \| 13:45:57 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:35:49 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:10:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:10:09 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/26 \| 22:14:36 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:50:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:45:15 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:13:02 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 16:17:51 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 13:25:08 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 16:14:12 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 04:40:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 15:33:02 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/02 \| 23:21:20 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 15:54:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 19:18:27 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 17:12:57 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 19:17:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 16:53:52 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 13:27:58 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 21:43:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 10:11:25 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:01:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 09:05:27 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 16:07:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 05:34:10 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 15:09:02 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:12:39 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:38:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 04:35:14 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 09:45:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 08:34:54 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 15:54:53 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 14:51:40 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:03:28 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 03:16:57 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 18:45:02 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:11:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 16:11:06 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:46:29 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:56:41 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 16:43:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 14:04:40 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 03:14:34 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 16:02:30 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 16:50:48 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 21:38:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:01:50 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 16:26:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 00:29:42 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 21:56:52 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 15:28:11 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 03:11:06 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:15:55 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:14:17 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 18:29:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:07:34 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:48:50 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 01:54:21 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 03:30:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 03:20:45 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 11:40:50 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:41:38 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 13:10:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 11:57:49 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 08:18:31 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 01:41:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:29:45 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:59:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 04:55:42 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 01:51:06 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 03:44:10 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:59:03 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 17:21:23 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:23:59 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 06:55:40 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 16:40:03 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 11:30:54 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 13:13:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 23:13:25 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:26:51 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 01:36:16 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 16:13:17 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 16:43:48 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 19:35:27 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 17:46:50 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 09:39:24 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 15:45:03 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 18:21:11 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:31:53 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 19:14:40 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 10:30:25 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 00:32:13 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 19:24:38 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/11 \| 14:19:44 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 19:08:00 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:57:42 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 08:53:01 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 20:25:03 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 04:45:33 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 01:04:03 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 19:26:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 15:03:31 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 15:13:29 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 14:59:16 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 18:40:53 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:05:09 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 15:38:09 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:40:37 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 20:39:36 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:24:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 15:31:08 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 17:40:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 10:45:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:10:46 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 16:58:30 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 04:18:11 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:21:24 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:02:13 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 16:34:51 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 05:26:15 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/02 \| 23:56:27 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:51:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:22:12 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 13:59:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 23:57:44 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 16:16:21 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 20:11:37 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 08:00:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/11 \| 14:53:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:47:09 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 08:33:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:21:59 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:31:18 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:41:00 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 23:18:29 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:19:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 22:22:21 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:25:43 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 02:03:15 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 09:00:10 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 17:55:20 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:29:17 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:21:53 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:15:48 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:56:41 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 15:01:18 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 14:52:15 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:05:28 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 12:31:17 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/11 \| 14:21:48 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 14:42:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:38:33 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:11:39 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:06:58 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 14:04:03 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 18:50:59 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 15:44:49 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 14:26:57 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 05:32:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 14:46:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 06:03:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 18:02:00 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 15:52:44 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 09:00:49 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 04:24:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/26 \| 22:09:18 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 09:10:08 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 23:44:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:47:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 21:51:15 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:18:24 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:32:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:31:12 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 08:35:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:04:20 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 03:37:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 19:59:51 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 22:47:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 18:41:09 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/02 \| 23:41:51 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:02:14 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 09:08:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:40:36 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 11:12:24 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 22:57:15 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 02:32:38 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:00:59 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:00:33 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 16:31:37 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 04:02:07 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 23:37:13 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:11:39 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 03:08:48 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 10:46:15 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:12:02 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 05:48:30 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 17:06:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 04:41:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 19:44:30 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:38:19 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 18:53:28 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 06:17:55 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 20:42:40 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 15:17:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:18:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:34:49 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 03:28:00 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 16:09:19 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 18:32:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 10:31:18 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:26:36 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:39:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 15:19:08 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 11:01:35 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 03:49:24 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/02 \| 23:29:51 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:44:52 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:50:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 11:02:12 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 10:16:02 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:09:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/11 \| 14:10:20 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 01:38:13 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:56:05 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:39:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 04:46:39 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 03:40:03 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:43:14 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 09:43:12 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 08:50:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 15:37:16 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:13:30 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 06:47:08 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:19:53 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 14:29:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:47:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 16:40:17 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/02 \| 23:19:33 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:45:38 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 13:32:39 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:05:36 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 02:30:11 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 09:59:55 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:39:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 16:48:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 19:42:09 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 15:25:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 12:09:58 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 15:51:22 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 21:00:51 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 13:37:27 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 12:14:17 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:18:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 08:47:50 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:26:52 - Program Manager
Source: a1K847qsM0.exe, 24983f03fb74576bbc5af6aa1085b23dWindows Update.exe.2.dr, Notepad.exe.2.dr, Explower.exe7.2.dr, Explower.exe2.2.dr, Explower.exe5.2.dr, Microsoft Corporation.exe.2.dr, Explower.exe4.2.dr, Explower.exe0.2.dr, Explower.exe8.2.dr, server.exe.0.dr	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:44:31 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 16:34:02 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 16:53:25 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 03:07:18 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:58:43 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 10:11:24 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 11:11:31 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 13:01:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:47:20 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 08:58:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:41:46 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:15:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:33:17 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 17:38:08 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 17:56:13 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:39:26 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 02:04:46 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 05:09:37 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 20:06:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 12:26:36 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 17:18:28 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:22:16 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 11:18:32 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 08:26:06 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 15:43:02 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:31:02 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 02:28:24 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 06:43:44 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 16:51:06 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:57:06 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 02:58:23 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 08:07:41 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:24:12 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 02:41:04 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 05:01:06 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:15:33 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:46:07 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 11:25:36 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 13:54:54 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 10:05:14 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 09:06:57 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 14:24:07 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:34:56 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:05:45 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 09:28:58 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 09:46:28 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:41:58 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 17:00:46 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 17:58:14 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 15:19:55 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 07:18:02 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:29:47 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:06:20 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 06:10:54 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 07:16:54 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:42:38 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 10:06:06 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 01:13:58 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:54:28 - Program Manager
Source: server.exe, 00000002.00000002.4534461443.0000000004196000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000002.00000002.4534461443.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:59:57 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Contains functionality to disable the Task Manager (.Net Source)

Source: a1K847qsM0.exe, Fransesco.cs	.Net Code: INS
Source: server.exe.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe0.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe1.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe2.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe3.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe4.2.dr, Fransesco.cs	.Net Code: INS
Source: Notepad.exe.2.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe5.2.dr, Fransesco.cs	.Net Code: INS
Source: Microsoft Corporation.exe.2.dr, Fransesco.cs	.Net Code: INS

Disables zone checking for all users

Source: C:\Users\user\AppData\Local\Temp\server.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: a1K847qsM0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4534386921.00000000026E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a1K847qsM0.exe PID: 1276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 384, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: a1K847qsM0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.a1K847qsM0.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4534386921.00000000026E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a1K847qsM0.exe PID: 1276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 384, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	11 Replication Through Removable Media	Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	1 Access Token Manipulation	32 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Process Injection	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
a1K847qsM0.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
a1K847qsM0.exe	79%	Virustotal		Browse
a1K847qsM0.exe	100%	Avira	TR/Dropper.Gen
a1K847qsM0.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	100%	Avira	TR/Dropper.Gen
C:\Notepad.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\server.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	100%	Joe Sandbox ML
C:\Notepad.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\server.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Notepad.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Notepad.exe	79%	Virustotal		Browse
C:\Program Files (x86)\Explower.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Program Files (x86)\Explower.exe	79%	Virustotal		Browse
C:\Users\user\AppData\Local\Explower.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Explower.exe	79%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	79%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Temp\server.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\Desktop\Explower.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\Documents\Explower.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\Favorites\Explower.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Windows\SysWOW64\Explower.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
167.71.56.116	unknown	United States		14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580216
Start date and time:	2024-12-24 03:41:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	a1K847qsM0.exe renamed because original name is a hash value
Original Sample Name:	55e2016fcb659bdf0f46a24ef2876609.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.adwa.evad.winEXE@16/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 138 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:42:33	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe
03:42:41	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
03:42:50	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
21:43:01	API Interceptor	890750x Sleep call for process: server.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
167.71.56.116	njrat.exe	Get hash	malicious	Njrat	Browse
	lz3EbiqoK4.exe	Get hash	malicious	Quasar	Browse
	lz3EbiqoK4.exe	Get hash	malicious	Quasar	Browse
	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Get hash	malicious	XWorm	Browse
	X.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe	Get hash	malicious	XWorm	Browse
	WinScanGuard_v.2.1.bat	Get hash	malicious	Quasar	Browse
	Shadow-Stealer.bat	Get hash	malicious	Quasar	Browse
	OvA6x5v34G.exe	Get hash	malicious	AsyncRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	https://flowto.it/8tooc2sec?fc=0	Get hash	malicious	Unknown	Browse	161.35.24.67
	https://qulatrics.com/	Get hash	malicious	Unknown	Browse	206.189.225.178
	https://qulatrics.com/	Get hash	malicious	Unknown	Browse	206.189.225.178
	https://liladelman.com/rental/1218-west-side-road-block-island/	Get hash	malicious	Unknown	Browse	159.89.55.215
	OZq1f2sZz3.exe	Get hash	malicious	AsyncRAT	Browse	104.236.39.42
	1.elf	Get hash	malicious	Unknown	Browse	157.230.180.148
	3.elf	Get hash	malicious	Unknown	Browse	157.245.169.47
	oAnb4ULQxP.exe	Get hash	malicious	AsyncRAT	Browse	104.236.39.42
	2.elf	Get hash	malicious	Unknown	Browse	157.230.201.7
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	165.22.174.231

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Notepad.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Notepad.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Notepad.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Notepad.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Notepad.exe, Author: Florian Roth Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Notepad.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Notepad.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Notepad.exe, Author: Sekoia.io Rule: Njrat, Description: detect njRAT in memory, Source: C:\Notepad.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Notepad.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 79%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Program Files (x86)\Explower.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Program Files (x86)\Explower.exe, Author: Sekoia.io Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 79%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Explower.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 79%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Explower.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Microsoft Corporation.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\a1K847qsM0.exe.log

Download File

Process:	C:\Users\user\Desktop\a1K847qsM0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	true
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 79%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Temp\server.exe

Download File

Process:	C:\Users\user\Desktop\a1K847qsM0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Florian Roth Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Sekoia.io Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: Florian Roth Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: Sekoia.io Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\app

Download File

Process:	C:\Users\user\Desktop\a1K847qsM0.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:l:l
MD5:	C2844BC9E1BD64168A727B0680AE4D90
SHA1:	7BB263540DE557F5A4E09C6C78B7DBB314A0DF9A
SHA-256:	9C9701AB918368B615FC6A0DBEB5EFA286A232D751982AE70B48AD6914BF01E5
SHA-512:	360953BB20D91539022FCB1BECF4638970C4452816797A8DCA65E3AE4A542302E6E89F0828087CAAA63A0750AA78605F8034DA7C8663FA4FC677C8F3E53655ED
Malicious:	false
Preview:	.23

C:\Users\user\Desktop\Explower.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Documents\Explower.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Favorites\Explower.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Windows\SysWOW64\Explower.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.562368913361869
Encrypted:	false
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
MD5:	55E2016FCB659BDF0F46A24EF2876609
SHA1:	5AFB69F26DDF1884372643A2B00D16A481FC7C26
SHA-256:	3825FE6FD9E8754B3D4A374B8C73884647C6898D5E1220A0FE89B1A3DC8E35C4
SHA-512:	4DE0FB035B904BD2557D48AACFEA53346748E0DBDA86B710EE86796C374C37FD35E50F4D8B05CD1C058F95665894629F8848F4BCE45378C00CED771BAAEA3E46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.562368913361869
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	a1K847qsM0.exe
File size:	95'232 bytes
MD5:	55e2016fcb659bdf0f46a24ef2876609
SHA1:	5afb69f26ddf1884372643a2b00d16a481fc7c26
SHA256:	3825fe6fd9e8754b3d4a374b8c73884647c6898d5e1220a0fe89b1a3dc8e35c4
SHA512:	4de0fb035b904bd2557d48aacfea53346748e0dbda86b710ee86796c374c37fd35e50f4d8b05cd1c058f95665894629f8848f4bce45378c00ced771baaea3e46
SSDEEP:	1536:jwWmC+xhUa9urgOB9RNvM4jEwzGi1dDID0gS:cWgUa9urgONdGi1dmt
TLSH:	2793D74977E56524E4BF56F75472F2004E34B48B1602E39E49F258EA0B33AC44F89EEB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....eg.................p............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x418f0e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6765A2A0 [Fri Dec 20 17:00:16 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18eb8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16f14	0x17000	b932bf9799458044e39c5671fa4bda31	False	0.3679305366847826	data	5.5941563909685215	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	26def8a0407cc7078ce41b7ef703298e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T03:42:31.917473+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49704	167.71.56.116	22342	TCP
2024-12-24T03:42:31.917473+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49704	167.71.56.116	22342	TCP
2024-12-24T03:42:34.840507+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49705	167.71.56.116	22342	TCP
2024-12-24T03:42:34.840507+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49705	167.71.56.116	22342	TCP
2024-12-24T03:42:38.042047+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49707	167.71.56.116	22342	TCP
2024-12-24T03:42:38.042047+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49707	167.71.56.116	22342	TCP
2024-12-24T03:42:41.244863+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49714	167.71.56.116	22342	TCP
2024-12-24T03:42:41.244863+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49714	167.71.56.116	22342	TCP
2024-12-24T03:42:44.450837+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49722	167.71.56.116	22342	TCP
2024-12-24T03:42:44.450837+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49722	167.71.56.116	22342	TCP
2024-12-24T03:42:47.651430+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49729	167.71.56.116	22342	TCP
2024-12-24T03:42:47.651430+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49729	167.71.56.116	22342	TCP
2024-12-24T03:42:50.838855+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49739	167.71.56.116	22342	TCP
2024-12-24T03:42:50.838855+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49739	167.71.56.116	22342	TCP
2024-12-24T03:42:54.026484+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49746	167.71.56.116	22342	TCP
2024-12-24T03:42:54.026484+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49746	167.71.56.116	22342	TCP
2024-12-24T03:42:54.315776+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49746	167.71.56.116	22342	TCP
2024-12-24T03:42:57.213455+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49752	167.71.56.116	22342	TCP
2024-12-24T03:42:57.213455+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49752	167.71.56.116	22342	TCP
2024-12-24T03:43:00.404749+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49763	167.71.56.116	22342	TCP
2024-12-24T03:43:00.404749+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49763	167.71.56.116	22342	TCP
2024-12-24T03:43:03.604465+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49769	167.71.56.116	22342	TCP
2024-12-24T03:43:03.604465+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49769	167.71.56.116	22342	TCP
2024-12-24T03:43:06.791787+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49780	167.71.56.116	22342	TCP
2024-12-24T03:43:06.791787+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49780	167.71.56.116	22342	TCP
2024-12-24T03:43:09.995359+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49786	167.71.56.116	22342	TCP
2024-12-24T03:43:09.995359+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49786	167.71.56.116	22342	TCP
2024-12-24T03:43:13.182429+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49797	167.71.56.116	22342	TCP
2024-12-24T03:43:13.182429+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49797	167.71.56.116	22342	TCP
2024-12-24T03:43:16.416324+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49803	167.71.56.116	22342	TCP
2024-12-24T03:43:16.416324+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49803	167.71.56.116	22342	TCP
2024-12-24T03:43:19.765068+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49809	167.71.56.116	22342	TCP
2024-12-24T03:43:19.765068+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49809	167.71.56.116	22342	TCP
2024-12-24T03:43:20.004427+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49809	167.71.56.116	22342	TCP
2024-12-24T03:43:22.960273+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49821	167.71.56.116	22342	TCP
2024-12-24T03:43:22.960273+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49821	167.71.56.116	22342	TCP
2024-12-24T03:43:26.026530+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49827	167.71.56.116	22342	TCP
2024-12-24T03:43:26.026530+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49827	167.71.56.116	22342	TCP
2024-12-24T03:43:28.964168+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49838	167.71.56.116	22342	TCP
2024-12-24T03:43:28.964168+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49838	167.71.56.116	22342	TCP
2024-12-24T03:43:31.792461+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49844	167.71.56.116	22342	TCP
2024-12-24T03:43:31.792461+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49844	167.71.56.116	22342	TCP
2024-12-24T03:43:34.495186+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49850	167.71.56.116	22342	TCP
2024-12-24T03:43:34.495186+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49850	167.71.56.116	22342	TCP
2024-12-24T03:43:37.140390+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49855	167.71.56.116	22342	TCP
2024-12-24T03:43:37.140390+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49855	167.71.56.116	22342	TCP
2024-12-24T03:43:39.651284+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49864	167.71.56.116	22342	TCP
2024-12-24T03:43:39.651284+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49864	167.71.56.116	22342	TCP
2024-12-24T03:43:42.091237+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49872	167.71.56.116	22342	TCP
2024-12-24T03:43:42.091237+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49872	167.71.56.116	22342	TCP
2024-12-24T03:43:44.432817+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49878	167.71.56.116	22342	TCP
2024-12-24T03:43:44.432817+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49878	167.71.56.116	22342	TCP
2024-12-24T03:43:46.714076+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49884	167.71.56.116	22342	TCP
2024-12-24T03:43:46.714076+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49884	167.71.56.116	22342	TCP
2024-12-24T03:43:48.940559+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49890	167.71.56.116	22342	TCP
2024-12-24T03:43:48.940559+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49890	167.71.56.116	22342	TCP
2024-12-24T03:43:51.028647+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49896	167.71.56.116	22342	TCP
2024-12-24T03:43:51.028647+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49896	167.71.56.116	22342	TCP
2024-12-24T03:43:53.088885+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49902	167.71.56.116	22342	TCP
2024-12-24T03:43:53.088885+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49902	167.71.56.116	22342	TCP
2024-12-24T03:43:55.091466+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49908	167.71.56.116	22342	TCP
2024-12-24T03:43:55.091466+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49908	167.71.56.116	22342	TCP
2024-12-24T03:43:57.059790+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49911	167.71.56.116	22342	TCP
2024-12-24T03:43:57.059790+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49911	167.71.56.116	22342	TCP
2024-12-24T03:43:58.997569+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49915	167.71.56.116	22342	TCP
2024-12-24T03:43:58.997569+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49915	167.71.56.116	22342	TCP
2024-12-24T03:44:00.883734+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49921	167.71.56.116	22342	TCP
2024-12-24T03:44:00.883734+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49921	167.71.56.116	22342	TCP
2024-12-24T03:44:02.699785+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49927	167.71.56.116	22342	TCP
2024-12-24T03:44:02.699785+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49927	167.71.56.116	22342	TCP
2024-12-24T03:44:04.487222+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49932	167.71.56.116	22342	TCP
2024-12-24T03:44:04.487222+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49932	167.71.56.116	22342	TCP
2024-12-24T03:44:06.250790+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49935	167.71.56.116	22342	TCP
2024-12-24T03:44:06.250790+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49935	167.71.56.116	22342	TCP
2024-12-24T03:44:07.924340+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49940	167.71.56.116	22342	TCP
2024-12-24T03:44:07.924340+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49940	167.71.56.116	22342	TCP
2024-12-24T03:44:09.619729+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49945	167.71.56.116	22342	TCP
2024-12-24T03:44:09.619729+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49945	167.71.56.116	22342	TCP
2024-12-24T03:44:11.468913+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49948	167.71.56.116	22342	TCP
2024-12-24T03:44:11.468913+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49948	167.71.56.116	22342	TCP
2024-12-24T03:44:13.088468+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49954	167.71.56.116	22342	TCP
2024-12-24T03:44:13.088468+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49954	167.71.56.116	22342	TCP
2024-12-24T03:44:14.670029+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49959	167.71.56.116	22342	TCP
2024-12-24T03:44:14.670029+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49959	167.71.56.116	22342	TCP
2024-12-24T03:44:16.458588+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49961	167.71.56.116	22342	TCP
2024-12-24T03:44:16.458588+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49961	167.71.56.116	22342	TCP
2024-12-24T03:44:17.978837+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49967	167.71.56.116	22342	TCP
2024-12-24T03:44:17.978837+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49967	167.71.56.116	22342	TCP
2024-12-24T03:44:19.527186+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49973	167.71.56.116	22342	TCP
2024-12-24T03:44:19.527186+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49973	167.71.56.116	22342	TCP
2024-12-24T03:44:21.012032+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49974	167.71.56.116	22342	TCP
2024-12-24T03:44:21.012032+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49974	167.71.56.116	22342	TCP
2024-12-24T03:44:22.479197+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49980	167.71.56.116	22342	TCP
2024-12-24T03:44:22.479197+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49980	167.71.56.116	22342	TCP
2024-12-24T03:44:23.916274+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49986	167.71.56.116	22342	TCP
2024-12-24T03:44:23.916274+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49986	167.71.56.116	22342	TCP
2024-12-24T03:44:25.354344+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49987	167.71.56.116	22342	TCP
2024-12-24T03:44:25.354344+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49987	167.71.56.116	22342	TCP
2024-12-24T03:44:26.775852+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49993	167.71.56.116	22342	TCP
2024-12-24T03:44:26.775852+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49993	167.71.56.116	22342	TCP
2024-12-24T03:44:27.437639+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49993	167.71.56.116	22342	TCP
2024-12-24T03:44:28.169642+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49999	167.71.56.116	22342	TCP
2024-12-24T03:44:28.169642+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49999	167.71.56.116	22342	TCP
2024-12-24T03:44:29.558902+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50000	167.71.56.116	22342	TCP
2024-12-24T03:44:29.558902+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50000	167.71.56.116	22342	TCP
2024-12-24T03:44:30.947858+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50006	167.71.56.116	22342	TCP
2024-12-24T03:44:30.947858+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50006	167.71.56.116	22342	TCP
2024-12-24T03:44:32.322518+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50008	167.71.56.116	22342	TCP
2024-12-24T03:44:32.322518+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50008	167.71.56.116	22342	TCP
2024-12-24T03:44:33.666668+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50013	167.71.56.116	22342	TCP
2024-12-24T03:44:33.666668+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50013	167.71.56.116	22342	TCP
2024-12-24T03:44:35.014287+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50018	167.71.56.116	22342	TCP
2024-12-24T03:44:35.014287+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50018	167.71.56.116	22342	TCP
2024-12-24T03:44:35.345084+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50018	167.71.56.116	22342	TCP
2024-12-24T03:44:36.339745+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50020	167.71.56.116	22342	TCP
2024-12-24T03:44:36.339745+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50020	167.71.56.116	22342	TCP
2024-12-24T03:44:37.666445+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50025	167.71.56.116	22342	TCP
2024-12-24T03:44:37.666445+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50025	167.71.56.116	22342	TCP
2024-12-24T03:44:38.989552+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50029	167.71.56.116	22342	TCP
2024-12-24T03:44:38.989552+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50029	167.71.56.116	22342	TCP
2024-12-24T03:44:40.293839+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50033	167.71.56.116	22342	TCP
2024-12-24T03:44:40.293839+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50033	167.71.56.116	22342	TCP
2024-12-24T03:44:41.588169+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50035	167.71.56.116	22342	TCP
2024-12-24T03:44:41.588169+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50035	167.71.56.116	22342	TCP
2024-12-24T03:44:41.827411+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50035	167.71.56.116	22342	TCP
2024-12-24T03:44:42.869517+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50036	167.71.56.116	22342	TCP
2024-12-24T03:44:42.869517+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50036	167.71.56.116	22342	TCP
2024-12-24T03:44:44.228764+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50037	167.71.56.116	22342	TCP
2024-12-24T03:44:44.228764+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50037	167.71.56.116	22342	TCP
2024-12-24T03:44:45.519523+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50038	167.71.56.116	22342	TCP
2024-12-24T03:44:45.519523+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50038	167.71.56.116	22342	TCP
2024-12-24T03:44:46.548271+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50038	167.71.56.116	22342	TCP
2024-12-24T03:44:46.791499+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50039	167.71.56.116	22342	TCP
2024-12-24T03:44:46.791499+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50039	167.71.56.116	22342	TCP
2024-12-24T03:44:48.060465+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50040	167.71.56.116	22342	TCP
2024-12-24T03:44:48.060465+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50040	167.71.56.116	22342	TCP
2024-12-24T03:44:49.344442+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50041	167.71.56.116	22342	TCP
2024-12-24T03:44:49.344442+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50041	167.71.56.116	22342	TCP
2024-12-24T03:44:50.604430+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50042	167.71.56.116	22342	TCP
2024-12-24T03:44:50.604430+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50042	167.71.56.116	22342	TCP
2024-12-24T03:44:51.853881+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50043	167.71.56.116	22342	TCP
2024-12-24T03:44:51.853881+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50043	167.71.56.116	22342	TCP
2024-12-24T03:44:53.104831+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50044	167.71.56.116	22342	TCP
2024-12-24T03:44:53.104831+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50044	167.71.56.116	22342	TCP
2024-12-24T03:44:53.468710+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50044	167.71.56.116	22342	TCP
2024-12-24T03:44:54.353767+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50045	167.71.56.116	22342	TCP
2024-12-24T03:44:54.353767+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50045	167.71.56.116	22342	TCP
2024-12-24T03:44:55.605732+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50046	167.71.56.116	22342	TCP
2024-12-24T03:44:55.605732+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50046	167.71.56.116	22342	TCP
2024-12-24T03:44:56.875912+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50047	167.71.56.116	22342	TCP
2024-12-24T03:44:56.875912+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50047	167.71.56.116	22342	TCP
2024-12-24T03:44:57.342983+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50047	167.71.56.116	22342	TCP
2024-12-24T03:44:58.104743+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50048	167.71.56.116	22342	TCP
2024-12-24T03:44:58.104743+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50048	167.71.56.116	22342	TCP
2024-12-24T03:44:58.673978+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50048	167.71.56.116	22342	TCP
2024-12-24T03:44:59.338648+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50049	167.71.56.116	22342	TCP
2024-12-24T03:44:59.338648+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50049	167.71.56.116	22342	TCP
2024-12-24T03:44:59.718681+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50049	167.71.56.116	22342	TCP
2024-12-24T03:45:00.577961+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50050	167.71.56.116	22342	TCP
2024-12-24T03:45:00.577961+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50050	167.71.56.116	22342	TCP
2024-12-24T03:45:01.811232+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50051	167.71.56.116	22342	TCP
2024-12-24T03:45:01.811232+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50051	167.71.56.116	22342	TCP
2024-12-24T03:45:02.573559+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50051	167.71.56.116	22342	TCP
2024-12-24T03:45:03.041537+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50052	167.71.56.116	22342	TCP
2024-12-24T03:45:03.041537+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50052	167.71.56.116	22342	TCP
2024-12-24T03:45:03.282063+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50052	167.71.56.116	22342	TCP
2024-12-24T03:45:04.278874+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50053	167.71.56.116	22342	TCP
2024-12-24T03:45:04.278874+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50053	167.71.56.116	22342	TCP
2024-12-24T03:45:05.512107+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50054	167.71.56.116	22342	TCP
2024-12-24T03:45:05.512107+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50054	167.71.56.116	22342	TCP
2024-12-24T03:45:06.733096+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50055	167.71.56.116	22342	TCP
2024-12-24T03:45:06.733096+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50055	167.71.56.116	22342	TCP
2024-12-24T03:45:07.963717+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50056	167.71.56.116	22342	TCP
2024-12-24T03:45:07.963717+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50056	167.71.56.116	22342	TCP
2024-12-24T03:45:09.262684+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50057	167.71.56.116	22342	TCP
2024-12-24T03:45:09.262684+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50057	167.71.56.116	22342	TCP
2024-12-24T03:45:10.482980+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50058	167.71.56.116	22342	TCP
2024-12-24T03:45:10.482980+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50058	167.71.56.116	22342	TCP
2024-12-24T03:45:11.706340+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50059	167.71.56.116	22342	TCP
2024-12-24T03:45:11.706340+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50059	167.71.56.116	22342	TCP
2024-12-24T03:45:12.916823+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50060	167.71.56.116	22342	TCP
2024-12-24T03:45:12.916823+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50060	167.71.56.116	22342	TCP
2024-12-24T03:45:14.160163+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50061	167.71.56.116	22342	TCP
2024-12-24T03:45:14.160163+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50061	167.71.56.116	22342	TCP
2024-12-24T03:45:15.498213+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50062	167.71.56.116	22342	TCP
2024-12-24T03:45:15.498213+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50062	167.71.56.116	22342	TCP
2024-12-24T03:45:16.715585+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50063	167.71.56.116	22342	TCP
2024-12-24T03:45:16.715585+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50063	167.71.56.116	22342	TCP
2024-12-24T03:45:17.916878+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50064	167.71.56.116	22342	TCP
2024-12-24T03:45:17.916878+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50064	167.71.56.116	22342	TCP
2024-12-24T03:45:19.124611+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50065	167.71.56.116	22342	TCP
2024-12-24T03:45:19.124611+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50065	167.71.56.116	22342	TCP
2024-12-24T03:45:20.327950+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50066	167.71.56.116	22342	TCP
2024-12-24T03:45:20.327950+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50066	167.71.56.116	22342	TCP
2024-12-24T03:45:20.567494+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50066	167.71.56.116	22342	TCP
2024-12-24T03:45:21.525678+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50067	167.71.56.116	22342	TCP
2024-12-24T03:45:21.525678+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50067	167.71.56.116	22342	TCP
2024-12-24T03:45:22.769407+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50068	167.71.56.116	22342	TCP
2024-12-24T03:45:22.769407+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50068	167.71.56.116	22342	TCP
2024-12-24T03:45:23.979395+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50069	167.71.56.116	22342	TCP
2024-12-24T03:45:23.979395+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50069	167.71.56.116	22342	TCP
2024-12-24T03:45:25.260034+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50070	167.71.56.116	22342	TCP
2024-12-24T03:45:25.260034+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50070	167.71.56.116	22342	TCP
2024-12-24T03:45:26.467431+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50071	167.71.56.116	22342	TCP
2024-12-24T03:45:26.467431+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50071	167.71.56.116	22342	TCP
2024-12-24T03:45:27.666433+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50072	167.71.56.116	22342	TCP
2024-12-24T03:45:27.666433+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50072	167.71.56.116	22342	TCP
2024-12-24T03:45:28.870498+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50073	167.71.56.116	22342	TCP
2024-12-24T03:45:28.870498+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50073	167.71.56.116	22342	TCP
2024-12-24T03:45:30.073173+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50074	167.71.56.116	22342	TCP
2024-12-24T03:45:30.073173+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50074	167.71.56.116	22342	TCP
2024-12-24T03:45:31.275705+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50075	167.71.56.116	22342	TCP
2024-12-24T03:45:31.275705+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50075	167.71.56.116	22342	TCP
2024-12-24T03:45:32.479054+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50076	167.71.56.116	22342	TCP
2024-12-24T03:45:32.479054+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50076	167.71.56.116	22342	TCP
2024-12-24T03:45:33.681805+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50077	167.71.56.116	22342	TCP
2024-12-24T03:45:33.681805+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50077	167.71.56.116	22342	TCP
2024-12-24T03:45:34.885340+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50078	167.71.56.116	22342	TCP
2024-12-24T03:45:34.885340+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50078	167.71.56.116	22342	TCP
2024-12-24T03:45:36.088415+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50079	167.71.56.116	22342	TCP
2024-12-24T03:45:36.088415+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50079	167.71.56.116	22342	TCP
2024-12-24T03:45:37.314723+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50080	167.71.56.116	22342	TCP
2024-12-24T03:45:37.314723+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50080	167.71.56.116	22342	TCP
2024-12-24T03:45:38.559296+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50081	167.71.56.116	22342	TCP
2024-12-24T03:45:38.559296+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50081	167.71.56.116	22342	TCP
2024-12-24T03:45:39.762035+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50082	167.71.56.116	22342	TCP
2024-12-24T03:45:39.762035+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50082	167.71.56.116	22342	TCP
2024-12-24T03:45:40.965123+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50083	167.71.56.116	22342	TCP
2024-12-24T03:45:40.965123+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50083	167.71.56.116	22342	TCP
2024-12-24T03:45:42.167155+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50084	167.71.56.116	22342	TCP
2024-12-24T03:45:42.167155+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50084	167.71.56.116	22342	TCP
2024-12-24T03:45:43.369376+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50085	167.71.56.116	22342	TCP
2024-12-24T03:45:43.369376+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50085	167.71.56.116	22342	TCP
2024-12-24T03:45:44.556778+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50086	167.71.56.116	22342	TCP
2024-12-24T03:45:44.556778+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50086	167.71.56.116	22342	TCP
2024-12-24T03:45:45.125637+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50086	167.71.56.116	22342	TCP
2024-12-24T03:45:45.775907+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50087	167.71.56.116	22342	TCP
2024-12-24T03:45:45.775907+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50087	167.71.56.116	22342	TCP
2024-12-24T03:45:46.978825+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50088	167.71.56.116	22342	TCP
2024-12-24T03:45:46.978825+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50088	167.71.56.116	22342	TCP
2024-12-24T03:45:48.183546+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50089	167.71.56.116	22342	TCP
2024-12-24T03:45:48.183546+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50089	167.71.56.116	22342	TCP
2024-12-24T03:45:49.462884+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50090	167.71.56.116	22342	TCP
2024-12-24T03:45:49.462884+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50090	167.71.56.116	22342	TCP
2024-12-24T03:45:50.670000+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50091	167.71.56.116	22342	TCP
2024-12-24T03:45:50.670000+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50091	167.71.56.116	22342	TCP
2024-12-24T03:45:51.878338+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50092	167.71.56.116	22342	TCP
2024-12-24T03:45:51.878338+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50092	167.71.56.116	22342	TCP
2024-12-24T03:45:52.359880+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50092	167.71.56.116	22342	TCP
2024-12-24T03:45:53.072427+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50093	167.71.56.116	22342	TCP
2024-12-24T03:45:53.072427+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50093	167.71.56.116	22342	TCP
2024-12-24T03:45:54.285286+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50094	167.71.56.116	22342	TCP
2024-12-24T03:45:54.285286+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50094	167.71.56.116	22342	TCP
2024-12-24T03:45:55.478700+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50095	167.71.56.116	22342	TCP
2024-12-24T03:45:55.478700+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50095	167.71.56.116	22342	TCP
2024-12-24T03:45:56.666629+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50096	167.71.56.116	22342	TCP
2024-12-24T03:45:56.666629+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50096	167.71.56.116	22342	TCP
2024-12-24T03:45:57.853580+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50097	167.71.56.116	22342	TCP
2024-12-24T03:45:57.853580+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50097	167.71.56.116	22342	TCP
2024-12-24T03:45:59.041215+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50098	167.71.56.116	22342	TCP
2024-12-24T03:45:59.041215+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50098	167.71.56.116	22342	TCP
2024-12-24T03:46:00.251802+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50099	167.71.56.116	22342	TCP
2024-12-24T03:46:00.251802+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50099	167.71.56.116	22342	TCP
2024-12-24T03:46:01.433418+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50100	167.71.56.116	22342	TCP
2024-12-24T03:46:01.433418+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50100	167.71.56.116	22342	TCP
2024-12-24T03:46:02.176704+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50100	167.71.56.116	22342	TCP
2024-12-24T03:46:02.638499+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50101	167.71.56.116	22342	TCP
2024-12-24T03:46:02.638499+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50101	167.71.56.116	22342	TCP
2024-12-24T03:46:03.838310+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50102	167.71.56.116	22342	TCP
2024-12-24T03:46:03.838310+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50102	167.71.56.116	22342	TCP
2024-12-24T03:46:05.041530+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50103	167.71.56.116	22342	TCP
2024-12-24T03:46:05.041530+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50103	167.71.56.116	22342	TCP
2024-12-24T03:46:06.244540+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50104	167.71.56.116	22342	TCP
2024-12-24T03:46:06.244540+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50104	167.71.56.116	22342	TCP
2024-12-24T03:46:07.447305+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50105	167.71.56.116	22342	TCP
2024-12-24T03:46:07.447305+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50105	167.71.56.116	22342	TCP
2024-12-24T03:46:08.650805+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50106	167.71.56.116	22342	TCP
2024-12-24T03:46:08.650805+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50106	167.71.56.116	22342	TCP
2024-12-24T03:46:09.886639+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50107	167.71.56.116	22342	TCP
2024-12-24T03:46:09.886639+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50107	167.71.56.116	22342	TCP
2024-12-24T03:46:10.523203+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50107	167.71.56.116	22342	TCP
2024-12-24T03:46:11.088603+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50108	167.71.56.116	22342	TCP
2024-12-24T03:46:11.088603+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50108	167.71.56.116	22342	TCP
2024-12-24T03:46:12.291593+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50109	167.71.56.116	22342	TCP
2024-12-24T03:46:12.291593+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50109	167.71.56.116	22342	TCP
2024-12-24T03:46:13.513078+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50110	167.71.56.116	22342	TCP
2024-12-24T03:46:13.513078+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50110	167.71.56.116	22342	TCP
2024-12-24T03:46:14.691428+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50111	167.71.56.116	22342	TCP
2024-12-24T03:46:14.691428+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50111	167.71.56.116	22342	TCP
2024-12-24T03:46:15.879354+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50112	167.71.56.116	22342	TCP
2024-12-24T03:46:15.879354+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50112	167.71.56.116	22342	TCP
2024-12-24T03:46:17.070069+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50113	167.71.56.116	22342	TCP
2024-12-24T03:46:17.070069+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50113	167.71.56.116	22342	TCP
2024-12-24T03:46:18.266432+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50114	167.71.56.116	22342	TCP
2024-12-24T03:46:18.266432+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50114	167.71.56.116	22342	TCP
2024-12-24T03:46:18.506143+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50114	167.71.56.116	22342	TCP
2024-12-24T03:46:19.447944+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50115	167.71.56.116	22342	TCP
2024-12-24T03:46:19.447944+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50115	167.71.56.116	22342	TCP
2024-12-24T03:46:20.637359+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50116	167.71.56.116	22342	TCP
2024-12-24T03:46:20.637359+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50116	167.71.56.116	22342	TCP
2024-12-24T03:46:21.163215+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50116	167.71.56.116	22342	TCP
2024-12-24T03:46:21.827327+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50117	167.71.56.116	22342	TCP
2024-12-24T03:46:21.827327+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50117	167.71.56.116	22342	TCP
2024-12-24T03:46:23.012600+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50118	167.71.56.116	22342	TCP
2024-12-24T03:46:23.012600+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50118	167.71.56.116	22342	TCP
2024-12-24T03:46:24.207497+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50119	167.71.56.116	22342	TCP
2024-12-24T03:46:24.207497+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50119	167.71.56.116	22342	TCP
2024-12-24T03:46:25.402623+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50120	167.71.56.116	22342	TCP
2024-12-24T03:46:25.402623+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50120	167.71.56.116	22342	TCP
2024-12-24T03:46:26.619599+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50121	167.71.56.116	22342	TCP
2024-12-24T03:46:26.619599+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50121	167.71.56.116	22342	TCP
2024-12-24T03:46:27.442555+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	50121	167.71.56.116	22342	TCP
2024-12-24T03:46:27.807153+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50122	167.71.56.116	22342	TCP
2024-12-24T03:46:27.807153+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50122	167.71.56.116	22342	TCP
2024-12-24T03:46:28.994042+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	50123	167.71.56.116	22342	TCP
2024-12-24T03:46:28.994042+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	50123	167.71.56.116	22342	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 03:42:31.524642944 CET	49704	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:31.644256115 CET	22342	49704	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:31.644598007 CET	49704	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:31.917473078 CET	49704	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:32.037026882 CET	22342	49704	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:32.037096977 CET	49704	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:32.156613111 CET	22342	49704	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:32.710587025 CET	22342	49704	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:32.710668087 CET	49704	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:34.718803883 CET	49704	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:34.719243050 CET	49705	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:34.839144945 CET	22342	49704	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:34.839201927 CET	22342	49705	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:34.839289904 CET	49705	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:34.840507030 CET	49705	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:34.960200071 CET	22342	49705	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:34.960264921 CET	49705	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:35.079869986 CET	22342	49705	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:35.907987118 CET	22342	49705	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:35.908083916 CET	49705	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:37.921550989 CET	49705	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:37.921845913 CET	49707	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:38.041248083 CET	22342	49705	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:38.041431904 CET	22342	49707	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:38.041516066 CET	49707	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:38.042047024 CET	49707	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:38.161569118 CET	22342	49707	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:38.161626101 CET	49707	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:38.281209946 CET	22342	49707	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:39.109716892 CET	22342	49707	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:39.109783888 CET	49707	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:41.124336004 CET	49707	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:41.124696016 CET	49714	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:41.244008064 CET	22342	49707	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:41.244296074 CET	22342	49714	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:41.244388103 CET	49714	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:41.244863033 CET	49714	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:41.364648104 CET	22342	49714	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:41.364799023 CET	49714	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:41.484385967 CET	22342	49714	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:42.312114000 CET	22342	49714	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:42.312172890 CET	49714	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:44.327518940 CET	49714	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:44.327877998 CET	49722	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:44.447521925 CET	22342	49714	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:44.447617054 CET	22342	49722	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:44.447732925 CET	49722	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:44.450836897 CET	49722	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:44.570339918 CET	22342	49722	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:44.570415974 CET	49722	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:44.689924002 CET	22342	49722	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:45.515281916 CET	22342	49722	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:45.515347004 CET	49722	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:47.530864954 CET	49722	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:47.531248093 CET	49729	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:47.650382042 CET	22342	49722	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:47.650862932 CET	22342	49729	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:47.650945902 CET	49729	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:47.651429892 CET	49729	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:47.770998001 CET	22342	49729	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:47.772252083 CET	49729	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:47.891896963 CET	22342	49729	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:48.715989113 CET	22342	49729	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:48.716053963 CET	49729	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:50.718470097 CET	49729	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:50.718774080 CET	49739	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:50.838032007 CET	22342	49729	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:50.838265896 CET	22342	49739	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:50.838335991 CET	49739	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:50.838855028 CET	49739	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:50.958863974 CET	22342	49739	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:50.960190058 CET	49739	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:51.080517054 CET	22342	49739	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:51.902333975 CET	22342	49739	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:51.904222965 CET	49739	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:53.905483007 CET	49739	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:53.905977964 CET	49746	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:54.025053024 CET	22342	49739	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:54.025417089 CET	22342	49746	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:54.025484085 CET	49746	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:54.026484013 CET	49746	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:54.145944118 CET	22342	49746	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:54.146003962 CET	49746	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:54.265481949 CET	22342	49746	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:54.315776110 CET	49746	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:54.435317993 CET	22342	49746	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:55.089643955 CET	22342	49746	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:55.089807987 CET	49746	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:57.092972994 CET	49746	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:57.093336105 CET	49752	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:57.212505102 CET	22342	49746	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:57.212764025 CET	22342	49752	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:57.212883949 CET	49752	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:57.213454962 CET	49752	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:57.332869053 CET	22342	49752	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:57.335108042 CET	49752	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:42:57.454746008 CET	22342	49752	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:58.279402971 CET	22342	49752	167.71.56.116	192.168.2.5
Dec 24, 2024 03:42:58.279485941 CET	49752	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:00.283761978 CET	49752	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:00.284185886 CET	49763	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:00.403474092 CET	22342	49752	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:00.403825998 CET	22342	49763	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:00.403928995 CET	49763	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:00.404748917 CET	49763	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:00.524187088 CET	22342	49763	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:00.524290085 CET	49763	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:00.644022942 CET	22342	49763	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:01.472302914 CET	22342	49763	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:01.472382069 CET	49763	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:03.483633041 CET	49763	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:03.484390974 CET	49769	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:03.603182077 CET	22342	49763	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:03.603913069 CET	22342	49769	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:03.604027033 CET	49769	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:03.604465008 CET	49769	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:03.724033117 CET	22342	49769	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:03.726285934 CET	49769	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:03.845871925 CET	22342	49769	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:04.668406010 CET	22342	49769	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:04.668483019 CET	49769	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:06.671164989 CET	49769	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:06.671427011 CET	49780	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:06.791135073 CET	22342	49769	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:06.791182041 CET	22342	49780	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:06.791290998 CET	49780	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:06.791786909 CET	49780	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:06.911393881 CET	22342	49780	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:06.916230917 CET	49780	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:07.035875082 CET	22342	49780	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:07.858625889 CET	22342	49780	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:07.858757973 CET	49780	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:09.874408007 CET	49780	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:09.874697924 CET	49786	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:09.994016886 CET	22342	49780	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:09.994535923 CET	22342	49786	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:09.994658947 CET	49786	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:09.995358944 CET	49786	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:10.114898920 CET	22342	49786	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:10.115130901 CET	49786	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:10.234751940 CET	22342	49786	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:11.058911085 CET	22342	49786	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:11.059097052 CET	49786	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:13.061831951 CET	49786	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:13.062210083 CET	49797	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:13.181583881 CET	22342	49786	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:13.181771040 CET	22342	49797	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:13.181854010 CET	49797	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:13.182429075 CET	49797	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:13.301908016 CET	22342	49797	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:13.301987886 CET	49797	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:13.421623945 CET	22342	49797	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:14.262290001 CET	22342	49797	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:14.262360096 CET	49797	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:16.281040907 CET	49797	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:16.282618046 CET	49803	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:16.400648117 CET	22342	49797	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:16.402252913 CET	22342	49803	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:16.402358055 CET	49803	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:16.416323900 CET	49803	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:16.535758972 CET	22342	49803	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:16.535881042 CET	49803	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:16.655405045 CET	22342	49803	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:17.505769014 CET	22342	49803	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:17.506660938 CET	49803	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:19.638889074 CET	49803	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:19.639328003 CET	49809	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:19.758547068 CET	22342	49803	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:19.758882999 CET	22342	49809	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:19.758981943 CET	49809	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:19.765068054 CET	49809	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:19.884622097 CET	22342	49809	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:19.884722948 CET	49809	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:20.004336119 CET	22342	49809	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:20.004426956 CET	49809	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:20.124109983 CET	22342	49809	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:20.822928905 CET	22342	49809	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:20.823101044 CET	49809	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:22.827373028 CET	49809	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:22.839835882 CET	49821	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:22.947043896 CET	22342	49809	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:22.959438086 CET	22342	49821	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:22.959518909 CET	49821	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:22.960273027 CET	49821	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:23.079838991 CET	22342	49821	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:23.080235958 CET	49821	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:23.199882984 CET	22342	49821	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:24.024162054 CET	22342	49821	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:24.024234056 CET	49821	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:25.905648947 CET	49821	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:25.906061888 CET	49827	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:26.025372028 CET	22342	49821	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:26.025743961 CET	22342	49827	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:26.025840044 CET	49827	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:26.026530027 CET	49827	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:26.146842003 CET	22342	49827	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:26.146994114 CET	49827	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:26.266659975 CET	22342	49827	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:27.095182896 CET	22342	49827	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:27.095253944 CET	49827	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:28.843146086 CET	49827	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:28.843561888 CET	49838	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:28.962764978 CET	22342	49827	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:28.963238955 CET	22342	49838	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:28.963422060 CET	49838	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:28.964168072 CET	49838	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:29.083767891 CET	22342	49838	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:29.083848953 CET	49838	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:29.203748941 CET	22342	49838	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:30.031864882 CET	22342	49838	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:30.031948090 CET	49838	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:31.671307087 CET	49838	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:31.671605110 CET	49844	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:31.791295052 CET	22342	49838	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:31.791331053 CET	22342	49844	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:31.791479111 CET	49844	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:31.792460918 CET	49844	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:31.911959887 CET	22342	49844	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:31.912209988 CET	49844	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:32.032130957 CET	22342	49844	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:32.855138063 CET	22342	49844	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:32.855294943 CET	49844	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:34.374290943 CET	49844	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:34.374727011 CET	49850	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:34.494018078 CET	22342	49844	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:34.494201899 CET	22342	49850	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:34.494309902 CET	49850	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:34.495186090 CET	49850	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:34.614671946 CET	22342	49850	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:34.614794016 CET	49850	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:34.734442949 CET	22342	49850	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:35.558032990 CET	22342	49850	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:35.558106899 CET	49850	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:36.983581066 CET	49850	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:36.983999014 CET	49855	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:37.138780117 CET	22342	49850	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:37.138803005 CET	22342	49855	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:37.138988018 CET	49855	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:37.140389919 CET	49855	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:37.260123968 CET	22342	49855	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:37.260262012 CET	49855	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:37.379770041 CET	22342	49855	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:38.205540895 CET	22342	49855	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:38.205687046 CET	49855	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:39.530385017 CET	49855	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:39.530760050 CET	49864	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:39.649924040 CET	22342	49855	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:39.650249958 CET	22342	49864	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:39.650312901 CET	49864	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:39.651283979 CET	49864	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:39.770819902 CET	22342	49864	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:39.770921946 CET	49864	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:39.890491009 CET	22342	49864	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:40.719006062 CET	22342	49864	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:40.720160961 CET	49864	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:41.969252110 CET	49864	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:41.969839096 CET	49872	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:42.088836908 CET	22342	49864	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:42.089411974 CET	22342	49872	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:42.089551926 CET	49872	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:42.091237068 CET	49872	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:42.210880041 CET	22342	49872	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:42.210982084 CET	49872	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:42.331384897 CET	22342	49872	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:43.155756950 CET	22342	49872	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:43.155819893 CET	49872	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:44.311717033 CET	49872	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:44.312167883 CET	49878	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:44.431435108 CET	22342	49872	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:44.431647062 CET	22342	49878	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:44.431790113 CET	49878	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:44.432816982 CET	49878	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:44.552268982 CET	22342	49878	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:44.552963018 CET	49878	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:44.672534943 CET	22342	49878	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:45.495562077 CET	22342	49878	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:45.495784998 CET	49878	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:46.592888117 CET	49878	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:46.593285084 CET	49884	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:46.712629080 CET	22342	49878	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:46.712817907 CET	22342	49884	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:46.712881088 CET	49884	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:46.714076042 CET	49884	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:46.833548069 CET	22342	49884	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:46.833710909 CET	49884	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:46.953440905 CET	22342	49884	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:47.776396990 CET	22342	49884	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:47.776500940 CET	49884	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:48.780405998 CET	49884	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:48.780993938 CET	49890	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:48.900213957 CET	22342	49884	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:48.900846004 CET	22342	49890	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:48.900994062 CET	49890	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:48.940558910 CET	49890	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:49.060132027 CET	22342	49890	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:49.060343027 CET	49890	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:49.181072950 CET	22342	49890	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:49.968728065 CET	22342	49890	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:49.968811035 CET	49890	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:50.905436993 CET	49890	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:50.905895948 CET	49896	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:51.025170088 CET	22342	49890	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:51.025355101 CET	22342	49896	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:51.025437117 CET	49896	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:51.028646946 CET	49896	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:51.148185968 CET	22342	49896	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:51.148261070 CET	49896	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:51.269179106 CET	22342	49896	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:52.089844942 CET	22342	49896	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:52.089942932 CET	49896	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:52.967865944 CET	49896	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:52.968229055 CET	49902	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:53.087727070 CET	22342	49896	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:53.087762117 CET	22342	49902	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:53.087857962 CET	49902	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:53.088885069 CET	49902	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:53.208462000 CET	22342	49902	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:53.208601952 CET	49902	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:53.328232050 CET	22342	49902	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:54.152012110 CET	22342	49902	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:54.152139902 CET	49902	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:54.969032049 CET	49902	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:54.970489979 CET	49908	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:55.089617968 CET	22342	49902	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:55.090038061 CET	22342	49908	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:55.090214968 CET	49908	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:55.091465950 CET	49908	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:55.212065935 CET	22342	49908	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:55.216134071 CET	49908	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:55.336128950 CET	22342	49908	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:56.161418915 CET	22342	49908	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:56.161567926 CET	49908	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:56.938700914 CET	49908	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:56.939188004 CET	49911	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:57.058165073 CET	22342	49908	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:57.058654070 CET	22342	49911	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:57.058753967 CET	49911	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:57.059789896 CET	49911	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:57.181466103 CET	22342	49911	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:57.184169054 CET	49911	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:57.305675030 CET	22342	49911	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:58.128096104 CET	22342	49911	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:58.128369093 CET	49911	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:58.869865894 CET	49911	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:58.870666981 CET	49915	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:58.989384890 CET	22342	49911	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:58.990062952 CET	22342	49915	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:58.990132093 CET	49915	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:58.997569084 CET	49915	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:59.117111921 CET	22342	49915	167.71.56.116	192.168.2.5
Dec 24, 2024 03:43:59.117171049 CET	49915	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:43:59.236696005 CET	22342	49915	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:00.054264069 CET	22342	49915	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:00.054371119 CET	49915	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:00.717819929 CET	49915	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:00.718194962 CET	49921	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:00.881242990 CET	22342	49915	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:00.881268978 CET	22342	49921	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:00.881371975 CET	49921	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:00.883733988 CET	49921	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:01.003160954 CET	22342	49921	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:01.006220102 CET	49921	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:01.125720978 CET	22342	49921	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:01.945458889 CET	22342	49921	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:01.945534945 CET	49921	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:02.579387903 CET	49921	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:02.579668045 CET	49927	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:02.699028969 CET	22342	49921	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:02.699148893 CET	22342	49927	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:02.699261904 CET	49927	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:02.699784994 CET	49927	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:02.819353104 CET	22342	49927	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:02.819431067 CET	49927	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:02.938991070 CET	22342	49927	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:03.766463995 CET	22342	49927	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:03.766530991 CET	49927	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:04.366779089 CET	49927	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:04.367136955 CET	49932	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:04.486332893 CET	22342	49927	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:04.486572027 CET	22342	49932	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:04.486666918 CET	49932	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:04.487221956 CET	49932	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:04.606646061 CET	22342	49932	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:04.608205080 CET	49932	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:04.727710962 CET	22342	49932	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:05.554316998 CET	22342	49932	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:05.554378986 CET	49932	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:06.108398914 CET	49932	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:06.108691931 CET	49935	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:06.227837086 CET	22342	49932	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:06.228130102 CET	22342	49935	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:06.228267908 CET	49935	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:06.250790119 CET	49935	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:06.370342970 CET	22342	49935	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:06.370465994 CET	49935	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:06.489903927 CET	22342	49935	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:07.291582108 CET	22342	49935	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:07.291635036 CET	49935	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:07.803390980 CET	49935	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:07.803836107 CET	49940	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:07.922816038 CET	22342	49935	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:07.923347950 CET	22342	49940	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:07.923432112 CET	49940	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:07.924340010 CET	49940	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:08.045253038 CET	22342	49940	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:08.045372963 CET	49940	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:08.166344881 CET	22342	49940	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:09.014683962 CET	22342	49940	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:09.014770031 CET	49940	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:09.499275923 CET	49940	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:09.499646902 CET	49945	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:09.618772030 CET	22342	49940	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:09.619082928 CET	22342	49945	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:09.619148016 CET	49945	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:09.619729042 CET	49945	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:09.739223003 CET	22342	49945	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:09.739269018 CET	49945	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:09.858762980 CET	22342	49945	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:10.683661938 CET	22342	49945	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:10.684072971 CET	49945	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:11.124036074 CET	49945	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:11.124326944 CET	49948	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:11.467753887 CET	49945	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:11.468190908 CET	22342	49945	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:11.468205929 CET	22342	49948	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:11.468302011 CET	49948	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:11.468913078 CET	49948	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:11.587449074 CET	22342	49945	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:11.587563038 CET	49945	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:11.588325977 CET	22342	49948	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:11.588396072 CET	49948	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:11.707848072 CET	22342	49948	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:12.546797037 CET	22342	49948	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:12.546880960 CET	49948	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:12.967964888 CET	49948	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:12.968286037 CET	49954	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:13.087426901 CET	22342	49948	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:13.087750912 CET	22342	49954	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:13.087852955 CET	49954	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:13.088468075 CET	49954	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:13.207926035 CET	22342	49954	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:13.208074093 CET	49954	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:13.327548981 CET	22342	49954	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:14.151683092 CET	22342	49954	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:14.151746988 CET	49954	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:14.546009064 CET	49954	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:14.549663067 CET	49959	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:14.665676117 CET	22342	49954	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:14.669245005 CET	22342	49959	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:14.669517994 CET	49959	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:14.670028925 CET	49959	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:14.789513111 CET	22342	49959	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:14.789596081 CET	49959	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:14.909301043 CET	22342	49959	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:15.963793993 CET	22342	49959	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:15.964169025 CET	49959	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:16.337768078 CET	49959	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:16.338221073 CET	49961	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:16.457175970 CET	22342	49959	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:16.457688093 CET	22342	49961	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:16.457763910 CET	49961	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:16.458587885 CET	49961	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:16.578010082 CET	22342	49961	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:16.578118086 CET	49961	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:16.697623014 CET	22342	49961	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:17.521580935 CET	22342	49961	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:17.521728992 CET	49961	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:17.858381033 CET	49961	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:17.858678102 CET	49967	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:17.978024006 CET	22342	49961	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:17.978161097 CET	22342	49967	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:17.978243113 CET	49967	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:17.978837013 CET	49967	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:18.098349094 CET	22342	49967	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:18.100100040 CET	49967	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:18.219629049 CET	22342	49967	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:19.077261925 CET	22342	49967	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:19.080102921 CET	49967	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:19.405807972 CET	49967	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:19.406328917 CET	49973	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:19.525398016 CET	22342	49967	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:19.525752068 CET	22342	49973	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:19.525840044 CET	49973	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:19.527185917 CET	49973	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:19.646694899 CET	22342	49973	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:19.646779060 CET	49973	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:19.766843081 CET	22342	49973	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:20.592859983 CET	22342	49973	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:20.592982054 CET	49973	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:20.891470909 CET	49973	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:20.891858101 CET	49974	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:21.011076927 CET	22342	49973	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:21.011348963 CET	22342	49974	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:21.011451006 CET	49974	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:21.012032032 CET	49974	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:21.131475925 CET	22342	49974	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:21.132122993 CET	49974	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:21.251873016 CET	22342	49974	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:22.075711966 CET	22342	49974	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:22.078284979 CET	49974	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:22.358478069 CET	49974	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:22.358908892 CET	49980	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:22.478239059 CET	22342	49974	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:22.478526115 CET	22342	49980	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:22.478610039 CET	49980	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:22.479197025 CET	49980	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:22.598689079 CET	22342	49980	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:22.598901987 CET	49980	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:22.718530893 CET	22342	49980	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:23.541385889 CET	22342	49980	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:23.541455030 CET	49980	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:23.795850039 CET	49980	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:23.796154976 CET	49986	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:23.915385008 CET	22342	49980	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:23.915538073 CET	22342	49986	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:23.915606976 CET	49986	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:23.916274071 CET	49986	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:24.035830975 CET	22342	49986	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:24.035913944 CET	49986	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:24.155500889 CET	22342	49986	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:24.982942104 CET	22342	49986	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:24.983134031 CET	49986	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:25.233412027 CET	49986	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:25.233830929 CET	49987	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:25.352878094 CET	22342	49986	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:25.353322029 CET	22342	49987	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:25.353435993 CET	49987	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:25.354343891 CET	49987	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:25.473944902 CET	22342	49987	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:25.474494934 CET	49987	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:25.594022036 CET	22342	49987	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:26.421269894 CET	22342	49987	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:26.421375990 CET	49987	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:26.655389071 CET	49987	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:26.655692101 CET	49993	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:26.774980068 CET	22342	49987	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:26.775151014 CET	22342	49993	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:26.775235891 CET	49993	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:26.775851965 CET	49993	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:26.895364046 CET	22342	49993	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:26.895471096 CET	49993	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:27.015275955 CET	22342	49993	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:27.437638998 CET	49993	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:27.557092905 CET	22342	49993	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:27.839102983 CET	22342	49993	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:27.839204073 CET	49993	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:28.046984911 CET	49993	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:28.047246933 CET	49999	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:28.168653011 CET	22342	49993	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:28.168940067 CET	22342	49999	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:28.169019938 CET	49999	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:28.169641972 CET	49999	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:28.290437937 CET	22342	49999	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:28.290538073 CET	49999	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:28.411406040 CET	22342	49999	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:29.238157034 CET	22342	49999	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:29.238221884 CET	49999	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:29.436991930 CET	49999	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:29.438354015 CET	50000	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:29.557497978 CET	22342	49999	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:29.558182001 CET	22342	50000	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:29.558394909 CET	50000	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:29.558902025 CET	50000	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:29.678355932 CET	22342	50000	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:29.678492069 CET	50000	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:29.798079014 CET	22342	50000	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:30.634094000 CET	22342	50000	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:30.634160995 CET	50000	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:30.827193022 CET	50000	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:30.827491045 CET	50006	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:30.946856976 CET	22342	50000	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:30.947117090 CET	22342	50006	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:30.947201014 CET	50006	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:30.947858095 CET	50006	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:31.067392111 CET	22342	50006	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:31.067490101 CET	50006	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:31.187165022 CET	22342	50006	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:32.019258022 CET	22342	50006	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:32.020081997 CET	50006	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:32.202088118 CET	50006	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:32.202378035 CET	50008	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:32.321712017 CET	22342	50006	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:32.321839094 CET	22342	50008	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:32.321914911 CET	50008	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:32.322518110 CET	50008	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:32.441931963 CET	22342	50008	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:32.441988945 CET	50008	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:32.561561108 CET	22342	50008	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:33.386013985 CET	22342	50008	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:33.386089087 CET	50008	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:33.545881033 CET	50008	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:33.546261072 CET	50013	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:33.665461063 CET	22342	50008	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:33.665718079 CET	22342	50013	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:33.665803909 CET	50013	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:33.666667938 CET	50013	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:33.786231041 CET	22342	50013	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:33.786325932 CET	50013	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:33.905917883 CET	22342	50013	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:34.729979992 CET	22342	50013	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:34.730055094 CET	50013	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:34.893825054 CET	50013	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:34.894176006 CET	50018	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:35.013487101 CET	22342	50013	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:35.013623953 CET	22342	50018	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:35.013708115 CET	50018	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:35.014286995 CET	50018	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:35.133806944 CET	22342	50018	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:35.134107113 CET	50018	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:35.254729033 CET	22342	50018	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:35.345083952 CET	50018	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:35.464736938 CET	22342	50018	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:36.076786041 CET	22342	50018	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:36.078231096 CET	50018	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:36.217772961 CET	50018	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:36.219573021 CET	50020	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:36.337305069 CET	22342	50018	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:36.339054108 CET	22342	50020	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:36.339190960 CET	50020	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:36.339745045 CET	50020	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:36.459187031 CET	22342	50020	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:36.459271908 CET	50020	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:36.580610991 CET	22342	50020	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:37.406591892 CET	22342	50020	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:37.406671047 CET	50020	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:37.545984983 CET	50020	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:37.546225071 CET	50025	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:37.665575027 CET	22342	50020	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:37.665734053 CET	22342	50025	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:37.665939093 CET	50025	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:37.666445017 CET	50025	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:37.786123037 CET	22342	50025	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:37.786247969 CET	50025	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:37.905875921 CET	22342	50025	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:38.729310989 CET	22342	50025	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:38.729372025 CET	50025	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:38.869196892 CET	50025	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:38.869401932 CET	50029	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:38.988796949 CET	22342	50025	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:38.988900900 CET	22342	50029	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:38.988961935 CET	50029	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:38.989552021 CET	50029	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:39.109153986 CET	22342	50029	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:39.109252930 CET	50029	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:39.229212046 CET	22342	50029	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:40.052607059 CET	22342	50029	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:40.054177046 CET	50029	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:40.170871019 CET	50029	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:40.171219110 CET	50033	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:40.290417910 CET	22342	50029	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:40.290677071 CET	22342	50033	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:40.290760994 CET	50033	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:40.293838978 CET	50033	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:40.413345098 CET	22342	50033	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:40.413420916 CET	50033	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:40.532980919 CET	22342	50033	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:41.358712912 CET	22342	50033	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:41.358795881 CET	50033	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:41.467741013 CET	50033	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:41.468039036 CET	50035	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:41.587332964 CET	22342	50033	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:41.587503910 CET	22342	50035	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:41.587613106 CET	50035	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:41.588169098 CET	50035	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:41.707747936 CET	22342	50035	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:41.707843065 CET	50035	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:41.827362061 CET	22342	50035	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:41.827410936 CET	50035	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:41.946903944 CET	22342	50035	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:42.651595116 CET	22342	50035	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:42.651655912 CET	50035	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:42.749032021 CET	50035	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:42.749524117 CET	50036	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:42.868484974 CET	22342	50035	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:42.868944883 CET	22342	50036	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:42.869010925 CET	50036	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:42.869517088 CET	50036	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:43.033920050 CET	22342	50036	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:43.034010887 CET	50036	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:43.153506041 CET	22342	50036	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:43.999070883 CET	22342	50036	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:44.004107952 CET	50036	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:44.108323097 CET	50036	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:44.108577967 CET	50037	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:44.227823019 CET	22342	50036	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:44.228046894 CET	22342	50037	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:44.228136063 CET	50037	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:44.228764057 CET	50037	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:44.349155903 CET	22342	50037	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:44.349277020 CET	50037	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:44.471873999 CET	22342	50037	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:45.291857958 CET	22342	50037	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:45.292102098 CET	50037	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:45.398418903 CET	50037	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:45.399025917 CET	50038	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:45.518146038 CET	22342	50037	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:45.518580914 CET	22342	50038	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:45.518743038 CET	50038	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:45.519522905 CET	50038	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:45.639072895 CET	22342	50038	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:45.639291048 CET	50038	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:45.758961916 CET	22342	50038	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:46.548270941 CET	50038	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:46.582377911 CET	22342	50038	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:46.582511902 CET	50038	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:46.668946981 CET	22342	50038	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:46.670846939 CET	50038	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:46.671303988 CET	50039	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:46.702059984 CET	22342	50038	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:46.790605068 CET	22342	50038	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:46.790802002 CET	22342	50039	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:46.790899992 CET	50039	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:46.791498899 CET	50039	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:46.911032915 CET	22342	50039	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:46.911103964 CET	50039	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:47.030723095 CET	22342	50039	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:47.854635000 CET	22342	50039	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:47.854702950 CET	50039	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:47.939784050 CET	50039	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:47.940042019 CET	50040	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:48.059566975 CET	22342	50039	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:48.059608936 CET	22342	50040	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:48.059845924 CET	50040	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:48.060465097 CET	50040	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:48.180800915 CET	22342	50040	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:48.180895090 CET	50040	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:48.300663948 CET	22342	50040	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:49.127621889 CET	22342	50040	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:49.127744913 CET	50040	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:49.203008890 CET	50040	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:49.222783089 CET	50041	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:49.322731972 CET	22342	50040	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:49.343206882 CET	22342	50041	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:49.343328953 CET	50041	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:49.344441891 CET	50041	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:49.464066982 CET	22342	50041	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:49.464133024 CET	50041	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:49.583766937 CET	22342	50041	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:50.410413980 CET	22342	50041	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:50.410603046 CET	50041	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:50.483892918 CET	50041	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:50.484173059 CET	50042	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:50.603446960 CET	22342	50041	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:50.603730917 CET	22342	50042	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:50.603858948 CET	50042	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:50.604429960 CET	50042	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:50.724035978 CET	22342	50042	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:50.726485014 CET	50042	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:50.846122026 CET	22342	50042	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:51.666882992 CET	22342	50042	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:51.667067051 CET	50042	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:51.733372927 CET	50042	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:51.733705997 CET	50043	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:51.852963924 CET	22342	50042	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:51.853187084 CET	22342	50043	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:51.853359938 CET	50043	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:51.853880882 CET	50043	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:51.973289013 CET	22342	50043	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:51.973375082 CET	50043	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:52.093106031 CET	22342	50043	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:52.925816059 CET	22342	50043	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:52.926184893 CET	50043	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:52.983639956 CET	50043	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:52.983959913 CET	50044	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:53.103286028 CET	22342	50043	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:53.103764057 CET	22342	50044	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:53.103954077 CET	50044	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:53.104830980 CET	50044	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:53.225382090 CET	22342	50044	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:53.225526094 CET	50044	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:53.345149040 CET	22342	50044	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:53.468709946 CET	50044	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:53.588140965 CET	22342	50044	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:54.172200918 CET	22342	50044	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:54.176064014 CET	50044	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:54.233309031 CET	50044	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:54.233603954 CET	50045	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:54.352840900 CET	22342	50044	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:54.353071928 CET	22342	50045	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:54.353198051 CET	50045	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:54.353766918 CET	50045	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:54.473193884 CET	22342	50045	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:54.476049900 CET	50045	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:54.595638037 CET	22342	50045	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:55.421289921 CET	22342	50045	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:55.421411991 CET	50045	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:55.484869003 CET	50045	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:55.485161066 CET	50046	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:55.604578972 CET	22342	50045	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:55.604665041 CET	22342	50046	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:55.604737043 CET	50046	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:55.605731964 CET	50046	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:55.725368977 CET	22342	50046	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:55.725493908 CET	50046	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:55.845236063 CET	22342	50046	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:56.686033964 CET	22342	50046	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:56.690248966 CET	50046	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:56.749212980 CET	50046	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:56.751182079 CET	50047	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:56.868789911 CET	22342	50046	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:56.870688915 CET	22342	50047	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:56.874962091 CET	50047	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:56.875911951 CET	50047	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:56.995424032 CET	22342	50047	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:56.998230934 CET	50047	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:57.131597042 CET	22342	50047	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:57.342983007 CET	50047	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:57.462605000 CET	22342	50047	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:57.939362049 CET	22342	50047	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:57.939450026 CET	50047	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:57.983849049 CET	50047	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:57.984534979 CET	50048	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:58.103406906 CET	22342	50047	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:58.104085922 CET	22342	50048	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:58.104173899 CET	50048	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:58.104743004 CET	50048	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:58.224278927 CET	22342	50048	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:58.224404097 CET	50048	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:58.344135046 CET	22342	50048	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:58.673978090 CET	50048	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:58.793665886 CET	22342	50048	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:59.173089981 CET	22342	50048	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:59.173190117 CET	50048	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:59.217736959 CET	50048	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:59.218100071 CET	50049	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:59.337251902 CET	22342	50048	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:59.337553978 CET	22342	50049	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:59.337745905 CET	50049	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:59.338648081 CET	50049	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:59.458101988 CET	22342	50049	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:59.458317041 CET	50049	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:59.577872992 CET	22342	50049	167.71.56.116	192.168.2.5
Dec 24, 2024 03:44:59.718681097 CET	50049	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:44:59.838201046 CET	22342	50049	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:00.404632092 CET	22342	50049	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:00.404731989 CET	50049	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:00.452033997 CET	50049	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:00.452501059 CET	50050	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:00.571508884 CET	22342	50049	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:00.572053909 CET	22342	50050	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:00.576076031 CET	50050	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:00.577960968 CET	50050	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:00.697511911 CET	22342	50050	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:00.697572947 CET	50050	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:00.817226887 CET	22342	50050	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:01.649081945 CET	22342	50050	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:01.650233984 CET	50050	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:01.686434984 CET	50050	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:01.690104008 CET	50051	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:01.806016922 CET	22342	50050	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:01.809631109 CET	22342	50051	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:01.810431957 CET	50051	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:01.811232090 CET	50051	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:01.930838108 CET	22342	50051	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:01.932106972 CET	50051	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:02.051788092 CET	22342	50051	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:02.573559046 CET	50051	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:02.693471909 CET	22342	50051	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:02.874141932 CET	22342	50051	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:02.874233961 CET	50051	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:02.920784950 CET	50051	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:02.921184063 CET	50052	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:03.040323973 CET	22342	50051	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:03.040610075 CET	22342	50052	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:03.040688992 CET	50052	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:03.041537046 CET	50052	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:03.160970926 CET	22342	50052	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:03.161151886 CET	50052	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:03.280670881 CET	22342	50052	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:03.282063007 CET	50052	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:03.401525974 CET	22342	50052	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:04.112489939 CET	22342	50052	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:04.114433050 CET	50052	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:04.155739069 CET	50052	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:04.158307076 CET	50053	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:04.275418997 CET	22342	50052	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:04.277761936 CET	22342	50053	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:04.277913094 CET	50053	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:04.278873920 CET	50053	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:04.398396015 CET	22342	50053	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:04.398488045 CET	50053	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:04.517999887 CET	22342	50053	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:05.351277113 CET	22342	50053	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:05.351394892 CET	50053	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:05.389653921 CET	50053	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:05.390595913 CET	50054	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:05.509376049 CET	22342	50053	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:05.510309935 CET	22342	50054	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:05.511006117 CET	50054	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:05.512106895 CET	50054	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:05.631495953 CET	22342	50054	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:05.631737947 CET	50054	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:05.751251936 CET	22342	50054	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:06.575464010 CET	22342	50054	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:06.575527906 CET	50054	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:06.609211922 CET	50054	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:06.612416983 CET	50055	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:06.728904009 CET	22342	50054	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:06.731964111 CET	22342	50055	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:06.732048035 CET	50055	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:06.733095884 CET	50055	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:06.852551937 CET	22342	50055	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:06.852650881 CET	50055	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:06.972198963 CET	22342	50055	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:07.808325052 CET	22342	50055	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:07.810126066 CET	50055	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:07.842796087 CET	50055	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:07.843280077 CET	50056	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:07.962543011 CET	22342	50055	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:07.962810993 CET	22342	50056	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:07.962923050 CET	50056	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:07.963716984 CET	50056	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:08.083416939 CET	22342	50056	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:08.083492994 CET	50056	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:08.203130007 CET	22342	50056	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:09.028553963 CET	22342	50056	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:09.028677940 CET	50056	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:09.062933922 CET	50056	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:09.063316107 CET	50057	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:09.261548042 CET	22342	50056	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:09.261600971 CET	22342	50057	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:09.261749983 CET	50057	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:09.262684107 CET	50057	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:09.384536028 CET	22342	50057	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:09.384654999 CET	50057	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:09.504390001 CET	22342	50057	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:10.328217983 CET	22342	50057	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:10.328285933 CET	50057	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:10.359973907 CET	50057	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:10.362358093 CET	50058	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:10.479680061 CET	22342	50057	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:10.481987000 CET	22342	50058	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:10.482086897 CET	50058	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:10.482980013 CET	50058	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:10.602565050 CET	22342	50058	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:10.602766037 CET	50058	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:10.722465992 CET	22342	50058	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:11.549957991 CET	22342	50058	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:11.550219059 CET	50058	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:11.580199003 CET	50058	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:11.580586910 CET	50059	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:11.699743032 CET	22342	50058	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:11.700026989 CET	22342	50059	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:11.700103998 CET	50059	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:11.706340075 CET	50059	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:11.825974941 CET	22342	50059	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:11.828125000 CET	50059	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:11.947860956 CET	22342	50059	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:12.764564991 CET	22342	50059	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:12.764651060 CET	50059	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:12.795761108 CET	50059	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:12.796113014 CET	50060	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:12.915416956 CET	22342	50059	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:12.915601015 CET	22342	50060	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:12.915750027 CET	50060	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:12.916822910 CET	50060	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:13.036281109 CET	22342	50060	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:13.040040016 CET	50060	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:13.159585953 CET	22342	50060	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:13.983272076 CET	22342	50060	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:13.983364105 CET	50060	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:14.014692068 CET	50060	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:14.039658070 CET	50061	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:14.134306908 CET	22342	50060	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:14.159231901 CET	22342	50061	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:14.159331083 CET	50061	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:14.160162926 CET	50061	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:14.279706955 CET	22342	50061	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:14.279803991 CET	50061	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:14.399386883 CET	22342	50061	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:15.223442078 CET	22342	50061	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:15.223592997 CET	50061	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:15.374366999 CET	50061	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:15.374793053 CET	50062	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:15.494019985 CET	22342	50061	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:15.494306087 CET	22342	50062	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:15.494381905 CET	50062	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:15.498213053 CET	50062	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:15.617902040 CET	22342	50062	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:15.617969990 CET	50062	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:15.737662077 CET	22342	50062	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:16.562777996 CET	22342	50062	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:16.564068079 CET	50062	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:16.592611074 CET	50062	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:16.592905045 CET	50063	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:16.712263107 CET	22342	50062	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:16.712433100 CET	22342	50063	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:16.712764978 CET	50063	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:16.715584993 CET	50063	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:16.835139036 CET	22342	50063	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:16.837263107 CET	50063	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:16.957133055 CET	22342	50063	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:17.780714035 CET	22342	50063	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:17.780795097 CET	50063	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:17.795870066 CET	50063	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:17.796376944 CET	50064	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:17.915492058 CET	22342	50063	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:17.915919065 CET	22342	50064	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:17.916074038 CET	50064	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:17.916877985 CET	50064	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:18.036520958 CET	22342	50064	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:18.036619902 CET	50064	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:18.156294107 CET	22342	50064	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:18.982906103 CET	22342	50064	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:18.984028101 CET	50064	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:18.998847961 CET	50064	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:19.000766993 CET	50065	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:19.118489981 CET	22342	50064	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:19.120383024 CET	22342	50065	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:19.124008894 CET	50065	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:19.124610901 CET	50065	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:19.244129896 CET	22342	50065	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:19.244266987 CET	50065	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:19.363874912 CET	22342	50065	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:20.186839104 CET	22342	50065	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:20.186912060 CET	50065	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:20.202523947 CET	50065	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:20.204206944 CET	50066	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:20.322135925 CET	22342	50065	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:20.323787928 CET	22342	50066	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:20.323858976 CET	50066	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:20.327950001 CET	50066	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:20.447652102 CET	22342	50066	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:20.447776079 CET	50066	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:20.567421913 CET	22342	50066	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:20.567493916 CET	50066	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:20.687127113 CET	22342	50066	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:21.388793945 CET	22342	50066	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:21.392023087 CET	50066	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:21.405085087 CET	50066	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:21.405359030 CET	50067	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:21.524657965 CET	22342	50066	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:21.524976015 CET	22342	50067	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:21.525118113 CET	50067	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:21.525677919 CET	50067	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:21.645272017 CET	22342	50067	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:21.645363092 CET	50067	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:21.765176058 CET	22342	50067	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:22.593254089 CET	22342	50067	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:22.593396902 CET	50067	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:22.642764091 CET	50067	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:22.643177986 CET	50068	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:22.762563944 CET	22342	50067	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:22.762712955 CET	22342	50068	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:22.762864113 CET	50068	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:22.769407034 CET	50068	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:22.889097929 CET	22342	50068	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:22.889349937 CET	50068	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:23.009185076 CET	22342	50068	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:23.835278988 CET	22342	50068	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:23.835438967 CET	50068	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:23.858442068 CET	50068	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:23.858706951 CET	50069	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:23.978169918 CET	22342	50068	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:23.978295088 CET	22342	50069	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:23.978367090 CET	50069	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:23.979394913 CET	50069	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:24.172465086 CET	22342	50069	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:24.172521114 CET	50069	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:24.294640064 CET	22342	50069	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:25.117381096 CET	22342	50069	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:25.120093107 CET	50069	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:25.139576912 CET	50069	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:25.139831066 CET	50070	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:25.259129047 CET	22342	50069	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:25.259344101 CET	22342	50070	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:25.259612083 CET	50070	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:25.260034084 CET	50070	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:25.379621983 CET	22342	50070	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:25.379920006 CET	50070	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:25.499639988 CET	22342	50070	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:26.327482939 CET	22342	50070	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:26.327625036 CET	50070	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:26.342953920 CET	50070	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:26.346859932 CET	50071	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:26.462532043 CET	22342	50070	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:26.466454983 CET	22342	50071	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:26.466686964 CET	50071	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:26.467431068 CET	50071	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:26.586913109 CET	22342	50071	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:26.586973906 CET	50071	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:26.709131956 CET	22342	50071	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:27.531819105 CET	22342	50071	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:27.531946898 CET	50071	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:27.545718908 CET	50071	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:27.546051025 CET	50072	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:27.665426970 CET	22342	50071	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:27.665640116 CET	22342	50072	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:27.665790081 CET	50072	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:27.666433096 CET	50072	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:27.785948038 CET	22342	50072	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:27.786191940 CET	50072	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:27.906671047 CET	22342	50072	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:28.731231928 CET	22342	50072	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:28.731465101 CET	50072	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:28.748867989 CET	50072	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:28.749185085 CET	50073	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:28.869826078 CET	22342	50072	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:28.869877100 CET	22342	50073	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:28.870085955 CET	50073	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:28.870497942 CET	50073	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:28.991893053 CET	22342	50073	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:28.991986036 CET	50073	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:29.111886978 CET	22342	50073	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:29.937962055 CET	22342	50073	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:29.938150883 CET	50073	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:29.951961040 CET	50073	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:29.952275991 CET	50074	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:30.072463036 CET	22342	50073	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:30.072501898 CET	22342	50074	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:30.072622061 CET	50074	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:30.073173046 CET	50074	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:30.192754984 CET	22342	50074	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:30.192992926 CET	50074	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:30.312665939 CET	22342	50074	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:31.136800051 CET	22342	50074	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:31.136874914 CET	50074	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:31.155085087 CET	50074	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:31.155410051 CET	50075	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:31.274688005 CET	22342	50074	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:31.275029898 CET	22342	50075	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:31.275106907 CET	50075	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:31.275705099 CET	50075	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:31.395246983 CET	22342	50075	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:31.395328045 CET	50075	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:31.515043974 CET	22342	50075	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:32.346652031 CET	22342	50075	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:32.346760988 CET	50075	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:32.358357906 CET	50075	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:32.358793974 CET	50076	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:32.478012085 CET	22342	50075	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:32.478394032 CET	22342	50076	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:32.478540897 CET	50076	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:32.479053974 CET	50076	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:32.599924088 CET	22342	50076	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:32.600071907 CET	50076	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:32.719701052 CET	22342	50076	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:33.542802095 CET	22342	50076	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:33.542865038 CET	50076	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:33.561359882 CET	50076	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:33.561634064 CET	50077	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:33.681072950 CET	22342	50076	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:33.681220055 CET	22342	50077	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:33.681299925 CET	50077	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:33.681804895 CET	50077	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:33.801331043 CET	22342	50077	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:33.801481009 CET	50077	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:33.921083927 CET	22342	50077	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:34.748887062 CET	22342	50077	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:34.750044107 CET	50077	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:34.764467955 CET	50077	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:34.764831066 CET	50078	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:34.884047031 CET	22342	50077	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:34.884371996 CET	22342	50078	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:34.884455919 CET	50078	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:34.885339975 CET	50078	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:35.004843950 CET	22342	50078	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:35.006031990 CET	50078	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:35.358202934 CET	50078	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:35.367522001 CET	22342	50078	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:35.483576059 CET	22342	50078	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:35.955367088 CET	22342	50078	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:35.955502033 CET	50078	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:35.967876911 CET	50078	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:35.967880964 CET	50079	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:36.087544918 CET	22342	50078	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:36.087603092 CET	22342	50079	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:36.087676048 CET	50079	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:36.088414907 CET	50079	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:36.208044052 CET	22342	50079	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:36.208158970 CET	50079	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:36.328075886 CET	22342	50079	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:37.155668020 CET	22342	50079	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:37.155783892 CET	50079	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:37.170721054 CET	50079	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:37.170991898 CET	50080	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:37.313994884 CET	22342	50079	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:37.314023018 CET	22342	50080	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:37.314100981 CET	50080	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:37.314723015 CET	50080	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:37.437596083 CET	22342	50080	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:37.437720060 CET	50080	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:37.557647943 CET	22342	50080	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:38.428632021 CET	22342	50080	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:38.428709984 CET	50080	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:38.436316013 CET	50080	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:38.436865091 CET	50081	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:38.555880070 CET	22342	50080	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:38.556471109 CET	22342	50081	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:38.556587934 CET	50081	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:38.559295893 CET	50081	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:38.679003000 CET	22342	50081	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:38.679136992 CET	50081	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:38.799030066 CET	22342	50081	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:39.624435902 CET	22342	50081	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:39.624526978 CET	50081	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:39.639427900 CET	50081	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:39.641593933 CET	50082	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:39.759198904 CET	22342	50081	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:39.761265039 CET	22342	50082	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:39.761396885 CET	50082	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:39.762034893 CET	50082	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:39.881551981 CET	22342	50082	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:39.881680965 CET	50082	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:40.001351118 CET	22342	50082	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:40.825606108 CET	22342	50082	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:40.825675964 CET	50082	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:40.843744993 CET	50082	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:40.844074011 CET	50083	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:40.964390993 CET	22342	50082	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:40.964432001 CET	22342	50083	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:40.964550018 CET	50083	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:40.965122938 CET	50083	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:41.085038900 CET	22342	50083	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:41.085115910 CET	50083	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:41.205853939 CET	22342	50083	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:42.032124996 CET	22342	50083	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:42.032248020 CET	50083	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:42.045722008 CET	50083	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:42.046055079 CET	50084	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:42.166055918 CET	22342	50083	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:42.166249037 CET	22342	50084	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:42.166321993 CET	50084	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:42.167155027 CET	50084	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:42.286703110 CET	22342	50084	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:42.287986040 CET	50084	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:42.407618999 CET	22342	50084	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:43.233848095 CET	22342	50084	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:43.236021042 CET	50084	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:43.248895884 CET	50084	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:43.249108076 CET	50085	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:43.368508101 CET	22342	50084	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:43.368649960 CET	22342	50085	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:43.368846893 CET	50085	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:43.369375944 CET	50085	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:43.488909006 CET	22342	50085	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:43.489011049 CET	50085	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:43.608628988 CET	22342	50085	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:44.432182074 CET	22342	50085	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:44.432377100 CET	50085	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:44.436302900 CET	50085	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:44.436610937 CET	50086	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:44.556035042 CET	22342	50085	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:44.556123972 CET	22342	50086	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:44.556215048 CET	50086	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:44.556777954 CET	50086	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:44.676320076 CET	22342	50086	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:44.676377058 CET	50086	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:44.796125889 CET	22342	50086	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:45.125637054 CET	50086	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:45.245551109 CET	22342	50086	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:45.644686937 CET	22342	50086	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:45.644784927 CET	50086	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:45.655046940 CET	50086	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:45.655345917 CET	50087	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:45.774607897 CET	22342	50086	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:45.774920940 CET	22342	50087	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:45.774993896 CET	50087	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:45.775907040 CET	50087	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:45.895417929 CET	22342	50087	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:45.895493984 CET	50087	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:46.015161991 CET	22342	50087	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:46.848474026 CET	22342	50087	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:46.852081060 CET	50087	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:46.858207941 CET	50087	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:46.858604908 CET	50088	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:46.977802038 CET	22342	50087	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:46.978116035 CET	22342	50088	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:46.978238106 CET	50088	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:46.978825092 CET	50088	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:47.098383904 CET	22342	50088	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:47.099997044 CET	50088	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:47.219600916 CET	22342	50088	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:48.045624018 CET	22342	50088	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:48.045728922 CET	50088	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:48.061297894 CET	50088	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:48.061599016 CET	50089	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:48.181031942 CET	22342	50088	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:48.181185007 CET	22342	50089	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:48.181271076 CET	50089	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:48.183546066 CET	50089	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:48.303886890 CET	22342	50089	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:48.304044008 CET	50089	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:48.424058914 CET	22342	50089	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:49.249043941 CET	22342	50089	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:49.249135017 CET	50089	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:49.264400959 CET	50089	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:49.267911911 CET	50090	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:49.462009907 CET	22342	50089	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:49.462060928 CET	22342	50090	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:49.462160110 CET	50090	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:49.462883949 CET	50090	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:49.583386898 CET	22342	50090	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:49.583487988 CET	50090	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:49.703089952 CET	22342	50090	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:50.529417038 CET	22342	50090	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:50.529489994 CET	50090	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:50.546138048 CET	50090	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:50.547525883 CET	50091	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:50.665715933 CET	22342	50090	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:50.667109966 CET	22342	50091	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:50.667205095 CET	50091	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:50.670000076 CET	50091	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:50.789602995 CET	22342	50091	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:50.789678097 CET	50091	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:50.909362078 CET	22342	50091	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:51.731445074 CET	22342	50091	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:51.731564999 CET	50091	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:51.757628918 CET	50091	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:51.757982969 CET	50092	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:51.877285957 CET	22342	50091	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:51.877490997 CET	22342	50092	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:51.877623081 CET	50092	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:51.878338099 CET	50092	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:51.997806072 CET	22342	50092	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:51.999994040 CET	50092	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:52.119519949 CET	22342	50092	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:52.359879971 CET	50092	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:52.479522943 CET	22342	50092	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:52.942560911 CET	22342	50092	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:52.942679882 CET	50092	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:52.952019930 CET	50092	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:52.952368975 CET	50093	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:53.071482897 CET	22342	50092	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:53.071825981 CET	22342	50093	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:53.071916103 CET	50093	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:53.072427034 CET	50093	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:53.191888094 CET	22342	50093	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:53.191939116 CET	50093	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:53.311523914 CET	22342	50093	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:54.135561943 CET	22342	50093	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:54.135907888 CET	50093	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:54.139666080 CET	50093	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:54.165019989 CET	50094	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:54.259253025 CET	22342	50093	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:54.284679890 CET	22342	50094	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:54.284765005 CET	50094	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:54.285285950 CET	50094	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:54.404870987 CET	22342	50094	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:54.404987097 CET	50094	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:54.524544001 CET	22342	50094	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:55.353247881 CET	22342	50094	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:55.356036901 CET	50094	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:55.358139038 CET	50094	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:55.358463049 CET	50095	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:55.477803946 CET	22342	50094	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:55.478017092 CET	22342	50095	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:55.478087902 CET	50095	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:55.478699923 CET	50095	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:55.598201036 CET	22342	50095	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:55.599982023 CET	50095	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:55.719579935 CET	22342	50095	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:56.541286945 CET	22342	50095	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:56.541378021 CET	50095	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:56.545701981 CET	50095	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:56.546148062 CET	50096	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:56.665239096 CET	22342	50095	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:56.665704966 CET	22342	50096	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:56.665807962 CET	50096	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:56.666629076 CET	50096	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:56.786171913 CET	22342	50096	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:56.786250114 CET	50096	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:56.908670902 CET	22342	50096	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:57.729933977 CET	22342	50096	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:57.730073929 CET	50096	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:57.733144045 CET	50096	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:57.733424902 CET	50097	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:57.852756023 CET	22342	50096	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:57.852948904 CET	22342	50097	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:57.853030920 CET	50097	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:57.853579998 CET	50097	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:57.974159956 CET	22342	50097	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:57.974220037 CET	50097	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:58.093936920 CET	22342	50097	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:58.918433905 CET	22342	50097	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:58.918633938 CET	50097	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:58.920650959 CET	50097	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:58.920959949 CET	50098	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:59.040117025 CET	22342	50097	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:59.040497065 CET	22342	50098	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:59.040608883 CET	50098	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:59.041214943 CET	50098	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:59.160763025 CET	22342	50098	167.71.56.116	192.168.2.5
Dec 24, 2024 03:45:59.160866022 CET	50098	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:45:59.280479908 CET	22342	50098	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:00.107825041 CET	22342	50098	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:00.107970953 CET	50098	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:00.123852015 CET	50098	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:00.124043941 CET	50099	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:00.244044065 CET	22342	50098	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:00.244098902 CET	22342	50099	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:00.244235039 CET	50099	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:00.251801968 CET	50099	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:00.371536016 CET	22342	50099	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:00.371773958 CET	50099	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:00.491539001 CET	22342	50099	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:01.307868004 CET	22342	50099	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:01.307982922 CET	50099	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:01.311336040 CET	50099	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:01.311676025 CET	50100	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:01.432131052 CET	22342	50099	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:01.432408094 CET	22342	50100	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:01.432472944 CET	50100	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:01.433418036 CET	50100	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:01.554270983 CET	22342	50100	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:01.554399014 CET	50100	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:01.674227953 CET	22342	50100	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:02.176703930 CET	50100	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:02.364957094 CET	22342	50100	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:02.499583006 CET	22342	50100	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:02.499982119 CET	50100	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:02.514422894 CET	50100	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:02.514698029 CET	50101	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:02.637821913 CET	22342	50100	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:02.637864113 CET	22342	50101	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:02.637958050 CET	50101	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:02.638499022 CET	50101	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:02.758971930 CET	22342	50101	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:02.759057999 CET	50101	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:02.879395008 CET	22342	50101	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:03.707940102 CET	22342	50101	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:03.708009005 CET	50101	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:03.717900038 CET	50101	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:03.718190908 CET	50102	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:03.837451935 CET	22342	50101	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:03.837676048 CET	22342	50102	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:03.837770939 CET	50102	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:03.838310003 CET	50102	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:03.957900047 CET	22342	50102	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:03.958004951 CET	50102	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:04.077631950 CET	22342	50102	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:04.902367115 CET	22342	50102	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:04.906099081 CET	50102	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:04.920630932 CET	50102	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:04.920993090 CET	50103	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:05.040158033 CET	22342	50102	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:05.040519953 CET	22342	50103	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:05.040657043 CET	50103	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:05.041529894 CET	50103	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:05.161096096 CET	22342	50103	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:05.162060976 CET	50103	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:05.281707048 CET	22342	50103	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:06.106869936 CET	22342	50103	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:06.106941938 CET	50103	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:06.123796940 CET	50103	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:06.124386072 CET	50104	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:06.243371964 CET	22342	50103	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:06.243889093 CET	22342	50104	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:06.243988991 CET	50104	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:06.244539976 CET	50104	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:06.365154982 CET	22342	50104	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:06.366180897 CET	50104	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:06.486392975 CET	22342	50104	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:07.312721014 CET	22342	50104	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:07.314114094 CET	50104	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:07.326977968 CET	50104	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:07.327167988 CET	50105	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:07.446603060 CET	22342	50104	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:07.446657896 CET	22342	50105	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:07.446744919 CET	50105	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:07.447304964 CET	50105	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:07.566911936 CET	22342	50105	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:07.568262100 CET	50105	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:07.687926054 CET	22342	50105	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:08.515688896 CET	22342	50105	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:08.515805960 CET	50105	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:08.530051947 CET	50105	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:08.530464888 CET	50106	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:08.649682045 CET	22342	50105	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:08.650001049 CET	22342	50106	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:08.650080919 CET	50106	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:08.650804996 CET	50106	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:08.770337105 CET	22342	50106	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:08.770462990 CET	50106	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:08.890114069 CET	22342	50106	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:09.755903959 CET	22342	50106	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:09.756027937 CET	50106	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:09.764414072 CET	50106	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:09.764728069 CET	50107	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:09.885561943 CET	22342	50106	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:09.885656118 CET	22342	50107	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:09.885795116 CET	50107	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:09.886639118 CET	50107	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:10.007683992 CET	22342	50107	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:10.008033037 CET	50107	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:10.129405975 CET	22342	50107	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:10.523202896 CET	50107	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:10.643198013 CET	22342	50107	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:10.954551935 CET	22342	50107	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:10.954646111 CET	50107	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:10.967535973 CET	50107	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:10.967947960 CET	50108	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:11.087187052 CET	22342	50107	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:11.087488890 CET	22342	50108	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:11.087567091 CET	50108	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:11.088603020 CET	50108	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:11.208139896 CET	22342	50108	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:11.208288908 CET	50108	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:11.328018904 CET	22342	50108	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:12.152261972 CET	22342	50108	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:12.154129028 CET	50108	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:12.170708895 CET	50108	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:12.171086073 CET	50109	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:12.290332079 CET	22342	50108	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:12.290633917 CET	22342	50109	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:12.290806055 CET	50109	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:12.291593075 CET	50109	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:12.411149025 CET	22342	50109	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:12.411222935 CET	50109	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:12.530920029 CET	22342	50109	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:13.357316971 CET	22342	50109	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:13.357430935 CET	50109	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:13.373821974 CET	50109	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:13.377624989 CET	50110	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:13.493406057 CET	22342	50109	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:13.497208118 CET	22342	50110	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:13.497345924 CET	50110	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:13.513077974 CET	50110	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:13.632855892 CET	22342	50110	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:13.632968903 CET	50110	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:13.752651930 CET	22342	50110	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:14.565586090 CET	22342	50110	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:14.568028927 CET	50110	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:14.570333958 CET	50110	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:14.570899963 CET	50111	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:14.690097094 CET	22342	50110	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:14.690432072 CET	22342	50111	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:14.690515041 CET	50111	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:14.691427946 CET	50111	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:14.811042070 CET	22342	50111	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:14.811105013 CET	50111	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:14.931128979 CET	22342	50111	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:15.754221916 CET	22342	50111	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:15.755980968 CET	50111	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:15.756320953 CET	50111	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:15.758826971 CET	50112	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:15.875998974 CET	22342	50111	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:15.878457069 CET	22342	50112	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:15.878608942 CET	50112	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:15.879354000 CET	50112	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:15.998982906 CET	22342	50112	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:15.999953985 CET	50112	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:16.119785070 CET	22342	50112	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:16.946835041 CET	22342	50112	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:16.947002888 CET	50112	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:16.949232101 CET	50112	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:16.949600935 CET	50113	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:17.068979979 CET	22342	50112	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:17.069127083 CET	22342	50113	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:17.069261074 CET	50113	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:17.070069075 CET	50113	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:17.189757109 CET	22342	50113	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:17.189934969 CET	50113	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:17.309830904 CET	22342	50113	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:18.139039993 CET	22342	50113	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:18.139148951 CET	50113	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:18.139276981 CET	50113	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:18.142887115 CET	50114	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:18.259093046 CET	22342	50113	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:18.262478113 CET	22342	50114	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:18.262598991 CET	50114	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:18.266432047 CET	50114	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:18.386171103 CET	22342	50114	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:18.386286974 CET	50114	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:18.506056070 CET	22342	50114	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:18.506143093 CET	50114	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:18.625694036 CET	22342	50114	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:19.326628923 CET	22342	50114	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:19.326778889 CET	50114	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:19.326927900 CET	50114	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:19.327274084 CET	50115	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:19.446568966 CET	22342	50114	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:19.446857929 CET	22342	50115	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:19.447021008 CET	50115	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:19.447943926 CET	50115	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:19.567507029 CET	22342	50115	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:19.572040081 CET	50115	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:19.691673994 CET	22342	50115	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:20.511085033 CET	22342	50115	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:20.511172056 CET	50115	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:20.512021065 CET	50115	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:20.516750097 CET	50116	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:20.631587982 CET	22342	50115	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:20.636368990 CET	22342	50116	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:20.636557102 CET	50116	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:20.637358904 CET	50116	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:20.756866932 CET	22342	50116	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:20.757045031 CET	50116	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:20.877578020 CET	22342	50116	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:21.163214922 CET	50116	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:21.282834053 CET	22342	50116	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:21.705096960 CET	22342	50116	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:21.706315994 CET	50116	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:21.706515074 CET	50116	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:21.706892967 CET	50117	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:21.826015949 CET	22342	50116	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:21.826407909 CET	22342	50117	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:21.826488018 CET	50117	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:21.827327013 CET	50117	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:21.946840048 CET	22342	50117	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:21.950720072 CET	50117	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:22.070409060 CET	22342	50117	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:22.891395092 CET	22342	50117	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:22.891540051 CET	50117	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:22.892093897 CET	50117	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:22.892400980 CET	50118	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:23.011573076 CET	22342	50117	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:23.011928082 CET	22342	50118	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:23.012012959 CET	50118	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:23.012599945 CET	50118	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:23.132134914 CET	22342	50118	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:23.132344961 CET	50118	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:23.251975060 CET	22342	50118	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:24.084656954 CET	22342	50118	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:24.084759951 CET	50118	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:24.086561918 CET	50118	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:24.087002993 CET	50119	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:24.206176996 CET	22342	50118	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:24.206587076 CET	22342	50119	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:24.206810951 CET	50119	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:24.207496881 CET	50119	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:24.327179909 CET	22342	50119	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:24.327279091 CET	50119	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:24.447052002 CET	22342	50119	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:25.276141882 CET	22342	50119	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:25.276281118 CET	50119	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:25.276921988 CET	50119	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:25.280098915 CET	50120	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:25.398339987 CET	22342	50119	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:25.401637077 CET	22342	50120	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:25.401735067 CET	50120	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:25.402622938 CET	50120	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:25.522100925 CET	22342	50120	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:25.522195101 CET	50120	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:25.641849995 CET	22342	50120	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:26.493707895 CET	22342	50120	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:26.495969057 CET	50120	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:26.498759031 CET	50120	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:26.499186039 CET	50121	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:26.618320942 CET	22342	50120	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:26.618710041 CET	22342	50121	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:26.618879080 CET	50121	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:26.619599104 CET	50121	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:26.739218950 CET	22342	50121	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:26.742254019 CET	50121	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:26.861965895 CET	22342	50121	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:27.442554951 CET	50121	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:27.562171936 CET	22342	50121	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:27.685966015 CET	22342	50121	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:27.686242104 CET	50121	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:27.686511040 CET	50121	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:27.686912060 CET	50122	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:27.806207895 CET	22342	50121	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:27.806410074 CET	22342	50122	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:27.806610107 CET	50122	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:27.807152987 CET	50122	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:27.926763058 CET	22342	50122	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:27.926902056 CET	50122	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:28.047100067 CET	22342	50122	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:28.870069027 CET	22342	50122	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:28.871985912 CET	50122	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:28.873403072 CET	50122	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:28.873765945 CET	50123	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:28.993019104 CET	22342	50122	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:28.993305922 CET	22342	50123	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:28.993424892 CET	50123	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:28.994041920 CET	50123	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:29.113656998 CET	22342	50123	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:29.113749027 CET	50123	22342	192.168.2.5	167.71.56.116
Dec 24, 2024 03:46:29.311219931 CET	22342	50123	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:30.061492920 CET	22342	50123	167.71.56.116	192.168.2.5
Dec 24, 2024 03:46:30.061943054 CET	50123	22342	192.168.2.5	167.71.56.116

Target ID:	0
Start time:	21:42:22
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\a1K847qsM0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\a1K847qsM0.exe"
Imagebase:	0xd20000
File size:	95'232 bytes
MD5 hash:	55E2016FCB659BDF0F46A24EF2876609
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.2090087518.0000000004458000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.2063530458.0000000000D22000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:42:23
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\server.exe"
Imagebase:	0xf0000
File size:	95'232 bytes
MD5 hash:	55E2016FCB659BDF0F46A24EF2876609
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000002.00000002.4534386921.00000000026E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Florian Roth Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Sekoia.io Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	21:42:26
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:42:26
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:42:28
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall delete allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe"
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:42:28
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:42:28
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:42:28
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:42:41
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe"
Imagebase:	0x9c0000
File size:	95'232 bytes
MD5 hash:	55E2016FCB659BDF0F46A24EF2876609
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: Florian Roth Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: Sekoia.io Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:42:42
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe"
Imagebase:	0xc70000
File size:	95'232 bytes
MD5 hash:	55E2016FCB659BDF0F46A24EF2876609
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:42:50
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe"
Imagebase:	0xd20000
File size:	95'232 bytes
MD5 hash:	55E2016FCB659BDF0F46A24EF2876609
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:42:58
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe"
Imagebase:	0xed0000
File size:	95'232 bytes
MD5 hash:	55E2016FCB659BDF0F46A24EF2876609
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Sekoia.io Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	58
Total number of Limit Nodes:	4

Executed Functions

Function 018E4298 Relevance: 3.2, Strings: 1, Instructions: 1950
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 018E4C24

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 90d965ee7b5fb50a6b1766fc8ab278809be6dd5706e0db9fcdc3a483820e1950
Instruction ID: 1a89b326751c7377224fcf809f5078147a8f3b9ebe2f743308e6faf7ea91642d
Opcode Fuzzy Hash: 90d965ee7b5fb50a6b1766fc8ab278809be6dd5706e0db9fcdc3a483820e1950
Instruction Fuzzy Hash: 7F233A74A01228CFEB25DF74D954BA9B7B6FB49308F1041E9D509AB3A1DB399E81CF40

Function 018E4269 Relevance: 3.0, Strings: 1, Instructions: 1768
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 018E4BC4

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e45557faf04fd2d05225fceff2ccf87b310b247981596b39e68cff5b1becbb54
Instruction ID: 0073fece7f74bbe8390c7dde38dfa5f82e5241e0c0de42b2ec4711dc6a20f5e0
Opcode Fuzzy Hash: e45557faf04fd2d05225fceff2ccf87b310b247981596b39e68cff5b1becbb54
Instruction Fuzzy Hash: 85134E74A01228CFEB25DF74D954BA9B7B6FB49308F1041E9D509AB3A1DB399E81CF40

Function 018E00B8 Relevance: 2.6, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

E]Hk^, xrefs: 018E0140, 018E0145
5]Hk^, xrefs: 018E0194, 018E0199

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID: 5]Hk^$E]Hk^
API String ID: 0-806510779
Opcode ID: d3b9b746fe86bf1a65c75fab7310e2e7db0456d6c283a84e7f680d2a93997e60
Instruction ID: 6907811f7746220f1548364a4d29c9523380694b6375ebbb93b2d588fa74e85f
Opcode Fuzzy Hash: d3b9b746fe86bf1a65c75fab7310e2e7db0456d6c283a84e7f680d2a93997e60
Instruction Fuzzy Hash: 2831D632B043409FD715DBBA9461BAE3BA7ABC6258B1449BED105CF3A1CF798C05C791

Function 018E0118 Relevance: 2.6, Strings: 2, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

E]Hk^, xrefs: 018E0140, 018E0145
5]Hk^, xrefs: 018E0194, 018E0199

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID: 5]Hk^$E]Hk^
API String ID: 0-806510779
Opcode ID: 6e198aa89f681ddd5eece73a5a36b087499ea96ef7d9148b0c3fe50b43e16634
Instruction ID: 0c15754817a35d7a3ba025506fb7c72c0c6ae3ba3f9b9f0d8520de14d42590ef
Opcode Fuzzy Hash: 6e198aa89f681ddd5eece73a5a36b087499ea96ef7d9148b0c3fe50b43e16634
Instruction Fuzzy Hash: 3B1186327042418FD726D7BEA451AAE37A7ABC625871448BED005CF365CF7D8C05D7A2

Function 013FAA75 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 013FAB25

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 595e62cc78ae9f123287c92fa86282212abecf863a7b86ef74f849980915f229
Instruction ID: 5e1770964362ce902c8deeed8ab2e7ae7d398a987d07f3d9039a5845aaa263a0
Opcode Fuzzy Hash: 595e62cc78ae9f123287c92fa86282212abecf863a7b86ef74f849980915f229
Instruction Fuzzy Hash: 5C318071508344AFE722CF25CC84F56BFF8EF05214F08889EE9898B652D365E808CB61

Function 013FB036 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 013FB0DD

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 8845815c07d86fa36b0da0aba4bc563ec7d8b561ebdf27f558aedfb477b38400
Instruction ID: 68a709bd276156c5b7377ec9dbe2a4e2447ff976a021b42656c0c0f424532c54
Opcode Fuzzy Hash: 8845815c07d86fa36b0da0aba4bc563ec7d8b561ebdf27f558aedfb477b38400
Instruction Fuzzy Hash: AF3181B55097806FE712CB25DC45B96FFF8EF06214F08849EE984CB293D365E908C762

Function 013FA6CE Relevance: 1.6, APIs: 1, Instructions: 85
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 013FA77E

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: c05ddd6c83d22901f86e4e09e041c16d32bb6c930dae3491db00fb18ba18591f
Instruction ID: 5fe2264e079a56d89deb0f70ac6a595dad6d4f684cab0411918ffa52fc67bfb8
Opcode Fuzzy Hash: c05ddd6c83d22901f86e4e09e041c16d32bb6c930dae3491db00fb18ba18591f
Instruction Fuzzy Hash: 3E31807554D3C06FD3138B259C61B61BFB4EF47614F0A80CBE884CB6A3D229A919D772

Function 013FAE77 Relevance: 1.6, APIs: 1, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,CC366C44,00000000,00000000,00000000,00000000), ref: 013FAF0D

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 2158a0da60a08583f82851b4adc16bb657babf52ec418819c749aaec16d50927
Instruction ID: 92c2f6b0c08be216350e43c8ee016e9320cb77c3bad51c3359f6008ac86c0043
Opcode Fuzzy Hash: 2158a0da60a08583f82851b4adc16bb657babf52ec418819c749aaec16d50927
Instruction Fuzzy Hash: 9C21B1B2508380AFD722CB11DD44F96BFB8EF06314F08849AE9849F192D225A508CB65

Function 013FAAA6 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 013FAB25

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 612c188be713cb4ba5553871840b4263fee9eb8618f1cfab936c06546d791cd3
Instruction ID: 311b7a69fc541aa1b665adf1e8b96dff8df93e28b3437b2d15f9c6c2928d2ee3
Opcode Fuzzy Hash: 612c188be713cb4ba5553871840b4263fee9eb8618f1cfab936c06546d791cd3
Instruction Fuzzy Hash: BF21AE71604604AFEB21CF29CD84F66FBE8EF04214F04886EEA498B751D375E808CB71

Function 013FA9BF Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 013FAA44

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 5f771fab99338dec1094627715d6a7e6131a1ec6c802c5a0b83ed50041a5b49b
Instruction ID: aabc418f9f3aa22ae420bfa2b64b98ffec856860c23508b58b975f4f04874a4d
Opcode Fuzzy Hash: 5f771fab99338dec1094627715d6a7e6131a1ec6c802c5a0b83ed50041a5b49b
Instruction Fuzzy Hash: 9121366540E7C09FDB138B259D64A51BFB4EF53624B0A80DBD9848F6A3C268980CCB72

Function 013FAC37 Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,CC366C44,00000000,00000000,00000000,00000000), ref: 013FACBD

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 9b1494e5a2da552a254eef828e36570f8266c2e9abc5c2c189d55e91b8c450f5
Instruction ID: e9b99fc74b4cc77c6fcf882b6425e92c7dd77b741c63aa2e5b96aafdfc4b4ea0
Opcode Fuzzy Hash: 9b1494e5a2da552a254eef828e36570f8266c2e9abc5c2c189d55e91b8c450f5
Instruction Fuzzy Hash: 8021E7B55083806FE7128B15DC40BA2BFBCEF57714F0880DBE984CB293D268A909D775

Function 013FB06A Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 013FB0DD

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 65600d709a089cb62359d27d26f4214435bd0dfde40cee625b992157e22ba2e5
Instruction ID: 07745cfa12b47baead4445920a931fe7f42d17036c29a79046c2cfb97768e235
Opcode Fuzzy Hash: 65600d709a089cb62359d27d26f4214435bd0dfde40cee625b992157e22ba2e5
Instruction Fuzzy Hash: F12162B16042449FE720DF29DD45BA6FBE8EF04218F04846EEA45CB746D775E408CB75

Function 013FA61E Relevance: 1.6, APIs: 1, Instructions: 65
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(?), ref: 013FA690

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ed699b6c9be33191599ffb0bbe1ea33c56df4dfccf6ad42cf34362c0c3981269
Instruction ID: d3ced6e3a46d69c62625ebc6f765bc7232032858802acf16ff4496588af0c1c7
Opcode Fuzzy Hash: ed699b6c9be33191599ffb0bbe1ea33c56df4dfccf6ad42cf34362c0c3981269
Instruction Fuzzy Hash: 4321587150D3C09FDB138B259C94652BFB4DF07224F0984DBD9858F2A3D2699908CBB2

Function 013FA573 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013FA5DE

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1acc7ce61b7a226697a7a222c0f052eb2601ce4ef8c82bcad1e61708d0c2702f
Instruction ID: 579c52cdb508d7c91f83268e1a3170aa4b2870926dcfd77cc5c57b47ba1088bf
Opcode Fuzzy Hash: 1acc7ce61b7a226697a7a222c0f052eb2601ce4ef8c82bcad1e61708d0c2702f
Instruction Fuzzy Hash: 7111B771408780AFDB228F55DC44A52FFF4EF46314F0888DEED858B553C235A418DB61

Function 013FAEAE Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,CC366C44,00000000,00000000,00000000,00000000), ref: 013FAF0D

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6fd81bf1637aa8fec26c65c5352abb9d3ff71c41d1972fcb86340adca2bc39ac
Instruction ID: 78928ac5b96049b2b1031de2d00128ac37168f87822944e3415aa36a869ca777
Opcode Fuzzy Hash: 6fd81bf1637aa8fec26c65c5352abb9d3ff71c41d1972fcb86340adca2bc39ac
Instruction Fuzzy Hash: 3A119071504204AFEB21CF55DD44BA6FBE8EF14318F04846AEA498B651C375E4088BB5

Function 013FB424 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 013FB480

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: a508adb4f469bec8f0660b6c63d5c3332c678e5b5d2b33d9b2513d09f1c5d892
Instruction ID: 9d0e6d82466842c606ad508fed18672712b1c79b391ccf0f03c5099da5739e54
Opcode Fuzzy Hash: a508adb4f469bec8f0660b6c63d5c3332c678e5b5d2b33d9b2513d09f1c5d892
Instruction Fuzzy Hash: 7A1151715093849FD712CF25DD54B52BFB8DF06214F0884AAED45CB252D265E808CB61

Function 013FAC6A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,CC366C44,00000000,00000000,00000000,00000000), ref: 013FACBD

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b60cce1ca0cab9ecef95b91752f8b92f1f831dc472f291ee891da7b655c71f88
Instruction ID: ade8ba3779e8862554794e9c4e4f998c98d82f44c8e0dd05418e656ff4815fb0
Opcode Fuzzy Hash: b60cce1ca0cab9ecef95b91752f8b92f1f831dc472f291ee891da7b655c71f88
Instruction Fuzzy Hash: 2301D671504204AFEB20CB05DD84BA6F7ECDF14628F04C06AEE098B741D778E4088AB5

Function 013FB446 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 013FB480

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 4a85c2a7b73554b1fea391eaf022987cf3a6b1431e5a0e318269aea85f3407b3
Instruction ID: 37943783b59cb5abc96ef8830626d3ec74593b8c7235601c363f4aa205df7245
Opcode Fuzzy Hash: 4a85c2a7b73554b1fea391eaf022987cf3a6b1431e5a0e318269aea85f3407b3
Instruction Fuzzy Hash: D90140B16042448FDB10CF29DA85756FBE8EF04624F08C4AADE49DB756D779E404CB61

Function 013FA59A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013FA5DE

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0dcea44dc73e5fd557a0a1e8214834507122c82568259dfd85d7029bcbcfcad1
Instruction ID: 259496c79d5003c2c2c112f54ec85d87ac4ac166bd4bf26caf5fd3e9692f749b
Opcode Fuzzy Hash: 0dcea44dc73e5fd557a0a1e8214834507122c82568259dfd85d7029bcbcfcad1
Instruction Fuzzy Hash: B50139725046049FDB218F59D944B52FBE4EF48624F0888AEDE8A4BA52C376E418DF62

Function 013FA72E Relevance: 1.5, APIs: 1, Instructions: 43comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 013FA77E

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: d52dea2c428b87dc8f1e6b10b6fc03b56196c57ad39ea994c1d2470e007a5c40
Instruction ID: bcfebfbcc20b056137d9c6e827d2795b9c1547ec33a549d11a1e975b620b557c
Opcode Fuzzy Hash: d52dea2c428b87dc8f1e6b10b6fc03b56196c57ad39ea994c1d2470e007a5c40
Instruction Fuzzy Hash: 1C01A271600600ABD310DF16DC46B66FBE8FB88A20F14815AEC089BB41D735F955CBE5

Function 013FA65E Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 013FA690

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 417e3a4724804a0c176f504b4cae2d2475c2f08523c63bd5ed0fd9ed088ce2f5
Instruction ID: 3081c8d6ac3ec0707aee71441066c47c427409c9b45d6ec2ff28d0c2b9882524
Opcode Fuzzy Hash: 417e3a4724804a0c176f504b4cae2d2475c2f08523c63bd5ed0fd9ed088ce2f5
Instruction Fuzzy Hash: 230162715042449FDB10CF59D984755FBE8EF44229F08C4AADD498F656D379E404CEA2

Function 013FAA12 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 013FAA44

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e3e26048a1f3887c384890d32e29902b962052296397befb16d0511a7a1c06e6
Instruction ID: fc71a46b2998edf02de058890bb9a066d2d612cb0d1032a7c96c8dbb57445e37
Opcode Fuzzy Hash: e3e26048a1f3887c384890d32e29902b962052296397befb16d0511a7a1c06e6
Instruction Fuzzy Hash: BFF0A4355046449FEB20CF09DA84761FBE4EF04628F08C0AADE494B752D279E50CCE62

Function 013FAB7C Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000), ref: 013FABF0

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3f94128c1b6fec50b5592db74a797373136b07a63d18ad50f037ecea2c150c2d
Instruction ID: 1dba6997ffa0bacae187b9a9b5885832d5224b990f2751acf7c15d3a665d3599
Opcode Fuzzy Hash: 3f94128c1b6fec50b5592db74a797373136b07a63d18ad50f037ecea2c150c2d
Instruction Fuzzy Hash: 0321F2715097C09FDB138B25DC91752BFB8EF07224F0984DBDD858F2A3D2249908CB62

Function 013FABBE Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000), ref: 013FABF0

Memory Dump Source

Source File: 00000000.00000002.2088945125.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fa000_a1K847qsM0.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 8897cb153658311fb2484ca84b58be199f46934ccf0477da4faaa3ef980b2505
Instruction ID: b82aff593d31f05da447ca3e85ce96fc636447ee9d94591cc4385c863eae543c
Opcode Fuzzy Hash: 8897cb153658311fb2484ca84b58be199f46934ccf0477da4faaa3ef980b2505
Instruction Fuzzy Hash: FF0184756042448FDB10CF19D985755FBE8DF04224F08C4BFDD49CB652D679E804CA61

Function 018E37E1 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac07be4b88e37db76a4c467b9fb9d51617794657f07dcc57cb5ecdbb812fc82e
Instruction ID: f79c33ebc6a8ad75a9ed60eb2fc8ba6efe6cd90af694f27e1bcc92bf8a680589
Opcode Fuzzy Hash: ac07be4b88e37db76a4c467b9fb9d51617794657f07dcc57cb5ecdbb812fc82e
Instruction Fuzzy Hash: B5322630A00218CFEB24DF74D955BADB7B6FB49308F1045A9D509AB3A5DB399E81CF50

Function 018E39BF Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 853b245a95f55074ba5cc70d2314278b415af1c6bdf0ce0396a8bc75928c5cbf
Instruction ID: 65527bc9f785fafe5b771151452659b5eb42ae0f8dce2339f4be03399b6dcd11
Opcode Fuzzy Hash: 853b245a95f55074ba5cc70d2314278b415af1c6bdf0ce0396a8bc75928c5cbf
Instruction Fuzzy Hash: 54814C31A01218CFDB24DFB8C955BADB7B2FF85308F1045A9D50AAB2A4DB798E44CF51

Function 018E3B18 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29dda20199453e17ac37d4f181aa83d4f0ac4afffef821918a2c365174c4b71c
Instruction ID: e7ea4b90b38dfba41d36b348d6f684d0d8d3849ddb39c8b6442059479072d618
Opcode Fuzzy Hash: 29dda20199453e17ac37d4f181aa83d4f0ac4afffef821918a2c365174c4b71c
Instruction Fuzzy Hash: 8B413C31A00218CFDB24DBB9C954BADB7F2FF45308F5044AAD409AB2A5DB798E44CF51

Function 018E0958 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b95f0e85fc932995e1baeed46fed9a5474557c7c36b5349809f56cee744522
Instruction ID: fe36bb15a68459365a560f55692dc294b78c4b3dc23a65c3eb7e9e6e29018683
Opcode Fuzzy Hash: 14b95f0e85fc932995e1baeed46fed9a5474557c7c36b5349809f56cee744522
Instruction Fuzzy Hash: 7731E031B002119FDB14AB7CD911BBE77AADB88208F00443AE509D77A5DF7CDD168B91

Function 018E0006 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecf8a07b44f1a62c7249962da9a9675bd4fdf0dce11f6c3f885fee36d1250c0
Instruction ID: cb84b6833c5723fb02b7a16945b00f5ad8bdf031596c2b68a25a5398af487214
Opcode Fuzzy Hash: aecf8a07b44f1a62c7249962da9a9675bd4fdf0dce11f6c3f885fee36d1250c0
Instruction Fuzzy Hash: 4C11806148E3C19FD7138B7498606C03FB0AF07618B5A44DBC480CF2B7E6AE4D0AD7A2

Function 01AF05E0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089962954.0000000001AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1af0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d160e2438d30b40b248e20fcd4fd60125163b56df9bcb324112799db0ad3baca
Instruction ID: 8b6bb5e0f7d4f62a477f76dd5acc929a21061c5fde7563a18441509c26425e9a
Opcode Fuzzy Hash: d160e2438d30b40b248e20fcd4fd60125163b56df9bcb324112799db0ad3baca
Instruction Fuzzy Hash: 4201C47250D3D05FC7128B299D50862FFB8EE46220709C5DFE889CB653C229A808CB72

Function 018E0879 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b231eb62d505acc1d0cafd210ebd9f4b886cfe4e58dbd300474980b837eb8927
Instruction ID: b5dedc0f98600febce3c698a80394a786c0a0e582f8cf176e22f3b6fd0372e5d
Opcode Fuzzy Hash: b231eb62d505acc1d0cafd210ebd9f4b886cfe4e58dbd300474980b837eb8927
Instruction Fuzzy Hash: AA016D31606342DFCB11EF79D65899D77E1EF84209B14882DE286CB369EB788C458F42

Function 018E00A8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e560e00c330f279f8409120b8646920e8e4cbfcbc271e71fc698ebc156fdc2
Instruction ID: 768e8560212da3dec124a7250848eba34c3e1b01ebe0f82c5765b7fdcc511c12
Opcode Fuzzy Hash: b0e560e00c330f279f8409120b8646920e8e4cbfcbc271e71fc698ebc156fdc2
Instruction Fuzzy Hash: 31F02832A04304AFEB14DFB1C852BAE7BA6EF42714F1085BEE100CB1D1DA369901C780

Function 01AF0649 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089962954.0000000001AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1af0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74fa1766f4bd324a2b6087ba9bc2451b7d2244fe3b8c5814e755195d53ce0e13
Instruction ID: 3c7d0ca31a84cf1e517d47da2e0ef9e022a4ccfa5a635b8a773dc6798f4c3428
Opcode Fuzzy Hash: 74fa1766f4bd324a2b6087ba9bc2451b7d2244fe3b8c5814e755195d53ce0e13
Instruction Fuzzy Hash: E7F0E57250D3800FD31A8B19BC115D1BBA0EB82230B2885FFD989CF653E626A54987A6

Function 01AF0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089962954.0000000001AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1af0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02efbbf3c09fdaac154850a64d2997960fc685c13a95b0b56f8a773bbd65f68
Instruction ID: 5953726fa0f402f3c5b9ad2f9cc061699dec4c90122f05d4cdff36c9b0342712
Opcode Fuzzy Hash: d02efbbf3c09fdaac154850a64d2997960fc685c13a95b0b56f8a773bbd65f68
Instruction Fuzzy Hash: E7E092B66006008B9650DF0BFD41452F7E8EB84630718C47FDC0E8BB01D63AB509CEA5

Function 018E36A8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374f28c2ee185fd78f8c3600d7affb6e6952dec451a532364809239e44cd5401
Instruction ID: 16a7492fbe6a53e2f8912d9acae73d3bffd9bb39cdcd86abae951f48d5952c48
Opcode Fuzzy Hash: 374f28c2ee185fd78f8c3600d7affb6e6952dec451a532364809239e44cd5401
Instruction Fuzzy Hash: 9DE0B630246340CFCB1A9B7890549583BB5EF4A30936408EED446CB266DB7BA892CB10

Function 013F23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2088930016.00000000013F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f2000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722c9f10c25ccb059fcc9223d5220a94ff191a790bbfb16ac4820544a554a259
Instruction ID: c4388783688cf422a4a96b3b1c5c54519781cf7b07e1259a91b46ca08039d6f0
Opcode Fuzzy Hash: 722c9f10c25ccb059fcc9223d5220a94ff191a790bbfb16ac4820544a554a259
Instruction Fuzzy Hash: 61D05E792056D18FE3279B1CC6A4B963BE4AB51718F4A44FEA900CB763C7A8D581D610

Function 013F23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2088930016.00000000013F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f2000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b555d787a471667cd3703dd4794391c821bdbc21afb969a3aa7cb27c21954de
Instruction ID: 20d67510128d59dd66d25f1ef6de0c18f95c557f423a35fba92dfd10c9ed09f9
Opcode Fuzzy Hash: 4b555d787a471667cd3703dd4794391c821bdbc21afb969a3aa7cb27c21954de
Instruction Fuzzy Hash: 31D05E743006818BD729DB0CC2D4F5A3BD4AB40718F0644EDAD108BB62C7A8D8C4DA00

Non-executed Functions

Function 018E44F1 Relevance: 2.9, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

Strings

, xrefs: 018E4BC4

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ffa380b4993faaa3575d0e43dc4fa41c99c8a2fe2f46ce336ac6ed422406d3d1
Instruction ID: 6b1d08f4c7b15f7447014f0370ebadf9631fdfd3ac6b17ae44f7a5102e2fdde0
Opcode Fuzzy Hash: ffa380b4993faaa3575d0e43dc4fa41c99c8a2fe2f46ce336ac6ed422406d3d1
Instruction Fuzzy Hash: 1E034E74A01228CFEB25DF74D954BA9B7B6FB49308F1041E9D509AB3A1DB399E81CF40

Function 018E4544 Relevance: 2.9, Strings: 1, Instructions: 1618COMMON

Download Yara Rule

Strings

, xrefs: 018E4BC4

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 0076ab9c4e2a1cb335a2cc8500137f66b14c4f923c9c0c4a4fe0e8705b1aa53b
Instruction ID: 92940b4ad6b8a0c3e8c53870c019f7fca6cc7bd207cc3c5c763040ee0745a58e
Opcode Fuzzy Hash: 0076ab9c4e2a1cb335a2cc8500137f66b14c4f923c9c0c4a4fe0e8705b1aa53b
Instruction Fuzzy Hash: 1D034E74A01228CFEB25DF74D954BA9B7B6FB49308F1041E9D509AB3A1DB399E81CF40

Function 018E4630 Relevance: 2.8, Strings: 1, Instructions: 1579COMMON

Download Yara Rule

Strings

, xrefs: 018E4BC4

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f4bc70b586967d50cb0a3906570e03f825701c9bcf300051600e1c761473249f
Instruction ID: affa7cf01625812e0c852cfc69630103390978f39c01234adcf84642480f2ef9
Opcode Fuzzy Hash: f4bc70b586967d50cb0a3906570e03f825701c9bcf300051600e1c761473249f
Instruction Fuzzy Hash: 80034E74A01228CFEB25DF34D954BA9B7B6FB49308F1041E9D509AB3A1DB399E81CF40

Function 018E470F Relevance: 2.8, Strings: 1, Instructions: 1544COMMON

Download Yara Rule

Strings

, xrefs: 018E4BC4

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f4c62e56633d163c72fa8643c22d82e64ba233d9f60ac36ab951aaa5c474ed37
Instruction ID: 0e416b62c40e7ccee1e2d34ab4651f4c0d690eb304e1b2843c9040d8167dfe92
Opcode Fuzzy Hash: f4c62e56633d163c72fa8643c22d82e64ba233d9f60ac36ab951aaa5c474ed37
Instruction Fuzzy Hash: 1AF24F74A01228CFEB25DF74D954BA9B7B6FB49308F1041E9D509AB3A1DB399E81CF40

Function 018E47D4 Relevance: 2.8, Strings: 1, Instructions: 1513COMMON

Download Yara Rule

Strings

, xrefs: 018E4BC4

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 8e9c1df5feaec32c8d8aada5caaa83c413f871b2dcda21acdea5fbf0106a3ceb
Instruction ID: 541eec1aec96f0408f5c11f9ce6797467454ea9b43714e3e1efc2bc83b6e0bcc
Opcode Fuzzy Hash: 8e9c1df5feaec32c8d8aada5caaa83c413f871b2dcda21acdea5fbf0106a3ceb
Instruction Fuzzy Hash: 2FF25F74A01228CFEB25DF34D954BA9BBB5FB49308F1041E9D509AB3A1DB399E81CF50

Function 018E4936 Relevance: 2.7, Strings: 1, Instructions: 1456COMMON

Download Yara Rule

Strings

, xrefs: 018E4BC4

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 16889bf8d134bf6caf9922d168622db39718077880f472bdb5564bc676ebc4f7
Instruction ID: bc260869046c6da80fbe75b8d2aec6fcbb45f1047eab0d571988f3927dbc1737
Opcode Fuzzy Hash: 16889bf8d134bf6caf9922d168622db39718077880f472bdb5564bc676ebc4f7
Instruction Fuzzy Hash: 72F25F74A01228CFEB25DF34D954BA9BBB5FB49308F1041E9D509AB3A1DB399E81CF50

Function 018E499D Relevance: 2.7, Strings: 1, Instructions: 1447COMMON

Download Yara Rule

Strings

, xrefs: 018E4BC4

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 50f7278f20e8b6f813db19cb722922dc3ca7ccdb2a88db4396fdafe43c4695a6
Instruction ID: 6842727be2ce16573d40bc730197f27fedc3eaea849bd6d7c889dbf8ba4583a7
Opcode Fuzzy Hash: 50f7278f20e8b6f813db19cb722922dc3ca7ccdb2a88db4396fdafe43c4695a6
Instruction Fuzzy Hash: 49F24074A01228CFEB25DF34D954BA9B7B5FB49308F1041E9D509AB3A1DB399E81CF50

Function 018E49F9 Relevance: 2.7, Strings: 1, Instructions: 1440COMMON

Download Yara Rule

Strings

, xrefs: 018E4BC4

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c9827d0b5f3c5fc1a2f421d8ed59f6c04f4971a90dea5b243856707309700d46
Instruction ID: e2f328b66f876eb603146cba73568fac09359331f5af0206dabb99364c89fe7f
Opcode Fuzzy Hash: c9827d0b5f3c5fc1a2f421d8ed59f6c04f4971a90dea5b243856707309700d46
Instruction Fuzzy Hash: 9EF24F74A01228CFEB25DF34D954BA9BBB5FB49308F1041E9D509AB3A1DB399E81CF50

Function 018E4B5B Relevance: 2.6, Strings: 1, Instructions: 1383COMMON

Download Yara Rule

Strings

, xrefs: 018E4BC4

Memory Dump Source

Source File: 00000000.00000002.2089769212.00000000018E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18e0000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 3e7a79b9d7a6e8ad743776b2d984824078f2eb8055e355cf764688b98ed78f89
Instruction ID: bd68a6ea953b215e5b9d67d930ab5960fa1b80736062cb4ef4101bfc4764ea60
Opcode Fuzzy Hash: 3e7a79b9d7a6e8ad743776b2d984824078f2eb8055e355cf764688b98ed78f89
Instruction Fuzzy Hash: 93E24F74A01228CFEB25DF34D954BA9BBB5FB49308F1041E9D509AB3A1DB399E81CF50

Function 013F26E7 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2088930016.00000000013F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13f2000_a1K847qsM0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e308b694105678b5d2552910734de94ac1bd3f3dc6aff4c6b47568cda719754e
Instruction ID: 44ad69f7a39317a35c7cc2ce5f055fab28ab6c2bbf208f341504d13b29e6a4e4
Opcode Fuzzy Hash: e308b694105678b5d2552910734de94ac1bd3f3dc6aff4c6b47568cda719754e
Instruction Fuzzy Hash: 77517A7544E7C69FD3078F208862445BFB4AE93204B0E88CFC884CF0A7C3649A59CB62

Analysis Process: server.exePID: 384, Parent PID: 1276COMMON

Execution Graph

Execution Coverage:	39.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.7%
Total number of Nodes:	105
Total number of Limit Nodes:	6

Executed Functions

Function 048C4298 Relevance: 3.2, Strings: 1, Instructions: 1950COMMON

Download Yara Rule

Strings

@, xrefs: 048C4C24

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: cd2f17abf2d191b6741c2b29ae83e11c26900777f0e2055024b25f4634baf62a
Instruction ID: 5a0a1982c18b59d58e016688c265773d350023f14b57f749da3935d26aefcb38
Opcode Fuzzy Hash: cd2f17abf2d191b6741c2b29ae83e11c26900777f0e2055024b25f4634baf62a
Instruction Fuzzy Hash: 1B233C74A01228CFDB25EF34D954BADB7B2BB49308F1041E9D509AB3A8DB359E85DF40

Function 048C44F1 Relevance: 2.9, Strings: 1, Instructions: 1624
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 048C4BC4

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e6d4972aacbc118b8e04ee31137535bcd44d3d11ffacec131ac92ccda6f29cfa
Instruction ID: 1fafb3c873a3b65ca8dc0cc16f4d3d19fd890217fcde38e3b36b6e8768d71696
Opcode Fuzzy Hash: e6d4972aacbc118b8e04ee31137535bcd44d3d11ffacec131ac92ccda6f29cfa
Instruction Fuzzy Hash: 92034E74A01228CFDB25EF34D954BA9B7B2FB49308F1041E9D509AB3A8DB359E85DF40

Function 048C4544 Relevance: 2.9, Strings: 1, Instructions: 1618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 048C4BC4

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c53b1e9b7d847cb87077e50caf79025fa9a2224d5fa4d29f2ef3189d5d5cb5e3
Instruction ID: 52082fe70af28013636845105b33f1fc1db892448de4e7e8aafcf5a68ca3a820
Opcode Fuzzy Hash: c53b1e9b7d847cb87077e50caf79025fa9a2224d5fa4d29f2ef3189d5d5cb5e3
Instruction Fuzzy Hash: D1034E74A01228CFDB25EF34D954BA9B7B2FB49308F1041E9D509AB3A8DB359E85DF40

Function 048C4630 Relevance: 2.8, Strings: 1, Instructions: 1579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 048C4BC4

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 60f535137a7602d47e8b4dad9cfb07e5321aed87b61b6c8a3267d7e833423a36
Instruction ID: 6a817f2619594d5188acb7dee38bc9da3223539abdc1c94742f733a71e43ff30
Opcode Fuzzy Hash: 60f535137a7602d47e8b4dad9cfb07e5321aed87b61b6c8a3267d7e833423a36
Instruction Fuzzy Hash: 46035F74A01228CFDB25EF34D954BA9B7B2FB49308F1041E9D509AB3A8DB359E85DF40

Function 048C470F Relevance: 2.8, Strings: 1, Instructions: 1544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 048C4BC4

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 57d179da067e631dc7b0461d7cc83e5c924b7ee476fc647685019c738c6120f9
Instruction ID: 7b8a337cc9b344615e99173977875817cce664610af52cc5af0bfa3f9d7721be
Opcode Fuzzy Hash: 57d179da067e631dc7b0461d7cc83e5c924b7ee476fc647685019c738c6120f9
Instruction Fuzzy Hash: 5DF25E74A01228CFDB25EF34D954BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C47D4 Relevance: 2.8, Strings: 1, Instructions: 1513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 048C4BC4

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: aa5fa3ea351ebeed6316a35876e0c6253990f354656ca30e868866e740248208
Instruction ID: 4e7bccec8e25d706288e4dd792e6598d4572cac74f13fbf7019ce420854229e5
Opcode Fuzzy Hash: aa5fa3ea351ebeed6316a35876e0c6253990f354656ca30e868866e740248208
Instruction Fuzzy Hash: 67F26E74A01228CFDB25EF34D954BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C4936 Relevance: 2.7, Strings: 1, Instructions: 1456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 048C4BC4

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: bb35aabad439ea74e6cf8caa66d5fe686ffadbd1a59fd94fb1779baf4e473d5f
Instruction ID: d6855141f5ef3bf5fe0dfc3a96d7d77dc5c4f501dfa96768b9ac889676dc7dec
Opcode Fuzzy Hash: bb35aabad439ea74e6cf8caa66d5fe686ffadbd1a59fd94fb1779baf4e473d5f
Instruction Fuzzy Hash: 49F26E74A01228CFDB25EF34D954BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C499D Relevance: 2.7, Strings: 1, Instructions: 1447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 048C4BC4

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9f1ffde494460ff6ca6f2465483ced7ac9025f47ed87d27f891dffd84a395630
Instruction ID: e7adcb7a260299f4fa944a8e0613808fd28d6da147f0554afefaceaaf496e48f
Opcode Fuzzy Hash: 9f1ffde494460ff6ca6f2465483ced7ac9025f47ed87d27f891dffd84a395630
Instruction Fuzzy Hash: F2F26E74A01228CFDB25EF34D954BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C49F9 Relevance: 2.7, Strings: 1, Instructions: 1440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 048C4BC4

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6b60a2d8e60870181b46b589c3601b99f756ada6f91e6b3c049ccdbc6accdbf0
Instruction ID: 047515718f0d4fbbdda5cf9aee63585b515e7c15cd8368f56bbe790b53abeb2e
Opcode Fuzzy Hash: 6b60a2d8e60870181b46b589c3601b99f756ada6f91e6b3c049ccdbc6accdbf0
Instruction Fuzzy Hash: 6AF26E74A01228CFDB25EF34D954BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C4B5B Relevance: 2.6, Strings: 1, Instructions: 1383
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 048C4BC4

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5d4cd7e715dc402522cbee30e6ba29d8b5f7bd32abe02bc71de4d58ce3559af5
Instruction ID: 1705c71544d04c1df339b412a5c4f2d9850aac84846352bf1ac10654badfc15a
Opcode Fuzzy Hash: 5d4cd7e715dc402522cbee30e6ba29d8b5f7bd32abe02bc71de4d58ce3559af5
Instruction Fuzzy Hash: 61E26E74A01228CFDB25EF34D954BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C4C8F Relevance: 1.4, Instructions: 1362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33b8ea82452e3566eb6b91b4b91a4b60d4a3f1a44729feea02cbcf2af2b416d
Instruction ID: 24cae2e20959358945adebbc83421fa1e744da1fa0e0cf0dd9dbdfc59b4de3d6
Opcode Fuzzy Hash: f33b8ea82452e3566eb6b91b4b91a4b60d4a3f1a44729feea02cbcf2af2b416d
Instruction Fuzzy Hash: 69E25D74A01228CFDB25EF34D954BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C4F2F Relevance: 1.2, Instructions: 1245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318c82ab92a37e90fea21a357ec218bf55236bc7b3dc5bbf423d21d806a6766f
Instruction ID: 30116499a527d28c5dcc739b62489c3e22a118a2ce6873bc100057f6329ec0ac
Opcode Fuzzy Hash: 318c82ab92a37e90fea21a357ec218bf55236bc7b3dc5bbf423d21d806a6766f
Instruction Fuzzy Hash: A8D25B74A05228CFDB25EF34D854BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C4F9D Relevance: 1.2, Instructions: 1236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e289b7c2b418302e16438b94677bebf42680806ad0e2d79feb589fe808cb0a
Instruction ID: 4b3c1400a1c0e4c888f00de14a47f0222036c325eb61e221c46bf5bef4535bd5
Opcode Fuzzy Hash: b7e289b7c2b418302e16438b94677bebf42680806ad0e2d79feb589fe808cb0a
Instruction Fuzzy Hash: AAD25B74A05228CFDB25EF34D854BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C5000 Relevance: 1.2, Instructions: 1230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c7a453b514a23ee9016395c0edc3a72ef563875aa08b98654940eaabe3929e
Instruction ID: 195bb70953b2cd6118ad9430814275399150811443b1a7af71e33c39b3d1a9d3
Opcode Fuzzy Hash: 05c7a453b514a23ee9016395c0edc3a72ef563875aa08b98654940eaabe3929e
Instruction Fuzzy Hash: A6D25B74A01228CFDB25EF34D854BA9B7B2FB49304F5041E9D509AB3A8DB359E85DF80

Function 048C505D Relevance: 1.2, Instructions: 1225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed86fe46998000ec16d088870530a2a8c07b0b69dc15293dade815d6aa9a159
Instruction ID: 143e94ea3468486a7d9de9e0f69eba551b444eb05a8f2a60d2f3a975a0481b01
Opcode Fuzzy Hash: 3ed86fe46998000ec16d088870530a2a8c07b0b69dc15293dade815d6aa9a159
Instruction Fuzzy Hash: 75D25B74A01228CFDB25EF34D854BA9B7B2FB49304F5041E9D509AB3A8DB359E85DF80

Function 048C50E3 Relevance: 1.2, Instructions: 1210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8ebd811cfb7dd8b7a5bc791dbeb0f0c8471493280bae17ab0ac594018fa1d5
Instruction ID: d2747d8930e93ae579e3d3a5b52f7f4e99e4075dbec7595b0c57b5e32d59da74
Opcode Fuzzy Hash: 7c8ebd811cfb7dd8b7a5bc791dbeb0f0c8471493280bae17ab0ac594018fa1d5
Instruction Fuzzy Hash: 9FD25B74A01228CFDB25EF34D854BA9B7B2FB49304F5041E9D509AB3A8DB359E85DF80

Function 048C536F Relevance: 1.1, Instructions: 1071COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859ae39be3205f3902c5a4f0855bd1501c497f6ebb8cbe8255e5de8d78d63d7d
Instruction ID: d14a419ef715b2f3cd861c471af444cb1588b62087b8b9df96f57b053277aaf0
Opcode Fuzzy Hash: 859ae39be3205f3902c5a4f0855bd1501c497f6ebb8cbe8255e5de8d78d63d7d
Instruction Fuzzy Hash: F3C23B74A01228CFDB25EF34D954BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C5459 Relevance: 1.0, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84638ec9ca7682f6e134e685e7e69c68731ed1ba34df1c5f82d4ae1ecaafa725
Instruction ID: 7938d0318b0fa8072b5ae78e3a66301ab1d6cb76cb8b71803695f7abf3f22c4c
Opcode Fuzzy Hash: 84638ec9ca7682f6e134e685e7e69c68731ed1ba34df1c5f82d4ae1ecaafa725
Instruction Fuzzy Hash: EDC23B74A01228CFDB25EF34D854BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C7418 Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d9892688d6cae0055eb414d4b6e9b65bdb97d556237b9fdf636dc090c7b67e
Instruction ID: b06559569a865d4e205824e1a247ef3b2c3b3f1d7b70027f55b5af4ab077e383
Opcode Fuzzy Hash: 61d9892688d6cae0055eb414d4b6e9b65bdb97d556237b9fdf636dc090c7b67e
Instruction Fuzzy Hash: 890225766002639BCB29AF319450538B3A7BF443553458A3EE4A5DB294EF3AF981DF80

Function 048C73FE Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a48174f2a20baa1ec49dd3aad290271016a8e11ec6c91e6435cd339acca87bb
Instruction ID: 66beba67af3128abf5a98626d1cfc70f270650ed820b3c51a2cd5f5de423e595
Opcode Fuzzy Hash: 6a48174f2a20baa1ec49dd3aad290271016a8e11ec6c91e6435cd339acca87bb
Instruction Fuzzy Hash: 11C159312052634BC736AB33A85053977E7BB44256345867BE4A0CF2D4EF3CE985EB90

Function 04972A1E Relevance: 1.6, APIs: 1, Instructions: 129
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 04972B19

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d0d9412205046d27113138a92500e5c58a090302f069645f53d736e23ff6adbe
Instruction ID: 608eddee9659f608a845805a46a8b7b0845bc4e0c9054af9956b87c33170906d
Opcode Fuzzy Hash: d0d9412205046d27113138a92500e5c58a090302f069645f53d736e23ff6adbe
Instruction Fuzzy Hash: 18417F715093846FE7238B218C40FA6BFBCEF17614F0985DAE985CB5A3D264E909CB71

Function 0497117B Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 04971242

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 484fcf45855faeface6448a459fb8388a7f7ebdd97c96eef73006ea81fa3eb3a
Instruction ID: ba250000999dd34ce112f6d3004d559b6be985ab375ccff8c07520129fe11d63
Opcode Fuzzy Hash: 484fcf45855faeface6448a459fb8388a7f7ebdd97c96eef73006ea81fa3eb3a
Instruction Fuzzy Hash: 7A317C6550E3C06FD3138B258C61A61BFB4EF47614F0E45CBE8C48F6A3D229A919D7B2

Function 04971CA0 Relevance: 1.6, APIs: 1, Instructions: 90
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessTimes.KERNELBASE(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04971D3D

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: b2bcb51479aa9f8918d8df435dc75844fe9de600205a6a59bb54348ff8dcf606
Instruction ID: 08264f5daf18e72d13985516e77b7df2d5bb0eafb3437cccc309364e34a0ebb8
Opcode Fuzzy Hash: b2bcb51479aa9f8918d8df435dc75844fe9de600205a6a59bb54348ff8dcf606
Instruction Fuzzy Hash: 9131D7725057806FE712CF60DC45B96BFB8EF16314F08849BE985CB193D325A909CB75

Function 04971694 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 0497172B

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: e5c6413eae7f79b0565cd26749d9ae848a5de36e7c7b661b135e65872885ad77
Instruction ID: 7f8027c312896554ae6d7631ef461ad2939f7caf7742ebb349f36ec80c95d1e4
Opcode Fuzzy Hash: e5c6413eae7f79b0565cd26749d9ae848a5de36e7c7b661b135e65872885ad77
Instruction Fuzzy Hash: 97318F71505384AFEB22CF64DC45FA6BBFCEF45210F0884AAE984DB652D324E909CB71

Function 04972A7E Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 04972B19

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d561711ec2a0382f80fb06a1966def1a29f4e37913ab756fdc6618807e854408
Instruction ID: 6392cbadb6ffccabf6dfc456472c81a4968dcc1b0b83167ea525e2743ca8254f
Opcode Fuzzy Hash: d561711ec2a0382f80fb06a1966def1a29f4e37913ab756fdc6618807e854408
Instruction Fuzzy Hash: 8C217C72600204AFEB318F15CC44FA7BBECEF18614F04896AE945CB651E724F5098B71

Function 04970A64 Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04970AF8

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 87f44b9f5616491a23bfa7517996c2f73d148fbef9488e3b2b2db1d0cf129b7d
Instruction ID: 667eea3db2b02186f4721546623bc7361a401e3066d68cc198294233ba283de9
Opcode Fuzzy Hash: 87f44b9f5616491a23bfa7517996c2f73d148fbef9488e3b2b2db1d0cf129b7d
Instruction Fuzzy Hash: 3C21B4B15093805FE7128F20DC85B96BFB8EF06324F0884DAE984CF193D364A909C765

Function 04972DC0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04972E57

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 289f33b166d171cefb167b4d716bb28d7fb850591837ab3eafcdc2086126b802
Instruction ID: ad5c93fcc865564b35a379242328d474fb4839b1e5156b6f754c2b32dd1eeab1
Opcode Fuzzy Hash: 289f33b166d171cefb167b4d716bb28d7fb850591837ab3eafcdc2086126b802
Instruction Fuzzy Hash: 5F21D5715093845FE713CB20DC55B96BFB8AF46214F08C4DBE9888F193D225A909CB66

Function 04972CF1 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 04972D80

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: b1d985077407dd3549c1d37ba613bc6a68f4222e9234bfbf1590ac1f6bd4b6ed
Instruction ID: 8c6350d12e9e7dbe7019cd155a2010974faa6b2a38d82745b55b0b1c142a0e66
Opcode Fuzzy Hash: b1d985077407dd3549c1d37ba613bc6a68f4222e9234bfbf1590ac1f6bd4b6ed
Instruction Fuzzy Hash: 90215C755093849FDB22CF25D844B92BFF8EF06214B0884EAE984CB262D265A909DB61

Function 0497184A Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 049718DE

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: e7cd4e5ea0ac0d6e3f1aa29b3d475de00163d7788eee980f61259743b632a3c1
Instruction ID: c845d90c186784e5f218f034c0889d2dfd289b5e5caa4822602ff40058979b94
Opcode Fuzzy Hash: e7cd4e5ea0ac0d6e3f1aa29b3d475de00163d7788eee980f61259743b632a3c1
Instruction Fuzzy Hash: C421EF71509380AFE722CF15CC44F96FFF8EF09220F04889EE9888B252C365E909CB61

Function 0497126E Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 049712FA

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 1e1e0c670319e82f0d14adb509072d1c2ab94be73aada1b12dcc6b1f65095796
Instruction ID: 2d7e39b34c692da1c4d663db6c242ba4cb0b1c6fa2f208d8d2c61e7f53d8caa8
Opcode Fuzzy Hash: 1e1e0c670319e82f0d14adb509072d1c2ab94be73aada1b12dcc6b1f65095796
Instruction Fuzzy Hash: FD21A071509380AFE722CF51CC45F96FFB8EF05210F08889EE9858B652C375E408CB65

Function 049716BA Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 0497172B

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: c68e729753b6d4343220f991313d6e6121da10e8d834805bb028983e43f0e04e
Instruction ID: 2776658132ffe264dea47f4b716ea071bf061ca282f13f7834ecd90c96faaa57
Opcode Fuzzy Hash: c68e729753b6d4343220f991313d6e6121da10e8d834805bb028983e43f0e04e
Instruction Fuzzy Hash: 6721B071600204AFEB209F24DC45BAABBECEF44214F04886AE945CB751D324E9088B75

Function 049715A2 Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04971640

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f2c50382ae22a85a9273570d94a7683cc264fa7e1df9795a7d79cd77c65f4fbe
Instruction ID: 55c4af56c8d5b18d519c11afdc0e7b7e025507ab37fbe8466c0e4d8618eadf34
Opcode Fuzzy Hash: f2c50382ae22a85a9273570d94a7683cc264fa7e1df9795a7d79cd77c65f4fbe
Instruction Fuzzy Hash: E321AE72504380AFE722CF11CC85F67BFFCAF45310F08859AE9859B292D325E908CB65

Function 04972EBF Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04972F3B

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: d596c649397be7d47dbedc42122581247acda091014dbcf28a0f18be2ccd8816
Instruction ID: c6f99f2ba41afa217bfabd3d682009f3f90f957974000bfa6f28cec5baaedcb8
Opcode Fuzzy Hash: d596c649397be7d47dbedc42122581247acda091014dbcf28a0f18be2ccd8816
Instruction Fuzzy Hash: 532192715093846FD722CF25DC44FA6FFB8EF45214F0884AEE945DB252D364E908CBA5

Function 04971AE1 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04971B64

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: e9fd569053cf156a21d866ab5aa51427dbab8053715d5020ad6ba5ac66f66bd8
Instruction ID: 41621cea163e74ed7fdaeffff65e545135c1a2a3c6bf62ddb87b138c710b9121
Opcode Fuzzy Hash: e9fd569053cf156a21d866ab5aa51427dbab8053715d5020ad6ba5ac66f66bd8
Instruction Fuzzy Hash: 8821A771509384AFD712CF50DC45F56FFB8EF46214F0884DBE9849F252D368A548C765

Function 04972C2B Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04972CA7

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 3cfb67495dbfbf05e89f203c3b5bdcde5bd4a18bf73074d23c7f2fb2ae8d8356
Instruction ID: f2a7fae31bf0116c2c28e9ff0deed47c207995bf14fa4bfec81002afb0031569
Opcode Fuzzy Hash: 3cfb67495dbfbf05e89f203c3b5bdcde5bd4a18bf73074d23c7f2fb2ae8d8356
Instruction Fuzzy Hash: 3621C3715093846FD722CF10DC44FA6FFB8EF55614F08849AE9459F252C374A508C7A5

Function 04971E7B Relevance: 1.6, APIs: 1, Instructions: 68networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 04971EFA

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 406c777382a469871722fec3603066c964da2f2088bfd5e8cfc30a21a477b1eb
Instruction ID: d4cea8a25dc7c8852ac5e65627897c03320b62f27257f56f5e1eed8149c3745d
Opcode Fuzzy Hash: 406c777382a469871722fec3603066c964da2f2088bfd5e8cfc30a21a477b1eb
Instruction Fuzzy Hash: 652195755097809FDB22CF65DC44A52FFF4EF06310F0984EAE9858F262D375A809DB61

Function 0497128E Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 049712FA

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 06b414fbb0de24c15faf1e7e7bfd93a0cc39b3d3051bdbbef582110c6b8fbb1f
Instruction ID: 827f6b2171e49723042832144d4348273718a28153dcda0fc9ed082e03ba2097
Opcode Fuzzy Hash: 06b414fbb0de24c15faf1e7e7bfd93a0cc39b3d3051bdbbef582110c6b8fbb1f
Instruction Fuzzy Hash: 4821CD71604200AFEB21CF55CD45BA6FBE8EF08324F04886EED858A751D375F408CBA6

Function 0497186A Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 049718DE

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 99b1192a3cf6fedd1407724cda367bf51a7954d3be51b5d0a465953a0fa58396
Instruction ID: ff1fbbe991bac3af4aa5e73a257db0ad260ecbdda81763b29fa94fffe928e6f3
Opcode Fuzzy Hash: 99b1192a3cf6fedd1407724cda367bf51a7954d3be51b5d0a465953a0fa58396
Instruction Fuzzy Hash: 7521DE71604200AFEB21CF15DC85FA6FBE8EF18224F04886DE9898B751D375F909CBA5

Function 0497213A Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 049721C3

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c839fccdf301abb31efe04fffb7c3f90c4d824dc5326394b91e8f18a1048106d
Instruction ID: 4aca9681ea98f7af7d5cfc625565e848d53130d64fc97cb3845f3eb5176f8396
Opcode Fuzzy Hash: c839fccdf301abb31efe04fffb7c3f90c4d824dc5326394b91e8f18a1048106d
Instruction Fuzzy Hash: 8411D6715053406FE721CB15DC85FA6FFB8EF45720F08809AFD849B292D264F948CB65

Function 049715CE Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04971640

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 379696827b4b75798c333e3e89c2b8a8727373a7f2982d3310dff3bb4018a435
Instruction ID: 603413e77612a0f1d5d271a37ec5d9c248f8cc4305e99b7a9d756dc556c14c40
Opcode Fuzzy Hash: 379696827b4b75798c333e3e89c2b8a8727373a7f2982d3310dff3bb4018a435
Instruction Fuzzy Hash: 7511A972600200AFEB21CE15CC85FA6FBECEF04620F08856AE9458A751D364F908CBB5

Function 04971CDE Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04971D3D

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 37a51c3e69b5f1373f1a059d33519d613d24c61c37d4d91a198fe4e619aac8d8
Instruction ID: c9241ea67d3f16f1f611ebf448d2098379141319703f28a21edb5e50a673974b
Opcode Fuzzy Hash: 37a51c3e69b5f1373f1a059d33519d613d24c61c37d4d91a198fe4e619aac8d8
Instruction Fuzzy Hash: 06119072600200AFEB21CF55DC45BAAFBECEF14324F04C86AE9458A651D775E908CBA5

Function 04972DFE Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04972E57

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: c1c7d531e4069ea106ff06ca97a862c78e8d6112a07861b1951aa763209081dc
Instruction ID: 1b5ede4d7e09dc7c527f09311632a4a989ea0fc1f4872ae0fc9f32e440086f78
Opcode Fuzzy Hash: c1c7d531e4069ea106ff06ca97a862c78e8d6112a07861b1951aa763209081dc
Instruction Fuzzy Hash: BC11B2716042009FEB21CF15DC45BAAFBECDF44224F0488AAED458B641D774E9088BA5

Function 04972EE2 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04972F3B

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: c1c7d531e4069ea106ff06ca97a862c78e8d6112a07861b1951aa763209081dc
Instruction ID: f726bc9ac5e3196b4e900ee90fb945f8626db4166ad660839936bbcdb0ce0e00
Opcode Fuzzy Hash: c1c7d531e4069ea106ff06ca97a862c78e8d6112a07861b1951aa763209081dc
Instruction Fuzzy Hash: 9911B2716002009FE721CF15DC44BAAFBECEF04224F0488AAED45CB641D774E9088BA5

Function 04970AA2 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04970AF8

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 65a1337eb58834adf405ed9f5af54306bc15d608f1b79cf703eb9d1358d37846
Instruction ID: 66a76374ccb4a223553363e26174e92df80024f766f12b2adf8f224cfb64492c
Opcode Fuzzy Hash: 65a1337eb58834adf405ed9f5af54306bc15d608f1b79cf703eb9d1358d37846
Instruction Fuzzy Hash: D711A371604204AFEB21CF15DC85BAAFBECDF04224F04887AED45CB641E774E9088BB5

Function 04972C4E Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04972CA7

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: d406c97bce6982809bc534a02bcb8c55a9b037326ba8d6f38f4afc8f116bea38
Instruction ID: 776bf46bc45b7e0adf2f42bf185bdf1c3be4dad244ed3ef619cebd8c077640a5
Opcode Fuzzy Hash: d406c97bce6982809bc534a02bcb8c55a9b037326ba8d6f38f4afc8f116bea38
Instruction Fuzzy Hash: F7119175604204AFE721CF55DC44FA6FBECEF14724F0888AAED458B641D375E5088BB5

Function 04971B0E Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,70451A63,00000000,00000000,00000000,00000000), ref: 04971B64

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: f69b9292b2790620fd05aeb182c4b59259c2e72e481909ee64a41b8ecb463c83
Instruction ID: 1e96d7633252ece254fca3c0686c563c251710395a01005dd4d9e94deacb07a1
Opcode Fuzzy Hash: f69b9292b2790620fd05aeb182c4b59259c2e72e481909ee64a41b8ecb463c83
Instruction Fuzzy Hash: C7110271604200AFEB21CF14DC85BAAFBECDF04324F08886AED049B345E378E5088BB5

Function 0497215A Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 049721C3

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9fe887d6c27dd6d25f9e3468d822cfac85c3b6c8c89028b7bc72e58f73f289b6
Instruction ID: 22b43fcd7931fa722a908699aa510db12176a858f7fd297b6cf94aafe12346ba
Opcode Fuzzy Hash: 9fe887d6c27dd6d25f9e3468d822cfac85c3b6c8c89028b7bc72e58f73f289b6
Instruction Fuzzy Hash: 5411E571600200AFE7208B15DD85FA6F7ACEF14724F0484A9FE444A781D3B8F948CBA5

Function 04972D2A Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 04972D80

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 657e63ec49fd0ee2b9d7c27b45993f9856859da811ea45d1ccdcb2063c34b1d5
Instruction ID: bb73dc3af2625eb974354b0a40593895ccc7a3813f21cfe0c3eeba0247ee5dc0
Opcode Fuzzy Hash: 657e63ec49fd0ee2b9d7c27b45993f9856859da811ea45d1ccdcb2063c34b1d5
Instruction Fuzzy Hash: A4112B756042449FDB20CF59D884B96FBE8EF04710F08C4BAED498B691E375E948CB61

Function 04971EAE Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 04971EFA

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: dbab1e2d47c862c0534cb8ac14bd39858acc6b81ad4e3ca2ef09231196bfa0e4
Instruction ID: 3e8a3c7edbbbc687c98e4b3d4fa962750a79840f2163f8a7fd0f24ba8d94c4e7
Opcode Fuzzy Hash: dbab1e2d47c862c0534cb8ac14bd39858acc6b81ad4e3ca2ef09231196bfa0e4
Instruction Fuzzy Hash: C0117C316042049FDB20CF55D885B56FBE8EF08320F0889AAED898B762D375E818DB61

Function 049711F2 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 04971242

Memory Dump Source

Source File: 00000002.00000002.4539445780.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4970000_server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0ce08f2953d85334865954b3a88939900fafdfd8441f71560eda9227021e8efc
Instruction ID: 27888aaa3dd21082b314717d9463097be618db491402b4ef2a1f4ceab0930258
Opcode Fuzzy Hash: 0ce08f2953d85334865954b3a88939900fafdfd8441f71560eda9227021e8efc
Instruction Fuzzy Hash: 5701A271A00200ABD310DF16CC86B66FBE8FB88A20F14811AEC489BB41D771F956CBE5

Function 048C7F10 Relevance: 1.2, Instructions: 1243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463fc7ac38c287023d97e08a3e48309eb42e89ef06256f45b59e11de02c6da74
Instruction ID: a54726c2fc35a3007402b92de916f7ff8dcdb1eaeb698d87d6fc8207f498f61b
Opcode Fuzzy Hash: 463fc7ac38c287023d97e08a3e48309eb42e89ef06256f45b59e11de02c6da74
Instruction Fuzzy Hash: CFC29D74B04164CFDF21AB7EE9007A977B6AB4D305F0085AB9809DB788DB349D58EF60

Function 048C7F8C Relevance: 1.1, Instructions: 1079COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6cb2b6d0f7eadc3d6c89c27d4245e029f2b0b0f8aa439a15c377f83e2255d9
Instruction ID: 651784a1dc726132c910341c946b1c5758a8c84dca8690ea1026a8528627f7b4
Opcode Fuzzy Hash: cd6cb2b6d0f7eadc3d6c89c27d4245e029f2b0b0f8aa439a15c377f83e2255d9
Instruction Fuzzy Hash: 5092AC347041649FDF21AB7ED9107A937A6AB8C309F00886B944DDB798DF34ED58EB60

Function 048C7FC6 Relevance: 1.1, Instructions: 1076COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac10ee6a706e296b6355793a76d52331092cc81eb97d2ec0c6f0ef74f782b840
Instruction ID: e89eafc88b2be32cfbc6c5d1ba0d4c5924d2dcab47d824f2b05d690df594248b
Opcode Fuzzy Hash: ac10ee6a706e296b6355793a76d52331092cc81eb97d2ec0c6f0ef74f782b840
Instruction Fuzzy Hash: 7892AC347041649FDF21AB7ED9107A937A6AB8C309F00886B944DDB798DF34ED58EB60

Function 048C7FF5 Relevance: 1.1, Instructions: 1075COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ecfb8206216bb82024352c2d194032c8e05bf4eb18b70a20889f8d88ff5403
Instruction ID: 556c62d5978998911aa4336ee5ed0123d3f63f9b01ce7b48ab09e9572d2858b3
Opcode Fuzzy Hash: 03ecfb8206216bb82024352c2d194032c8e05bf4eb18b70a20889f8d88ff5403
Instruction Fuzzy Hash: F192AC347041649FDF21AB7ED9107A937A6AB8C309F00886B944DDB798DF34ED58EB60

Function 048C562A Relevance: 1.0, Instructions: 963COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6391655af6c7a24ea56cff8724a90ed870a188e29e5964ee9e1eed2aa122c3fe
Instruction ID: 6ef31f14a80a9a0bb8d5784d8543f805a02b735e56231c9f3b85f8a0082aa946
Opcode Fuzzy Hash: 6391655af6c7a24ea56cff8724a90ed870a188e29e5964ee9e1eed2aa122c3fe
Instruction Fuzzy Hash: CBB24974A01228CFDB25EF34D854BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C57A1 Relevance: .9, Instructions: 906COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a0e1f601cf92c8710b4e673da22912b0f1e1f8ee98e52b454be8ed018e7ebc
Instruction ID: feb6475db0b980b9dafa9ce19730818ea5ac04c14875bdd1e9655ea31cc4f7aa
Opcode Fuzzy Hash: 68a0e1f601cf92c8710b4e673da22912b0f1e1f8ee98e52b454be8ed018e7ebc
Instruction Fuzzy Hash: 92A24974A01228CFDB25EF34D954BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C5918 Relevance: .8, Instructions: 849COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57865f26d98e269dee67efb5858a2b5a04c3405bc2096f5f4367a6c2051c6ead
Instruction ID: 75734db95e424db6ba6844e0d18cc4d91d1e408b056efffcf7482b75abf111c9
Opcode Fuzzy Hash: 57865f26d98e269dee67efb5858a2b5a04c3405bc2096f5f4367a6c2051c6ead
Instruction Fuzzy Hash: C5924A74A01228CFDB25EF34D854BA9B7B2FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C5A8F Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d253e05b3f852e961d931bd88691f0828d19ea1ab34d1226ce6c8fbcecba78c
Instruction ID: c15bfd7bea7a3b8ca72dfbeb1e85fb1a2412d1471bffff3b2461778e0accc485
Opcode Fuzzy Hash: 8d253e05b3f852e961d931bd88691f0828d19ea1ab34d1226ce6c8fbcecba78c
Instruction Fuzzy Hash: 4A924A74A01228CFDB25EF34D954BA8B7B6FB49304F1041E9D509AB3A8DB359E85DF80

Function 048C5C06 Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad52d463bc1c90cff2dce4c7bbf5a0627662aa7dd7c64ffa40d4679f55cc8497
Instruction ID: dc71bc6c250dd232f1a3b19dfa19cdad2661a9086d7832a050659ede3e2f48ec
Opcode Fuzzy Hash: ad52d463bc1c90cff2dce4c7bbf5a0627662aa7dd7c64ffa40d4679f55cc8497
Instruction Fuzzy Hash: 01824A74A01228CFDB25EF34D954BA8B7B6FB49304F1041E9D909AB398DB359E85DF80

Function 048C5EF4 Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d6f556e00faa56631d7b6fcca96f05f7ae3f10855f5fb51d84c7ab91cfb86a
Instruction ID: e4cccb5b5169bdcf346d648716d4c6294edafe3aa779c2d039ef70a547ba9e3b
Opcode Fuzzy Hash: 43d6f556e00faa56631d7b6fcca96f05f7ae3f10855f5fb51d84c7ab91cfb86a
Instruction Fuzzy Hash: 3B623A74A00228CFDB25EF34D854BA8B7B6FB49304F5041E9D909AB398DB359E85DF80

Function 048C61E2 Relevance: .5, Instructions: 507COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 010415143ac249f948216d09a805c3d19e82abcec11156eba495b76738fec8b2
Instruction ID: 68171652926f8639d1e94f0bc88db128025a569c15a4a067593e288ce013c831
Opcode Fuzzy Hash: 010415143ac249f948216d09a805c3d19e82abcec11156eba495b76738fec8b2
Instruction Fuzzy Hash: 76424C74A00228CFDB25EF34D954BA8B7B6FB49304F1041EAD909AB398DB359E85DF40

Function 048C3802 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a1205721015c26838f5604ca7ee446d548f5cd067f2b2aacc68a80f0c977fc8
Instruction ID: b629a3ab190911dd79e512b8b4df024728c22c04e4186833052723846c99c976
Opcode Fuzzy Hash: 9a1205721015c26838f5604ca7ee446d548f5cd067f2b2aacc68a80f0c977fc8
Instruction Fuzzy Hash: C0322970A00218CFDB25EF74C955BEDB7B2AB49308F1045A9D509AB3A8DB359E85CF80

Function 048C6359 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0882290229b8733c1c2cab331c41ac3a0b8376ebb445723572461d72a34bca42
Instruction ID: f1c285b4a81ff1bd1f757861564f22a65ac516cce0de5ac39f0e6d65c3da490d
Opcode Fuzzy Hash: 0882290229b8733c1c2cab331c41ac3a0b8376ebb445723572461d72a34bca42
Instruction Fuzzy Hash: 67323C74A00228CFDB25EF34D954BA8B7B5FB49304F1085EAD909AB398DB359E85DF40

Function 048C6483 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac5d583b8ebdd9d1b726fd93411f6f583aab5f8b40dbb88ae336c7d03387793
Instruction ID: c59ac82c448583c5d35d7ace167a423b76cd504087fce8707f41e671fc37d135
Opcode Fuzzy Hash: 3ac5d583b8ebdd9d1b726fd93411f6f583aab5f8b40dbb88ae336c7d03387793
Instruction Fuzzy Hash: CD224D74A00228CFDB25EF34D954BA8B7B5FB49304F1081EAD909AB398DB359E85DF40

Function 048C67A9 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da52812b6306b4d320f1d8d37bbb9ca049090e26b57b425de304d7f3dae3535
Instruction ID: 9180d4a88fe3061cc2d6ecb38a1cee49078172b704354246ed8c1ae171246b12
Opcode Fuzzy Hash: 0da52812b6306b4d320f1d8d37bbb9ca049090e26b57b425de304d7f3dae3535
Instruction Fuzzy Hash: A4023974A00228CFDB25EF34D854BA9B7B6FB49304F5041EAD909AB398DB359E85CF40

Function 048C9538 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf803a7552ea7e475b7dd5b5dc2055d0f910846c0867630b2f467ffa2384696
Instruction ID: 9e1905127052b4f362f9b84d644bf5682e020828c952bbdac83c3046e471100f
Opcode Fuzzy Hash: eaf803a7552ea7e475b7dd5b5dc2055d0f910846c0867630b2f467ffa2384696
Instruction Fuzzy Hash: 58D14F70E00208DFCB09EFB5E45166D77B6AF48348B60952DD4169B7A8DF39AC05DF90

Function 048C7AD8 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f5fb2fa6e82861ef8144015dd82fa898788e02af6dd7aac7e2bbaf8d18ad82
Instruction ID: df272d620011f4b02cab12771b3b8787074f136a32b42e1a13c8b1e62cbdaaa7
Opcode Fuzzy Hash: 97f5fb2fa6e82861ef8144015dd82fa898788e02af6dd7aac7e2bbaf8d18ad82
Instruction Fuzzy Hash: 0FA1F132B00202CBC714EB39C944BAD72E2AB85354F544A7CD512DB3D9EB39EC49DB91

Function 048C690A Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18be16873c692ee00866caa84a8b884336eb114e18ecfae85ff15745254ba9aa
Instruction ID: 02af324114e93975dff8b75d31fa49cd80442c039e07d969c06cf8f506bdf462
Opcode Fuzzy Hash: 18be16873c692ee00866caa84a8b884336eb114e18ecfae85ff15745254ba9aa
Instruction Fuzzy Hash: 58D13874A00228CFDB25EF35C894BADB7B6BB49304F5045EAD509AB398DB359E85CF40

Function 048C9529 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 753497b40d5f42d6a7c4c2b9858f0b749d3515070b6905b8760685b5cfc88e8b
Instruction ID: a8e99230191ffe615385fd894f51c5c1ac9e4c8715029edea02305151605dcad
Opcode Fuzzy Hash: 753497b40d5f42d6a7c4c2b9858f0b749d3515070b6905b8760685b5cfc88e8b
Instruction Fuzzy Hash: B2B14E70A00204EFCB19EF75E451A6E77B6AF88348B60952DE4159B3ACDF39AC05DF90

Function 048C963D Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07afd95efbea947cf589b73b2b40539af871697b04b09f2600648c78bfdee46
Instruction ID: 029bc49b0d282a6a0bb5def14cb8832633e41edc0b4be8df0c2c14f5b88e11df
Opcode Fuzzy Hash: f07afd95efbea947cf589b73b2b40539af871697b04b09f2600648c78bfdee46
Instruction Fuzzy Hash: D0915D34A00204EFCB19AFB9E45166D73B6AF88348B60952DE4159B3ACDF39AC05DF90

Function 048C969B Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb227ad9618c1bf7f118923834a240b8048afa7d880284e9498cd9c37f993d78
Instruction ID: c8cada445107cd31bbd69fcdb351eed70b6b42018acb52cfb269607b26d858e3
Opcode Fuzzy Hash: fb227ad9618c1bf7f118923834a240b8048afa7d880284e9498cd9c37f993d78
Instruction Fuzzy Hash: 05914E34B00204EFCB19AFB9E45166D73B6AF88308B60956DE4159B3ACDF39AC05DF90

Function 048C96EB Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aafdd460be0f595a814bc6e0faeb8fddcc6cbb649a89c2a086716cb70297f02
Instruction ID: 0976d8f70be9aa5155d02a26f0411dec263ad860803a2a4217640ec6ff840d9c
Opcode Fuzzy Hash: 5aafdd460be0f595a814bc6e0faeb8fddcc6cbb649a89c2a086716cb70297f02
Instruction Fuzzy Hash: 8F813D34B00204EFCB1AAF79E45166D73B6AF88308B60956DE4159B7ACDF39AC05DF90

Function 048C6B55 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793a5a2a6d4019d787981811227421fb2e020d9085e1bd63ac2385f5094cf488
Instruction ID: c78b63ca1280d6cb3e29b500a2b42a09a52f50e64aa1dc9d97a720766e7cce25
Opcode Fuzzy Hash: 793a5a2a6d4019d787981811227421fb2e020d9085e1bd63ac2385f5094cf488
Instruction Fuzzy Hash: 9D915F74A001288FDB65EB35C851BAD73B6AF88308F5046EE9509AB394DF399E85CF44

Function 048C3DCC Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e263c94b7871f593867b6f5b3ca87982fea04214dd960f9c219fbb9dfd55ea4f
Instruction ID: 6c71803b2151d479805425523dd318527b32481aec869765254ec1d0bf3398f5
Opcode Fuzzy Hash: e263c94b7871f593867b6f5b3ca87982fea04214dd960f9c219fbb9dfd55ea4f
Instruction Fuzzy Hash: 38A1F274A00218CFCB25EF74D991BACB7B2FB49308F1045A9D909AB359DB359E85DF80

Function 048C976D Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b8b36d9256e36e98494e9ede19ee92b1e9588b1820f301791196c44f4104b0
Instruction ID: 66e655e2ada3fb761e76fda57d66f49c79b6061f112c90d3998d0e92ada037a8
Opcode Fuzzy Hash: a8b8b36d9256e36e98494e9ede19ee92b1e9588b1820f301791196c44f4104b0
Instruction Fuzzy Hash: 0D715E34B00204DFCB1AAFB9E45166D73A6AF88308B60956DD4159B7ACDF39EC05DF90

Function 048C39BF Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94af5d1824d156184c81c31ffed61b66659e29900ebee410a7fc5c068214042d
Instruction ID: acc32dfaa39e3c0b312ffb9c2ac23607e9d217ddb1872de38a59af12f5f58b13
Opcode Fuzzy Hash: 94af5d1824d156184c81c31ffed61b66659e29900ebee410a7fc5c068214042d
Instruction Fuzzy Hash: 4D817D30A01218CFDB24EFB4C855BEDB7B2BF45308F1045A9D50AAB2A8DB799D85CF51

Function 048C6C46 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106498dbdda2c848af712d34516e7c3ac5412e89ba815063d66c32182a4552bf
Instruction ID: 5dd6c91047fc44355a54604ca1cfb0eb335a585d97cbc69eba926a308eb5c0fe
Opcode Fuzzy Hash: 106498dbdda2c848af712d34516e7c3ac5412e89ba815063d66c32182a4552bf
Instruction Fuzzy Hash: D0615070A00128CFDB25EB35C995BAD73B5AF48308F5046EE9509AB394DF399E85CF40

Function 048C7AC8 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2d2c2fcf779593ddd9a4f8469b31a081222fa7218b998da248791c867a18ea
Instruction ID: 59806609b72caf37cd8794bc669dbaef3b49d51c6375fff895c60344e206e0af
Opcode Fuzzy Hash: ae2d2c2fcf779593ddd9a4f8469b31a081222fa7218b998da248791c867a18ea
Instruction Fuzzy Hash: A5511F71A04206CFDB24EF36D8047A977E2AB41314F588A78E401DB2E5EB34E94ADF60

Function 048C985D Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463a25f083c2e74863c9527a2ff0eedac82491c99f53af5940e97fc28feeacf0
Instruction ID: 9e0261b1c6d665179ba62637b9ac1ca4b6269a46d119eef39480f5239d20adff
Opcode Fuzzy Hash: 463a25f083c2e74863c9527a2ff0eedac82491c99f53af5940e97fc28feeacf0
Instruction Fuzzy Hash: 44518034B002149FCB19AFB9E45176D73A6EF88348F20856DD8159B3A8DF39AC05DB90

Function 048C7EB6 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c466bb0d7b6bc58ddecc58a796c76d5191148768329f34f7e0ff8913e7e706d
Instruction ID: 6a5ea64d2c9869461456e0641da7fa1f7f2276d2fd56af2405472f45e939b5e0
Opcode Fuzzy Hash: 5c466bb0d7b6bc58ddecc58a796c76d5191148768329f34f7e0ff8913e7e706d
Instruction Fuzzy Hash: 0241EE31B04216CFDB25EF36D8057A872E2AF41318F588A69D411DB2D5EF38E94ADF60

Function 048C3B18 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7cdb642c2618dfb407b336b997d80574e415eca917c5dced2462dc0c21a3b5
Instruction ID: e332b50d634e4a6ca6231c94b7d03a58f822ec3aad593b42227939324733673e
Opcode Fuzzy Hash: 8b7cdb642c2618dfb407b336b997d80574e415eca917c5dced2462dc0c21a3b5
Instruction Fuzzy Hash: 26415E30A002188FDB24EBB8C954BECB7F2BF45308F4045AAD409AB2A9DB755E48CF51

Function 048C02C0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786ae4c81c009d1662beaa7356e86f1a66cef13260eba3662b4446ff91c276bf
Instruction ID: c484b9854870df6f7744b0da27d1c686b8627cdf5501bbbb6e0d2046c5673974
Opcode Fuzzy Hash: 786ae4c81c009d1662beaa7356e86f1a66cef13260eba3662b4446ff91c276bf
Instruction Fuzzy Hash: 6D31B531B002018FDB14BBBCD811BBE32ABAB89208F104839D509DB7A9DF799D59D7D1

Function 048C9E38 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1872c5d44370d5ae68a08bca20a6f7d70e94eae03128189f1e624e90341e4384
Instruction ID: 99fac322b97a19abd04044b22a2a635cabaec9de879e7c2e2be4ab771ff60230
Opcode Fuzzy Hash: 1872c5d44370d5ae68a08bca20a6f7d70e94eae03128189f1e624e90341e4384
Instruction Fuzzy Hash: 9A31B3B0B102059FDB14DB39C854BAEBAF6AF88304F14457DD405EB7A1DBB4E804CB90

Function 048C00B8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6fc42b812f60922248f18191cff43cf05630df2bab25e9747c1f5fa822c649d
Instruction ID: 6e71fb0de654b1079de552d0180c1bbac1b4440eb9e73921aa321a7947e74fae
Opcode Fuzzy Hash: e6fc42b812f60922248f18191cff43cf05630df2bab25e9747c1f5fa822c649d
Instruction Fuzzy Hash: BF31E3326043449FC725AB789821BAE3BA7ABC2348B0485BDD105CF2E6CF795C09C791

Function 048C7350 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35693c58e9a9beb59f907cdca3f47e5943458c7b82de0eb1e10f1ebdd5c1cb5c
Instruction ID: c352cd1af377d12372834a344e089c6e558922d9ecb5a68dbd96a4d58fc7499d
Opcode Fuzzy Hash: 35693c58e9a9beb59f907cdca3f47e5943458c7b82de0eb1e10f1ebdd5c1cb5c
Instruction Fuzzy Hash: 112126756083458FC7216B78A8144AD7BF1EF832067454AFED481CF396EB38580A8B92

Function 047422B8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539219155.0000000004740000.00000040.00000800.00020000.00000000.sdmp, Offset: 04740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4740000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d50150d21a8c2cde0a8d2607ca23a794635d5b386597ad47a337429be870c9d
Instruction ID: 44880fdf31d6a8d29e1ce544e292877da28347d9b63054bef2f22994dee29df5
Opcode Fuzzy Hash: 8d50150d21a8c2cde0a8d2607ca23a794635d5b386597ad47a337429be870c9d
Instruction Fuzzy Hash: 4A11BDB5908341AFD350CF19D841A5BFBE4FB88664F04896EF998D7311D235E9048FA2

Function 048C9B57 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966f1c66c6d8f44fb3a68d2c4cc91e1b4677d44c552149310222a9cb04ed350f
Instruction ID: 338bd4f96057c6e052a3e343716a6fc1a9607a90adc4808c4cfec74033bade5b
Opcode Fuzzy Hash: 966f1c66c6d8f44fb3a68d2c4cc91e1b4677d44c552149310222a9cb04ed350f
Instruction Fuzzy Hash: E311C271E002098FCB18EF78D8015AEB7FAEF9A254B21017DC405EB744EB349E45CB90

Function 048C0118 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42f187ec99ace962227fbcef1a9e9f2ad4e1fd0783dba023560aafa4ea8d5cd3
Instruction ID: 704f07c9dfeae5140cb75a88c889e0f932b919cb08b827f22beef0dccd37d57e
Opcode Fuzzy Hash: 42f187ec99ace962227fbcef1a9e9f2ad4e1fd0783dba023560aafa4ea8d5cd3
Instruction Fuzzy Hash: 371170326142448FC325BB7C9421A6E3BD7ABC634834594BDD0058F3BACF794C09D792

Function 0090B454 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4533951594.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fde0539cacab40fdec4ae1fb01001c1a0043f16662d7196964ff69619b9e712
Instruction ID: df745273052a717f94dd305afd68867793d24f11b865ffc81735d428dadf3929
Opcode Fuzzy Hash: 5fde0539cacab40fdec4ae1fb01001c1a0043f16662d7196964ff69619b9e712
Instruction Fuzzy Hash: EA11BEB5908301AFD350CF09DC41E5BFBE8EB88660F04892EF95997311D275E908CFA2

Function 048C0007 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a9f6c6043a0f84def8076ded4643f271baf3c9e20f60d6380bcf77ec5572ab
Instruction ID: c5c3bc12a6ecb1f38c8316e3e8dfc399f45f5b46a77f92763eb017091f937dc7
Opcode Fuzzy Hash: 12a9f6c6043a0f84def8076ded4643f271baf3c9e20f60d6380bcf77ec5572ab
Instruction Fuzzy Hash: 21119D6245E3C19FC3135734A8296917FB46E43219B0E89DBD080CF2A7D26C4A0AD7A2

Function 048C01E1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a98157f2a25fb4350178a0db5ac2606da5f828d95613b74efbbdc2c178df6fd0
Instruction ID: ac508294d984421342902214d94f9be68d8be88f39dcea252022ed7541bb096e
Opcode Fuzzy Hash: a98157f2a25fb4350178a0db5ac2606da5f828d95613b74efbbdc2c178df6fd0
Instruction Fuzzy Hash: F801807110A242DFCB10EB3CD55985D7BE1EFC5309B14882CE646CB359DB359848EF42

Function 048C00A8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 632aef7fc50e7e86b2dc7605a5ecf33107f45f36d49b383aad291244c96cce9c
Instruction ID: 6c1ec23fed20f9002855d180fc5fe7a468e40561efc35f60b953590a9f791760
Opcode Fuzzy Hash: 632aef7fc50e7e86b2dc7605a5ecf33107f45f36d49b383aad291244c96cce9c
Instruction Fuzzy Hash: A4F06272A05304AFEB14EF708812BAE7BB3EF81714F1486BEA141DB1D1DA355941C780

Function 04742323 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539219155.0000000004740000.00000040.00000800.00020000.00000000.sdmp, Offset: 04740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4740000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c89509297a1775f7d6f0f2114a34879a96fa520ef57260750c3cca6cd21ece
Instruction ID: f8106cebbbc2b8c9b1306485e87b69b78a2c28d2c3849b3d97079587781107e5
Opcode Fuzzy Hash: 46c89509297a1775f7d6f0f2114a34879a96fa520ef57260750c3cca6cd21ece
Instruction Fuzzy Hash: 1BE0D8B294120067D2108F0AAC46F52FB9CDB44931F04C567ED091B741D175B5188AE1

Function 04741BCF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539219155.0000000004740000.00000040.00000800.00020000.00000000.sdmp, Offset: 04740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4740000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15480f3a9fa9f05daaea25165c90922eaa9f8cd8c8e19b346238f58a554a9780
Instruction ID: 9baf1c124db38ead87474ecc7090fe42e2909522149aca494fd1997970784ce7
Opcode Fuzzy Hash: 15480f3a9fa9f05daaea25165c90922eaa9f8cd8c8e19b346238f58a554a9780
Instruction Fuzzy Hash: 9AE0D8B290020067D210DF0AAC45F53FB9CDB40930F04C567ED091B701D176B614CAE1

Function 0090B4A3 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4533951594.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c280d9fde823f8dfe3acbbf2ea29458635a69cdbe4031b4ce5ea79d72c27f3a0
Instruction ID: 17478be4320ede5a9e303bc2866a8d90c1a727670617cfc49a4ecc26fe1e46ad
Opcode Fuzzy Hash: c280d9fde823f8dfe3acbbf2ea29458635a69cdbe4031b4ce5ea79d72c27f3a0
Instruction Fuzzy Hash: 41E0D8B294020467D2108F0AAC45F52F79CDB40931F04C56BED0D5B711D175B504CEF1

Function 048C4200 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7fd43f0756304ae406e1a8a36150298e11dc2c8e35b866f0cee57d50830fc40
Instruction ID: 06ce0bc063869f4e6fda2eea1de08f877e4cbb2eb4cd0dc2ddb4083c73c51d18
Opcode Fuzzy Hash: a7fd43f0756304ae406e1a8a36150298e11dc2c8e35b866f0cee57d50830fc40
Instruction Fuzzy Hash: DDE0867094E2889FCB01CF7498514DC7FF1EB0620172141FED849C7662DA750D05DB02

Function 048C9DF8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ffde114797301f49dc35d2cae61f5f0bb340923ebea4ad8552ce4a19ccab01
Instruction ID: b2165cc41a73177afe9751a2341a4977948a0c4c1b0795d699cde1e8a443c823
Opcode Fuzzy Hash: b3ffde114797301f49dc35d2cae61f5f0bb340923ebea4ad8552ce4a19ccab01
Instruction Fuzzy Hash: 05E012B1549244DFCB15DBB4A9154FC7BB0DA5620171141EEC846D7262EE75094ACB41

Function 048C36A8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18585a702a91d0566da84d212c4d4dcde96863272cc93734723ddab9b4476586
Instruction ID: 142612419e487ea11c5e788cb74e7e2e12ba288b17198450d87364fc576a14af
Opcode Fuzzy Hash: 18585a702a91d0566da84d212c4d4dcde96863272cc93734723ddab9b4476586
Instruction Fuzzy Hash: 02E0C23014B340CFC71A2B70A42581C3FB1AF4720535408FEC1068B366DB7A8886CF10

Function 008F23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4533846098.00000000008F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f2000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e723b9032fff584232f912b8ca0fbe251079569d8dfcbb8deedd927db0f6dbc
Instruction ID: 04126cf8b8e857d5cc0269baa1636c7ef866ad1fb11cdcf9f4a679a2c8643cf0
Opcode Fuzzy Hash: 9e723b9032fff584232f912b8ca0fbe251079569d8dfcbb8deedd927db0f6dbc
Instruction Fuzzy Hash: 34D05E792056D54FD327DB2CC6A4BA537D4FB61714F4A44FAA800CB763C7A8D981D610

Function 008F23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4533846098.00000000008F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f2000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb9904ff338044e5e5c1ada810abb91bcb40ba1d4965cadb99270b3ccab29bf
Instruction ID: 423112e7ef169523e7aea76ccd8279a02cc8424a5b196393fb739784ef1b3575
Opcode Fuzzy Hash: ccb9904ff338044e5e5c1ada810abb91bcb40ba1d4965cadb99270b3ccab29bf
Instruction Fuzzy Hash: CFD05E743006854BC729DB1CC2D4F6937D4BB40714F0645E8AC10CBB72C7A8D8C4DA00

Function 048C4210 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4539376509.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48c0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57438f0d85325c298b05f25d5eca84743f4336872b87db1d53ba748585eec39
Instruction ID: 85d1b47404ad22d1529adf0f2ecbdaf3b98b7dff3ab34edafd5fe6e1249a7956
Opcode Fuzzy Hash: a57438f0d85325c298b05f25d5eca84743f4336872b87db1d53ba748585eec39
Instruction Fuzzy Hash: AAD0C971A15208EF8B44EFA8DD0189DB7F9EB46215B1041AAA80DD3750EE325E04EB81

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report a1K847qsM0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Notepad.exe

C:\Program Files (x86)\Explower.exe

C:\Users\user\AppData\Local\Explower.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Explower.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Microsoft Corporation.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\a1K847qsM0.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe

C:\Users\user\AppData\Local\Temp\server.exe

Windows Analysis Report
a1K847qsM0.exe