Windows Analysis Report
nKHN8rvjmN.exe

AI detected suspicious sample

Source: Yara match	File source: nKHN8rvjmN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nKHN8rvjmN.exe PID: 3304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 6044, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explore.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explore.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explore.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explore.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\server.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explore.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explore.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explore.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: nKHN8rvjmN.exe

Joe Sandbox ML: detected

Source: nKHN8rvjmN.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Contains functionality to spread to USB devices (.Net source)

Source: nKHN8rvjmN.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Source: nKHN8rvjmN.exe, Usb1.cs	.Net Code: infect
Source: server.exe.0.dr, Usb1.cs	.Net Code: infect
Source: Explore.exe.2.dr, Usb1.cs	.Net Code: infect
Source: Explore.exe0.2.dr, Usb1.cs	.Net Code: infect
Source: StUpdate.exe.2.dr, Usb1.cs	.Net Code: infect
Source: Explore.exe1.2.dr, Usb1.cs	.Net Code: infect
Source: Microsoft Corporation.exe.2.dr, Usb1.cs	.Net Code: infect
Source: 32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe.2.dr, Usb1.cs	.Net Code: infect
Source: Explore.exe2.2.dr, Usb1.cs	.Net Code: infect
Source: Explore.exe3.2.dr, Usb1.cs	.Net Code: infect
Source: Explore.exe4.2.dr, Usb1.cs	.Net Code: infect

Source: nKHN8rvjmN.exe, 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: nKHN8rvjmN.exe, 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: nKHN8rvjmN.exe, 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: nKHN8rvjmN.exe, 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: nKHN8rvjmN.exe, 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: nKHN8rvjmN.exe, 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: nKHN8rvjmN.exe	Binary or memory string: \autorun.inf
Source: nKHN8rvjmN.exe	Binary or memory string: [autorun]
Source: nKHN8rvjmN.exe	Binary or memory string: autorun.inf
Source: StUpdate.exe.2.dr	Binary or memory string: \autorun.inf
Source: StUpdate.exe.2.dr	Binary or memory string: [autorun]
Source: StUpdate.exe.2.dr	Binary or memory string: autorun.inf
Source: Explore.exe1.2.dr	Binary or memory string: \autorun.inf
Source: Explore.exe1.2.dr	Binary or memory string: [autorun]
Source: Explore.exe1.2.dr	Binary or memory string: autorun.inf
Source: Microsoft Corporation.exe.2.dr	Binary or memory string: \autorun.inf
Source: Microsoft Corporation.exe.2.dr	Binary or memory string: [autorun]
Source: Microsoft Corporation.exe.2.dr	Binary or memory string: autorun.inf
Source: Explore.exe0.2.dr	Binary or memory string: \autorun.inf
Source: Explore.exe0.2.dr	Binary or memory string: [autorun]
Source: Explore.exe0.2.dr	Binary or memory string: autorun.inf
Source: Explore.exe4.2.dr	Binary or memory string: \autorun.inf
Source: Explore.exe4.2.dr	Binary or memory string: [autorun]
Source: Explore.exe4.2.dr	Binary or memory string: autorun.inf
Source: server.exe.0.dr	Binary or memory string: \autorun.inf
Source: server.exe.0.dr	Binary or memory string: [autorun]
Source: server.exe.0.dr	Binary or memory string: autorun.inf
Source: Explore.exe2.2.dr	Binary or memory string: \autorun.inf
Source: Explore.exe2.2.dr	Binary or memory string: [autorun]
Source: Explore.exe2.2.dr	Binary or memory string: autorun.inf
Source: Explore.exe.2.dr	Binary or memory string: \autorun.inf
Source: Explore.exe.2.dr	Binary or memory string: [autorun]
Source: Explore.exe.2.dr	Binary or memory string: autorun.inf
Source: 32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe.2.dr	Binary or memory string: \autorun.inf
Source: 32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe.2.dr	Binary or memory string: [autorun]
Source: 32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe.2.dr	Binary or memory string: autorun.inf
Source: Explore.exe3.2.dr	Binary or memory string: \autorun.inf
Source: Explore.exe3.2.dr	Binary or memory string: [autorun]
Source: Explore.exe3.2.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49706 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49704 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49704 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49706 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49720 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49720 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49709 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49724 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49733 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49724 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49709 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49734 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49718 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49752 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49718 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49734 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49719 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49719 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49723 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49741 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49741 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49760 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49760 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49737 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49737 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49752 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49733 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49723 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49749 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49749 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49725 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49722 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49715 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49740 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49728 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49721 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49739 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49738 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49739 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49715 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49751 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49726 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49751 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49726 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49728 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49730 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49725 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49730 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49754 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49754 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49721 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49722 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49705 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49738 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49705 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49729 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49721 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49729 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49731 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49734 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49740 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49736 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49743 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49736 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49735 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49717 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49717 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49735 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49743 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49731 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49753 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49753 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49747 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49747 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49761 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49742 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49742 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49714 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49714 -> 3.67.161.133:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49748 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49759 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49732 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49746 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49746 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49744 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49746 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49748 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49745 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49744 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49761 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49758 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49759 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49758 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49759 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49757 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49757 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49732 -> 18.158.58.205:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49745 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49755 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49756 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49756 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49755 -> 3.64.4.198:14355
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49750 -> 3.127.181.115:14355
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49750 -> 3.127.181.115:14355

Source: global traffic	TCP traffic: 192.168.2.5:49704 -> 3.67.161.133:14355
Source: global traffic	TCP traffic: 192.168.2.5:49730 -> 18.158.58.205:14355
Source: global traffic	TCP traffic: 192.168.2.5:49744 -> 3.127.181.115:14355
Source: global traffic	TCP traffic: 192.168.2.5:49752 -> 3.64.4.198:14355

Source: Joe Sandbox View	IP Address: 18.158.58.205 18.158.58.205
Source: Joe Sandbox View	IP Address: 3.64.4.198 3.64.4.198
Source: Joe Sandbox View	IP Address: 3.127.181.115 3.127.181.115
Source: Joe Sandbox View	IP Address: 3.67.161.133 3.67.161.133

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 5.tcp.eu.ngrok.io

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: nKHN8rvjmN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nKHN8rvjmN.exe PID: 3304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 6044, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explore.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED

System Summary

Source: nKHN8rvjmN.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: nKHN8rvjmN.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: nKHN8rvjmN.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: nKHN8rvjmN.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_0155BDCA NtQuerySystemInformation,		2_2_0155BDCA
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_0155BD99 NtQuerySystemInformation,		2_2_0155BD99

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Windows\SysWOW64\Explore.exe

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_04874298	0_2_04874298
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_04875000	0_2_04875000
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_0487470F	0_2_0487470F
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_04874C8F	0_2_04874C8F
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_04874291	0_2_04874291
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_04874F9D	0_2_04874F9D
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_0487499D	0_2_0487499D
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_04874F2F	0_2_04874F2F
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_04874936	0_2_04874936
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_04874630	0_2_04874630
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_04874544	0_2_04874544
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_048747D4	0_2_048747D4
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_0487505D	0_2_0487505D
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_04874B5B	0_2_04874B5B
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_04875459	0_2_04875459
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_048750E3	0_2_048750E3
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_0487536F	0_2_0487536F
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_048744F1	0_2_048744F1
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Code function: 0_2_048749F9	0_2_048749F9
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_05727900	2_2_05727900
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_057274C7	2_2_057274C7
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_05724290	2_2_05724290
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_0572427F	2_2_0572427F

Source: nKHN8rvjmN.exe, 00000000.00000002.2029601766.00000000007CE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs nKHN8rvjmN.exe

Source: nKHN8rvjmN.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: nKHN8rvjmN.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: nKHN8rvjmN.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: nKHN8rvjmN.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: nKHN8rvjmN.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explore.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.spre.phis.troj.adwa.evad.winEXE@24/18@4/4

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_0155BC4E AdjustTokenPrivileges,		2_2_0155BC4E
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 2_2_0155BC17 AdjustTokenPrivileges,		2_2_0155BC17

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Program Files (x86)\Explore.exe

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe

File created: C:\Users\user\AppData\Roaming\app

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2000:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\AppData\Local\Temp\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\32cf646479fb52a6cecce80a3bf8d7de
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6052:120:WilError_03

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Source: nKHN8rvjmN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: nKHN8rvjmN.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: nKHN8rvjmN.exe

ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe

File read: C:\Users\user\Desktop\nKHN8rvjmN.exe

Source: unknown	Process created: C:\Users\user\Desktop\nKHN8rvjmN.exe "C:\Users\user\Desktop\nKHN8rvjmN.exe"
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process created: C:\Users\user\AppData\Local\Temp\server.exe "C:\Users\user\AppData\Local\Temp\server.exe"
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe"
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\user\AppData\Local\Temp/StUpdate.exe
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\StUpdate.exe C:\Users\user\AppData\Local\Temp/StUpdate.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\StUpdate.exe C:\Users\user\AppData\Local\Temp/StUpdate.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\StUpdate.exe C:\Users\user\AppData\Local\Temp/StUpdate.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\StUpdate.exe C:\Users\user\AppData\Local\Temp/StUpdate.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\StUpdate.exe C:\Users\user\AppData\Local\Temp/StUpdate.exe
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process created: C:\Users\user\AppData\Local\Temp\server.exe "C:\Users\user\AppData\Local\Temp\server.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\user\AppData\Local\Temp/StUpdate.exe	Jump to behavior

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: shfolder.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: nKHN8rvjmN.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

.NET source code contains potential unpacker

Source: nKHN8rvjmN.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: nKHN8rvjmN.exe, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: server.exe.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explore.exe.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explore.exe0.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: StUpdate.exe.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explore.exe1.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Microsoft Corporation.exe.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explore.exe2.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explore.exe3.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explore.exe4.2.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Users\user\Documents\Explore.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Windows\SysWOW64\Explore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Local\Temp\StUpdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\Documents\Explore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	File created: C:\Users\user\AppData\Local\Temp\server.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Program Files (x86)\Explore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explore.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Program Files (x86)\Explore.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Windows\SysWOW64\Explore.exe

Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\user\AppData\Local\Temp/StUpdate.exe

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Jump to behavior

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Memory allocated: A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Memory allocated: 2710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Memory allocated: A60000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 17C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 3520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 5520000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 66E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 76E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 7A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 8A10000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 7A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 8E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 9E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 9E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: AF60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: BF60000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: C400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: D400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: E400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: C400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: F580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 10580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 9BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: AF60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: E400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 11580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 12580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 13580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 14580000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 14EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 15EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 16EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 17EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 18EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 19EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 1AEC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 1BEC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 1CEC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 1DEC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 1EEC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 1FEC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 20EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 21EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 22EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 23EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 24EC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 26140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 27140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 28140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 29140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 2A140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 2B140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 13980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 14980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 15980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 16980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: FD80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 10D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 11D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 17980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 18980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 19980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 2C140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 2D140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 2E140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: 2F140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Memory allocated: 1510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Memory allocated: 3240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Memory allocated: 2C20000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Memory allocated: 14A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Memory allocated: 3190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Memory allocated: 14A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Memory allocated: 1700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Memory allocated: 3470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Memory allocated: 5470000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: threadDelayed 2289	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: threadDelayed 1884	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: foregroundWindowGot 388	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: foregroundWindowGot 404	Jump to behavior

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe TID: 5956	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe TID: 6420	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe TID: 3556	Thread sleep time: -1144500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe TID: 3556	Thread sleep time: -942000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe TID: 7116	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe TID: 6556	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe TID: 5560	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe TID: 2136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior

Source: server.exe, 00000002.00000002.4452062075.000000000163B000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000003.00000003.2046412720.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000006.00000003.2093561425.0000000000E31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: netsh.exe, 00000005.00000003.2084636306.0000000003741000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\nKHN8rvjmN.exe

Process created: C:\Users\user\AppData\Local\Temp\server.exe "C:\Users\user\AppData\Local\Temp\server.exe"

Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 15:18:50 - Program Manager
Source: nKHN8rvjmN.exe, 00000000.00000002.2030389992.0000000002743000.00000004.00000800.00020000.00000000.sdmp, nKHN8rvjmN.exe, 00000000.00000002.2030389992.000000000274A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:21:53 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:37 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/04 \| 04:58:15 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:24 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:23:56 - Program Manager
Source: nKHN8rvjmN.exe, 00000000.00000002.2030389992.0000000002743000.00000004.00000800.00020000.00000000.sdmp, nKHN8rvjmN.exe, 00000000.00000002.2030389992.000000000274A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager\Ol
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/04 \| 01:05:29 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:23:08 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:23:15 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:40 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:29 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:23 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 14:05:49 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:30 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:20 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:21:57 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:24:16 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:23:22 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:23:04 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/03 \| 21:37:25 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:51 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:41 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 14:00:28 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:31 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:49:46 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:21:56 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:23:53 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:23:03 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/04 \| 00:47:57 - Program Manager
Source: nKHN8rvjmN.exe, 00000000.00000002.2030970856.0000000004ACB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: "dProgram Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/04 \| 04:51:07 - Program Manager
Source: nKHN8rvjmN.exe, 00000000.00000002.2030389992.0000000002743000.00000004.00000800.00020000.00000000.sdmp, nKHN8rvjmN.exe, 00000000.00000002.2030389992.000000000274A000.00000004.00000800.00020000.00000000.sdmp, nKHN8rvjmN.exe, 00000000.00000002.2030970856.0000000004ACB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:23:46 - Program Manager
Source: nKHN8rvjmN.exe, StUpdate.exe.2.dr, Explore.exe1.2.dr, Microsoft Corporation.exe.2.dr, Explore.exe0.2.dr, Explore.exe4.2.dr, server.exe.0.dr, Explore.exe2.2.dr, Explore.exe.2.dr, 32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe.2.dr, Explore.exe3.2.dr	Binary or memory string: ProgMan
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:34 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 14:57:34 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 14:08:17 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:19 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:06 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:42:41 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/04 \| 06:39:16 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:23:21 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 16:32:19 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 16:38:25 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:39 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:46 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 14:00:13 - Program Manager
Source: nKHN8rvjmN.exe, StUpdate.exe.2.dr, Explore.exe1.2.dr, Microsoft Corporation.exe.2.dr, Explore.exe0.2.dr, Explore.exe4.2.dr, server.exe.0.dr, Explore.exe2.2.dr, Explore.exe.2.dr, 32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe.2.dr, Explore.exe3.2.dr	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:24:51 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 16:55:44 - Program Manager
Source: Microsoft Corporation.exe, 00000013.00000002.2371091247.00000000058BB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dProgram Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 14:22:38 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:24:09 - Program Manager
Source: nKHN8rvjmN.exe, 00000000.00000002.2030389992.000000000274A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:21:54 - Program Manager
Source: nKHN8rvjmN.exe, StUpdate.exe.2.dr, Explore.exe1.2.dr, Microsoft Corporation.exe.2.dr, Explore.exe0.2.dr, Explore.exe4.2.dr, server.exe.0.dr, Explore.exe2.2.dr, Explore.exe.2.dr, 32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe.2.dr, Explore.exe3.2.dr	Binary or memory string: Shell_TrayWnd
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:15 - Program Manager
Source: nKHN8rvjmN.exe, 00000000.00000002.2030389992.0000000002743000.00000004.00000800.00020000.00000000.sdmp, nKHN8rvjmN.exe, 00000000.00000002.2030389992.000000000274A000.00000004.00000800.00020000.00000000.sdmp, nKHN8rvjmN.exe, 00000000.00000002.2030389992.0000000002711000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -ledProgram Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:24:21 - Program Manager
Source: nKHN8rvjmN.exe, 00000000.00000002.2030389992.0000000002743000.00000004.00000800.00020000.00000000.sdmp, nKHN8rvjmN.exe, 00000000.00000002.2030389992.000000000274A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:21:52 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:35 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:22:25 - Program Manager
Source: server.exe, 00000002.00000002.4452062075.000000000163B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Rh Program Manager$
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:24:02 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 14:13:29 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 16:09:07 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:23:16 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/04 \| 07:06:19 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:24:28 - Program Manager
Source: server.exe, 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/10/01 \| 13:27:41 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 2_2_0155A72E GetUserNameW,

2_2_0155A72E

Source: C:\Users\user\AppData\Local\Temp\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality to disable the Task Manager (.Net Source)

Lowering of HIPS / PFW / Operating System Security Settings

Source: nKHN8rvjmN.exe, Fransesco.cs	.Net Code: INS
Source: server.exe.0.dr, Fransesco.cs	.Net Code: INS
Source: Explore.exe.2.dr, Fransesco.cs	.Net Code: INS
Source: Explore.exe0.2.dr, Fransesco.cs	.Net Code: INS
Source: StUpdate.exe.2.dr, Fransesco.cs	.Net Code: INS
Source: Explore.exe1.2.dr, Fransesco.cs	.Net Code: INS
Source: Microsoft Corporation.exe.2.dr, Fransesco.cs	.Net Code: INS
Source: 32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe.2.dr, Fransesco.cs	.Net Code: INS
Source: Explore.exe2.2.dr, Fransesco.cs	.Net Code: INS
Source: Explore.exe3.2.dr, Fransesco.cs	.Net Code: INS
Source: Explore.exe4.2.dr, Fransesco.cs	.Net Code: INS

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\AppData\Local\Temp\server.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Disables zone checking for all users

Source: C:\Users\user\AppData\Local\Temp\server.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE

Stealing of Sensitive Information

Source: Yara match	File source: nKHN8rvjmN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nKHN8rvjmN.exe PID: 3304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 6044, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explore.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED

Remote Access Functionality

Source: Yara match	File source: nKHN8rvjmN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.nKHN8rvjmN.exe.a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nKHN8rvjmN.exe PID: 3304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 6044, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explore.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	11 Replication Through Removable Media	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Access Token Manipulation	32 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	12 Registry Run Keys / Startup Folder	12 Process Injection	51 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Registry Run Keys / Startup Folder	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	12 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	12 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
nKHN8rvjmN.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
nKHN8rvjmN.exe	100%	Avira	TR/Dropper.Gen
nKHN8rvjmN.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\StUpdate.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explore.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explore.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explore.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\server.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explore.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explore.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explore.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\StUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explore.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explore.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\server.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explore.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explore.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Microsoft\Windows\History\Explore.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explore.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Temp\StUpdate.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Temp\server.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\Documents\Explore.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Windows\SysWOW64\Explore.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT

Name	IP	Active	Malicious	Antivirus Detection	Reputation
5.tcp.eu.ngrok.io	3.67.161.133	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.158.58.205	unknown	United States	16509	AMAZON-02US	true
3.64.4.198	unknown	United States	16509	AMAZON-02US	true
3.127.181.115	unknown	United States	16509	AMAZON-02US	true
3.67.161.133	5.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523562
Start date and time:	2024-10-01 19:21:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nKHN8rvjmN.exe renamed because original name is a hash value
Original Sample Name:	2545b47e98ffb00e68912dbedcb8f5db.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.adwa.evad.winEXE@24/18@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 257 Number of non-executed functions: 19
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: nKHN8rvjmN.exe

Simulations

Behavior and APIs

Time	Type	Description
13:22:36	API Interceptor	105410x Sleep call for process: server.exe modified
19:21:57	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe
19:21:59	Task Scheduler	Run new task: StUpdate path: C:\Users\user\AppData\Local\Temp/StUpdate.exe
19:22:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe
19:22:17	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
18.158.58.205	Injector.exe	Get hash	malicious	ZTrat	Browse
	s4gr7c1k4r.exe	Get hash	malicious	Njrat	Browse
	RHen9DNEy6.exe	Get hash	malicious	Njrat	Browse
	MSRSAAP.EXE.exe	Get hash	malicious	DarkComet	Browse
	D828CZjRLi.exe	Get hash	malicious	Nanocore	Browse
	sg4Mw15RpV.exe	Get hash	malicious	Njrat	Browse
	m_zcxd.exe	Get hash	malicious	Njrat	Browse
	8A184A4C0C3FBB38A42095F653EA1063A07F75D3DE1A1.exe	Get hash	malicious	Njrat	Browse
	EVoLxNbDkh.exe	Get hash	malicious	Njrat	Browse
	s8FO8OkNPk.exe	Get hash	malicious	Njrat	Browse
3.64.4.198	dg7zkyyiEZ.exe	Get hash	malicious	Njrat	Browse
	kWDK4Wvmt6.exe	Get hash	malicious	Njrat	Browse
	s4gr7c1k4r.exe	Get hash	malicious	Njrat	Browse
	RHen9DNEy6.exe	Get hash	malicious	Njrat	Browse
	MSRSAAP.EXE.exe	Get hash	malicious	DarkComet	Browse
	qTBtkrv95Q.exe	Get hash	malicious	Njrat	Browse
	D828CZjRLi.exe	Get hash	malicious	Nanocore	Browse
	QRFMuwplbn.exe	Get hash	malicious	Njrat	Browse
	1E1A475D7B9C949BFB9CB6C7CC90EC13C18057FD6BD0C.exe	Get hash	malicious	Njrat	Browse
	m_zcxd.exe	Get hash	malicious	Njrat	Browse
3.127.181.115	dg7zkyyiEZ.exe	Get hash	malicious	Njrat	Browse
	kWDK4Wvmt6.exe	Get hash	malicious	Njrat	Browse
	wLFRqIw3cY.exe	Get hash	malicious	Njrat	Browse
	RXDIFP5OXK.exe	Get hash	malicious	Njrat	Browse
	RHen9DNEy6.exe	Get hash	malicious	Njrat	Browse
	D828CZjRLi.exe	Get hash	malicious	Nanocore	Browse
	sg4Mw15RpV.exe	Get hash	malicious	Njrat	Browse
	KsrDBL027L.exe	Get hash	malicious	Njrat	Browse
	sam.exe	Get hash	malicious	Njrat, RevengeRAT	Browse
	P1qURiDOE1.exe	Get hash	malicious	Njrat	Browse
3.67.161.133	dg7zkyyiEZ.exe	Get hash	malicious	Njrat	Browse
	kWDK4Wvmt6.exe	Get hash	malicious	Njrat	Browse
	xuPFIoUdut.exe	Get hash	malicious	Njrat	Browse
	s4gr7c1k4r.exe	Get hash	malicious	Njrat	Browse
	qTBtkrv95Q.exe	Get hash	malicious	Njrat	Browse
	D828CZjRLi.exe	Get hash	malicious	Nanocore	Browse
	QRFMuwplbn.exe	Get hash	malicious	Njrat	Browse
	1E1A475D7B9C949BFB9CB6C7CC90EC13C18057FD6BD0C.exe	Get hash	malicious	Njrat	Browse
	sg4Mw15RpV.exe	Get hash	malicious	Njrat	Browse
	EVoLxNbDkh.exe	Get hash	malicious	Njrat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.tcp.eu.ngrok.io	dg7zkyyiEZ.exe	Get hash	malicious	Njrat	Browse	3.64.4.198
	Injector.exe	Get hash	malicious	ZTrat	Browse	18.158.58.205
	Minecraft.exe	Get hash	malicious	Unknown	Browse	3.67.112.102
	kWDK4Wvmt6.exe	Get hash	malicious	Njrat	Browse	3.67.161.133
	wLFRqIw3cY.exe	Get hash	malicious	Njrat	Browse	3.127.181.115
	RXDIFP5OXK.exe	Get hash	malicious	Njrat	Browse	3.67.62.142
	xuPFIoUdut.exe	Get hash	malicious	Njrat	Browse	3.67.161.133
	s4gr7c1k4r.exe	Get hash	malicious	Njrat	Browse	3.67.62.142
	RHen9DNEy6.exe	Get hash	malicious	Njrat	Browse	3.64.4.198
	MSRSAAP.EXE.exe	Get hash	malicious	DarkComet	Browse	18.158.58.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.30.160.207
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	3.71.149.231
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.213.197.159
	https://wetransfer.com/downloads/fc718a7028ccd1e273879a61c0883fe420241001145250/8110e2eb5f5a56cc2015d1b3243d9b3120241001145309/33d289?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	HTMLPhisher	Browse	18.245.46.109
	https://www.dropbox.com/l/scl/AADL_v5DzsoHwkyegIhk6J0bQm3A7UWklCA	Get hash	malicious	Unknown	Browse	52.28.39.231
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	18.195.235.189
	https://pt9w4x.nauleacepr.com/9QLzRhIr/#Ygovernment.relations@rolls-royce.com	Get hash	malicious	HTMLPhisher	Browse	18.245.86.73
	https://vwkugoia0yciq0buttompanj2.ntvultra.com/viciorhthvgh/forhwural/coupletri/QdhahVchT/yEjbKM/anNhbGFzQGhvbGxhbmRjby5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.33.187.96
	document.exe	Get hash	malicious	FormBook	Browse	13.248.252.114
	https://links.rasa.io/v1/t/eJx1kM2OgjAUhV_FsB6kpUXQ1bzAuJp9c2mvTI1Q0tvGEMO7DzCKC51t73d-em5J9JfksEl-QujpkGXR19A13sUet9q1W4iZJko-NkmLAQwEmOhbQi56jbPwiFe6YAjoXyBswS7mBiwN2nVXGCSTn838PrvPCg8EqkUiaFCFoV9Na2_x9I0Uvv6OK0yxPqMO6tlhsmpjZ8OgppCTbaKHYF33IFflk7Nm1u3LUgDjp5QXRqZ1qU0KOYNUij0T1U7ntaxeOhJ2Rk1_XJJzlsuUs5TxlfOonTf3BF5UohBl9aZCj56mjv9wjzQfV0TIXck5E_I9RBTxjh5dt8wFtQrTgMr18xzrZRzHX-Cephc=#a2FyZW4ubW9vbmV5QGJhbGxhcmRkZXNpZ25zLm5ldA==	Get hash	malicious	HTMLPhisher	Browse	3.5.130.130
AMAZON-02US	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.30.160.207
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	3.71.149.231
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.213.197.159
	https://wetransfer.com/downloads/fc718a7028ccd1e273879a61c0883fe420241001145250/8110e2eb5f5a56cc2015d1b3243d9b3120241001145309/33d289?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	HTMLPhisher	Browse	18.245.46.109
	https://www.dropbox.com/l/scl/AADL_v5DzsoHwkyegIhk6J0bQm3A7UWklCA	Get hash	malicious	Unknown	Browse	52.28.39.231
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	18.195.235.189
	https://pt9w4x.nauleacepr.com/9QLzRhIr/#Ygovernment.relations@rolls-royce.com	Get hash	malicious	HTMLPhisher	Browse	18.245.86.73
	https://vwkugoia0yciq0buttompanj2.ntvultra.com/viciorhthvgh/forhwural/coupletri/QdhahVchT/yEjbKM/anNhbGFzQGhvbGxhbmRjby5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.33.187.96
	document.exe	Get hash	malicious	FormBook	Browse	13.248.252.114
	https://links.rasa.io/v1/t/eJx1kM2OgjAUhV_FsB6kpUXQ1bzAuJp9c2mvTI1Q0tvGEMO7DzCKC51t73d-em5J9JfksEl-QujpkGXR19A13sUet9q1W4iZJko-NkmLAQwEmOhbQi56jbPwiFe6YAjoXyBswS7mBiwN2nVXGCSTn838PrvPCg8EqkUiaFCFoV9Na2_x9I0Uvv6OK0yxPqMO6tlhsmpjZ8OgppCTbaKHYF33IFflk7Nm1u3LUgDjp5QXRqZ1qU0KOYNUij0T1U7ntaxeOhJ2Rk1_XJJzlsuUs5TxlfOonTf3BF5UohBl9aZCj56mjv9wjzQfV0TIXck5E_I9RBTxjh5dt8wFtQrTgMr18xzrZRzHX-Cephc=#a2FyZW4ubW9vbmV5QGJhbGxhcmRkZXNpZ25zLm5ldA==	Get hash	malicious	HTMLPhisher	Browse	3.5.130.130
AMAZON-02US	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.30.160.207
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	3.71.149.231
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.213.197.159
	https://wetransfer.com/downloads/fc718a7028ccd1e273879a61c0883fe420241001145250/8110e2eb5f5a56cc2015d1b3243d9b3120241001145309/33d289?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	HTMLPhisher	Browse	18.245.46.109
	https://www.dropbox.com/l/scl/AADL_v5DzsoHwkyegIhk6J0bQm3A7UWklCA	Get hash	malicious	Unknown	Browse	52.28.39.231
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	18.195.235.189
	https://pt9w4x.nauleacepr.com/9QLzRhIr/#Ygovernment.relations@rolls-royce.com	Get hash	malicious	HTMLPhisher	Browse	18.245.86.73
	https://vwkugoia0yciq0buttompanj2.ntvultra.com/viciorhthvgh/forhwural/coupletri/QdhahVchT/yEjbKM/anNhbGFzQGhvbGxhbmRjby5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.33.187.96
	document.exe	Get hash	malicious	FormBook	Browse	13.248.252.114
	https://links.rasa.io/v1/t/eJx1kM2OgjAUhV_FsB6kpUXQ1bzAuJp9c2mvTI1Q0tvGEMO7DzCKC51t73d-em5J9JfksEl-QujpkGXR19A13sUet9q1W4iZJko-NkmLAQwEmOhbQi56jbPwiFe6YAjoXyBswS7mBiwN2nVXGCSTn838PrvPCg8EqkUiaFCFoV9Na2_x9I0Uvv6OK0yxPqMO6tlhsmpjZ8OgppCTbaKHYF33IFflk7Nm1u3LUgDjp5QXRqZ1qU0KOYNUij0T1U7ntaxeOhJ2Rk1_XJJzlsuUs5TxlfOonTf3BF5UohBl9aZCj56mjv9wjzQfV0TIXck5E_I9RBTxjh5dt8wFtQrTgMr18xzrZRzHX-Cephc=#a2FyZW4ubW9vbmV5QGJhbGxhcmRkZXNpZ25zLm5ldA==	Get hash	malicious	HTMLPhisher	Browse	3.5.130.130
AMAZON-02US	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.30.160.207
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	3.71.149.231
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.213.197.159
	https://wetransfer.com/downloads/fc718a7028ccd1e273879a61c0883fe420241001145250/8110e2eb5f5a56cc2015d1b3243d9b3120241001145309/33d289?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	HTMLPhisher	Browse	18.245.46.109
	https://www.dropbox.com/l/scl/AADL_v5DzsoHwkyegIhk6J0bQm3A7UWklCA	Get hash	malicious	Unknown	Browse	52.28.39.231
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	18.195.235.189
	https://pt9w4x.nauleacepr.com/9QLzRhIr/#Ygovernment.relations@rolls-royce.com	Get hash	malicious	HTMLPhisher	Browse	18.245.86.73
	https://vwkugoia0yciq0buttompanj2.ntvultra.com/viciorhthvgh/forhwural/coupletri/QdhahVchT/yEjbKM/anNhbGFzQGhvbGxhbmRjby5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.33.187.96
	document.exe	Get hash	malicious	FormBook	Browse	13.248.252.114
	https://links.rasa.io/v1/t/eJx1kM2OgjAUhV_FsB6kpUXQ1bzAuJp9c2mvTI1Q0tvGEMO7DzCKC51t73d-em5J9JfksEl-QujpkGXR19A13sUet9q1W4iZJko-NkmLAQwEmOhbQi56jbPwiFe6YAjoXyBswS7mBiwN2nVXGCSTn838PrvPCg8EqkUiaFCFoV9Na2_x9I0Uvv6OK0yxPqMO6tlhsmpjZ8OgppCTbaKHYF33IFflk7Nm1u3LUgDjp5QXRqZ1qU0KOYNUij0T1U7ntaxeOhJ2Rk1_XJJzlsuUs5TxlfOonTf3BF5UohBl9aZCj56mjv9wjzQfV0TIXck5E_I9RBTxjh5dt8wFtQrTgMr18xzrZRzHX-Cephc=#a2FyZW4ubW9vbmV5QGJhbGxhcmRkZXNpZ25zLm5ldA==	Get hash	malicious	HTMLPhisher	Browse	3.5.130.130

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560972006356616
Encrypted:	false
SSDEEP:	1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
MD5:	2545B47E98FFB00E68912DBEDCB8F5DB
SHA1:	0612D0F4417EBB63E52AD1DA47DB3209E848332A
SHA-256:	18240BE396F8B7A2A28669DFB20F4FB311DAF0B1FD4C1D81DF26D7F8419444D4
SHA-512:	D480F7713618938A6239445C4E5CCDBDC1305FA3D45E958D7B4656CEE09E792AD5892E18C0C590F2AA9C2E904F00A271FBBB8DA5DB3D14846A9819BA5CBA7788
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explore.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explore.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explore.exe, Author: unknown Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explore.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explore.exe, Author: Florian Roth Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explore.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explore.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explore.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explore.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explore.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explore.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explore.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explore.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explore.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explore.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe.log

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Explore.exe.log

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Microsoft Corporation.exe.log

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\nKHN8rvjmN.exe.log

Process:	C:\Users\user\Desktop\nKHN8rvjmN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	true
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explore.exe

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560972006356616
Encrypted:	false
SSDEEP:	1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
MD5:	2545B47E98FFB00E68912DBEDCB8F5DB
SHA1:	0612D0F4417EBB63E52AD1DA47DB3209E848332A
SHA-256:	18240BE396F8B7A2A28669DFB20F4FB311DAF0B1FD4C1D81DF26D7F8419444D4
SHA-512:	D480F7713618938A6239445C4E5CCDBDC1305FA3D45E958D7B4656CEE09E792AD5892E18C0C590F2AA9C2E904F00A271FBBB8DA5DB3D14846A9819BA5CBA7788
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explore.exe

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560972006356616
Encrypted:	false
SSDEEP:	1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
MD5:	2545B47E98FFB00E68912DBEDCB8F5DB
SHA1:	0612D0F4417EBB63E52AD1DA47DB3209E848332A
SHA-256:	18240BE396F8B7A2A28669DFB20F4FB311DAF0B1FD4C1D81DF26D7F8419444D4
SHA-512:	D480F7713618938A6239445C4E5CCDBDC1305FA3D45E958D7B4656CEE09E792AD5892E18C0C590F2AA9C2E904F00A271FBBB8DA5DB3D14846A9819BA5CBA7788
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Temp\StUpdate.exe

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560972006356616
Encrypted:	false
SSDEEP:	1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
MD5:	2545B47E98FFB00E68912DBEDCB8F5DB
SHA1:	0612D0F4417EBB63E52AD1DA47DB3209E848332A
SHA-256:	18240BE396F8B7A2A28669DFB20F4FB311DAF0B1FD4C1D81DF26D7F8419444D4
SHA-512:	D480F7713618938A6239445C4E5CCDBDC1305FA3D45E958D7B4656CEE09E792AD5892E18C0C590F2AA9C2E904F00A271FBBB8DA5DB3D14846A9819BA5CBA7788
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Temp\server.exe

Process:	C:\Users\user\Desktop\nKHN8rvjmN.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560972006356616
Encrypted:	false
SSDEEP:	1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
MD5:	2545B47E98FFB00E68912DBEDCB8F5DB
SHA1:	0612D0F4417EBB63E52AD1DA47DB3209E848332A
SHA-256:	18240BE396F8B7A2A28669DFB20F4FB311DAF0B1FD4C1D81DF26D7F8419444D4
SHA-512:	D480F7713618938A6239445C4E5CCDBDC1305FA3D45E958D7B4656CEE09E792AD5892E18C0C590F2AA9C2E904F00A271FBBB8DA5DB3D14846A9819BA5CBA7788
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560972006356616
Encrypted:	false
SSDEEP:	1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
MD5:	2545B47E98FFB00E68912DBEDCB8F5DB
SHA1:	0612D0F4417EBB63E52AD1DA47DB3209E848332A
SHA-256:	18240BE396F8B7A2A28669DFB20F4FB311DAF0B1FD4C1D81DF26D7F8419444D4
SHA-512:	D480F7713618938A6239445C4E5CCDBDC1305FA3D45E958D7B4656CEE09E792AD5892E18C0C590F2AA9C2E904F00A271FBBB8DA5DB3D14846A9819BA5CBA7788
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560972006356616
Encrypted:	false
SSDEEP:	1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
MD5:	2545B47E98FFB00E68912DBEDCB8F5DB
SHA1:	0612D0F4417EBB63E52AD1DA47DB3209E848332A
SHA-256:	18240BE396F8B7A2A28669DFB20F4FB311DAF0B1FD4C1D81DF26D7F8419444D4
SHA-512:	D480F7713618938A6239445C4E5CCDBDC1305FA3D45E958D7B4656CEE09E792AD5892E18C0C590F2AA9C2E904F00A271FBBB8DA5DB3D14846A9819BA5CBA7788
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560972006356616
Encrypted:	false
SSDEEP:	1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
MD5:	2545B47E98FFB00E68912DBEDCB8F5DB
SHA1:	0612D0F4417EBB63E52AD1DA47DB3209E848332A
SHA-256:	18240BE396F8B7A2A28669DFB20F4FB311DAF0B1FD4C1D81DF26D7F8419444D4
SHA-512:	D480F7713618938A6239445C4E5CCDBDC1305FA3D45E958D7B4656CEE09E792AD5892E18C0C590F2AA9C2E904F00A271FBBB8DA5DB3D14846A9819BA5CBA7788
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\app

Process:	C:\Users\user\Desktop\nKHN8rvjmN.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:R:R
MD5:	4D853D9C7197EE7FA81C6535B1F7D655
SHA1:	EAC3D866E991967B385F3DD22DA25E410D8F7F49
SHA-256:	5ABDB6175F820F0AC3D8647FBB1F7A0BCC91757A782A8A145570944CA6A00C96
SHA-512:	DC5A09D8586EB9F591F6E00187817C19F693E9328A1B2E5838C61C0B234E9608EECC45BBF7F4A90912E9A456D0AB469ED2503BAFB4988B276CEC8D5F0B18FDA7
Malicious:	false
Preview:	.1

C:\Users\user\Documents\Explore.exe

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560972006356616
Encrypted:	false
SSDEEP:	1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
MD5:	2545B47E98FFB00E68912DBEDCB8F5DB
SHA1:	0612D0F4417EBB63E52AD1DA47DB3209E848332A
SHA-256:	18240BE396F8B7A2A28669DFB20F4FB311DAF0B1FD4C1D81DF26D7F8419444D4
SHA-512:	D480F7713618938A6239445C4E5CCDBDC1305FA3D45E958D7B4656CEE09E792AD5892E18C0C590F2AA9C2E904F00A271FBBB8DA5DB3D14846A9819BA5CBA7788
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Windows\SysWOW64\Explore.exe

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.560972006356616
Encrypted:	false
SSDEEP:	1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
MD5:	2545B47E98FFB00E68912DBEDCB8F5DB
SHA1:	0612D0F4417EBB63E52AD1DA47DB3209E848332A
SHA-256:	18240BE396F8B7A2A28669DFB20F4FB311DAF0B1FD4C1D81DF26D7F8419444D4
SHA-512:	D480F7713618938A6239445C4E5CCDBDC1305FA3D45E958D7B4656CEE09E792AD5892E18C0C590F2AA9C2E904F00A271FBBB8DA5DB3D14846A9819BA5CBA7788
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

\Device\ConDrv

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.560972006356616
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	nKHN8rvjmN.exe
File size:	95'232 bytes
MD5:	2545b47e98ffb00e68912dbedcb8f5db
SHA1:	0612d0f4417ebb63e52ad1da47db3209e848332a
SHA256:	18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4
SHA512:	d480f7713618938a6239445c4e5ccdbdc1305fa3d45e958d7b4656cee09e792ad5892e18c0c590f2aa9c2e904f00a271fbbb8da5db3d14846a9819ba5cba7788
SSDEEP:	1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
TLSH:	2C93E74977E43424E5BF56F39971B2404F34B5871602E39E58F218AA1B33AC44F89FEA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................p............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x418efe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F986F2 [Sun Sep 29 16:57:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18ea4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16f04	0x17000	09879cd9a0a99d990b80cf57dd6222a6	False	0.36818529211956524	data	5.59271339646758	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	02466978873e232bef309f048b95192f	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T19:22:05.570773+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49704	3.67.161.133	14355	TCP
2024-10-01T19:22:05.570773+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49704	3.67.161.133	14355	TCP
2024-10-01T19:22:07.961648+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49705	3.67.161.133	14355	TCP
2024-10-01T19:22:07.961648+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49705	3.67.161.133	14355	TCP
2024-10-01T19:22:12.121634+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49706	3.67.161.133	14355	TCP
2024-10-01T19:22:12.121634+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49706	3.67.161.133	14355	TCP
2024-10-01T19:22:15.113972+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49709	3.67.161.133	14355	TCP
2024-10-01T19:22:15.113972+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49709	3.67.161.133	14355	TCP
2024-10-01T19:22:18.151614+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49714	3.67.161.133	14355	TCP
2024-10-01T19:22:18.151614+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49714	3.67.161.133	14355	TCP
2024-10-01T19:22:21.403273+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49715	3.67.161.133	14355	TCP
2024-10-01T19:22:21.403273+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49715	3.67.161.133	14355	TCP
2024-10-01T19:22:24.316827+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49717	3.67.161.133	14355	TCP
2024-10-01T19:22:24.316827+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49717	3.67.161.133	14355	TCP
2024-10-01T19:22:28.374155+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49718	3.67.161.133	14355	TCP
2024-10-01T19:22:28.374155+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49718	3.67.161.133	14355	TCP
2024-10-01T19:22:31.519603+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49719	3.67.161.133	14355	TCP
2024-10-01T19:22:31.519603+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49719	3.67.161.133	14355	TCP
2024-10-01T19:22:34.832589+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49720	3.67.161.133	14355	TCP
2024-10-01T19:22:34.832589+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49720	3.67.161.133	14355	TCP
2024-10-01T19:22:38.113336+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49721	3.67.161.133	14355	TCP
2024-10-01T19:22:38.113336+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49721	3.67.161.133	14355	TCP
2024-10-01T19:22:38.471730+0200	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49721	3.67.161.133	14355	TCP
2024-10-01T19:22:38.810544+0200	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49721	3.67.161.133	14355	TCP
2024-10-01T19:22:42.179629+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49722	3.67.161.133	14355	TCP
2024-10-01T19:22:42.179629+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49722	3.67.161.133	14355	TCP
2024-10-01T19:22:45.622433+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49723	3.67.161.133	14355	TCP
2024-10-01T19:22:45.622433+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49723	3.67.161.133	14355	TCP
2024-10-01T19:22:48.662189+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49724	3.67.161.133	14355	TCP
2024-10-01T19:22:48.662189+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49724	3.67.161.133	14355	TCP
2024-10-01T19:22:51.511706+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49725	3.67.161.133	14355	TCP
2024-10-01T19:22:51.511706+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49725	3.67.161.133	14355	TCP
2024-10-01T19:22:54.112897+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49726	3.67.161.133	14355	TCP
2024-10-01T19:22:54.112897+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49726	3.67.161.133	14355	TCP
2024-10-01T19:22:57.363488+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49728	3.67.161.133	14355	TCP
2024-10-01T19:22:57.363488+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49728	3.67.161.133	14355	TCP
2024-10-01T19:23:00.688538+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49729	3.67.161.133	14355	TCP
2024-10-01T19:23:00.688538+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49729	3.67.161.133	14355	TCP
2024-10-01T19:23:04.260352+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49730	18.158.58.205	14355	TCP
2024-10-01T19:23:04.260352+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49730	18.158.58.205	14355	TCP
2024-10-01T19:23:07.305485+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49731	18.158.58.205	14355	TCP
2024-10-01T19:23:07.305485+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49731	18.158.58.205	14355	TCP
2024-10-01T19:23:10.722244+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49732	18.158.58.205	14355	TCP
2024-10-01T19:23:10.722244+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49732	18.158.58.205	14355	TCP
2024-10-01T19:23:14.219259+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49733	18.158.58.205	14355	TCP
2024-10-01T19:23:14.219259+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49733	18.158.58.205	14355	TCP
2024-10-01T19:23:17.043161+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49734	18.158.58.205	14355	TCP
2024-10-01T19:23:17.043161+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49734	18.158.58.205	14355	TCP
2024-10-01T19:23:17.623088+0200	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49734	18.158.58.205	14355	TCP
2024-10-01T19:23:22.204240+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49735	18.158.58.205	14355	TCP
2024-10-01T19:23:22.204240+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49735	18.158.58.205	14355	TCP
2024-10-01T19:23:25.772944+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49736	18.158.58.205	14355	TCP
2024-10-01T19:23:25.772944+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49736	18.158.58.205	14355	TCP
2024-10-01T19:23:29.750221+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49737	18.158.58.205	14355	TCP
2024-10-01T19:23:29.750221+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49737	18.158.58.205	14355	TCP
2024-10-01T19:23:34.341100+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49738	18.158.58.205	14355	TCP
2024-10-01T19:23:34.341100+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49738	18.158.58.205	14355	TCP
2024-10-01T19:23:37.347851+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49739	18.158.58.205	14355	TCP
2024-10-01T19:23:37.347851+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49739	18.158.58.205	14355	TCP
2024-10-01T19:23:40.829037+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49740	18.158.58.205	14355	TCP
2024-10-01T19:23:40.829037+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49740	18.158.58.205	14355	TCP
2024-10-01T19:23:47.098118+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49741	18.158.58.205	14355	TCP
2024-10-01T19:23:47.098118+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49741	18.158.58.205	14355	TCP
2024-10-01T19:23:51.097857+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49742	18.158.58.205	14355	TCP
2024-10-01T19:23:51.097857+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49742	18.158.58.205	14355	TCP
2024-10-01T19:23:58.919701+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49743	18.158.58.205	14355	TCP
2024-10-01T19:23:58.919701+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49743	18.158.58.205	14355	TCP
2024-10-01T19:24:06.331479+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49744	3.127.181.115	14355	TCP
2024-10-01T19:24:06.331479+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49744	3.127.181.115	14355	TCP
2024-10-01T19:24:13.906350+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49745	3.127.181.115	14355	TCP
2024-10-01T19:24:13.906350+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49745	3.127.181.115	14355	TCP
2024-10-01T19:24:24.978852+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49746	3.127.181.115	14355	TCP
2024-10-01T19:24:24.978852+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49746	3.127.181.115	14355	TCP
2024-10-01T19:24:25.020132+0200	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49746	3.127.181.115	14355	TCP
2024-10-01T19:24:27.832466+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49747	3.127.181.115	14355	TCP
2024-10-01T19:24:27.832466+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49747	3.127.181.115	14355	TCP
2024-10-01T19:24:33.904491+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49748	3.127.181.115	14355	TCP
2024-10-01T19:24:33.904491+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49748	3.127.181.115	14355	TCP
2024-10-01T19:24:37.302132+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49749	3.127.181.115	14355	TCP
2024-10-01T19:24:37.302132+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49749	3.127.181.115	14355	TCP
2024-10-01T19:24:42.470605+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49750	3.127.181.115	14355	TCP
2024-10-01T19:24:42.470605+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49750	3.127.181.115	14355	TCP
2024-10-01T19:25:06.925611+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49751	3.127.181.115	14355	TCP
2024-10-01T19:25:06.925611+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49751	3.127.181.115	14355	TCP
2024-10-01T19:25:20.816734+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49752	3.64.4.198	14355	TCP
2024-10-01T19:25:20.816734+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49752	3.64.4.198	14355	TCP
2024-10-01T19:25:28.783719+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49753	3.64.4.198	14355	TCP
2024-10-01T19:25:28.783719+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49753	3.64.4.198	14355	TCP
2024-10-01T19:25:32.675749+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49754	3.64.4.198	14355	TCP
2024-10-01T19:25:32.675749+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49754	3.64.4.198	14355	TCP
2024-10-01T19:25:36.785631+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49755	3.64.4.198	14355	TCP
2024-10-01T19:25:36.785631+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49755	3.64.4.198	14355	TCP
2024-10-01T19:25:39.506680+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49756	3.64.4.198	14355	TCP
2024-10-01T19:25:39.506680+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49756	3.64.4.198	14355	TCP
2024-10-01T19:25:42.979877+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49757	3.64.4.198	14355	TCP
2024-10-01T19:25:42.979877+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49757	3.64.4.198	14355	TCP
2024-10-01T19:25:46.883212+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49758	3.64.4.198	14355	TCP
2024-10-01T19:25:46.883212+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49758	3.64.4.198	14355	TCP
2024-10-01T19:25:50.712666+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49759	3.64.4.198	14355	TCP
2024-10-01T19:25:50.712666+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49759	3.64.4.198	14355	TCP
2024-10-01T19:25:52.232550+0200	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49759	3.64.4.198	14355	TCP
2024-10-01T19:25:54.472864+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49760	3.64.4.198	14355	TCP
2024-10-01T19:25:54.472864+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49760	3.64.4.198	14355	TCP
2024-10-01T19:25:57.723543+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49761	3.64.4.198	14355	TCP
2024-10-01T19:25:57.723543+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49761	3.64.4.198	14355	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 19:22:02.907404900 CEST	49704	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:02.912636995 CEST	14355	49704	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:02.912740946 CEST	49704	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:05.570772886 CEST	49704	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:05.575710058 CEST	14355	49704	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:05.575819016 CEST	49704	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:05.580945015 CEST	14355	49704	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:05.794044971 CEST	14355	49704	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:05.794184923 CEST	49704	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:07.798789024 CEST	49704	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:07.803837061 CEST	14355	49704	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:07.806442976 CEST	49705	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:07.811343908 CEST	14355	49705	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:07.811436892 CEST	49705	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:07.961647987 CEST	49705	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:07.966588974 CEST	14355	49705	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:07.966670036 CEST	49705	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:07.971519947 CEST	14355	49705	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:09.026276112 CEST	14355	49705	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:09.026422977 CEST	49705	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:11.044859886 CEST	49705	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:11.045792103 CEST	49706	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:11.497940063 CEST	49705	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:12.076061964 CEST	49706	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:12.107279062 CEST	49705	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:12.120049953 CEST	14355	49705	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:12.120096922 CEST	14355	49706	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:12.120130062 CEST	14355	49705	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:12.120186090 CEST	49706	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:12.120213032 CEST	49705	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:12.121634007 CEST	49706	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:12.121681929 CEST	14355	49706	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:12.121736050 CEST	49706	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:12.121751070 CEST	14355	49705	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:12.121804953 CEST	49705	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:12.126529932 CEST	14355	49706	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:12.126600981 CEST	49706	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:12.131453037 CEST	14355	49706	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:13.099083900 CEST	14355	49706	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:13.099175930 CEST	49706	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:15.107557058 CEST	49706	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:15.108392000 CEST	49709	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:15.112550020 CEST	14355	49706	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:15.113296032 CEST	14355	49709	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:15.113409042 CEST	49709	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:15.113971949 CEST	49709	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:15.118835926 CEST	14355	49709	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:15.118908882 CEST	49709	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:15.123698950 CEST	14355	49709	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:15.919899940 CEST	14355	49709	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:15.919984102 CEST	49709	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:17.938194036 CEST	49709	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:17.943100929 CEST	14355	49709	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:18.028924942 CEST	49714	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:18.150417089 CEST	14355	49714	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:18.150616884 CEST	49714	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:18.151613951 CEST	49714	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:18.158163071 CEST	14355	49714	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:18.158250093 CEST	49714	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:18.166733980 CEST	14355	49714	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:19.129570961 CEST	14355	49714	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:19.129671097 CEST	49714	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:21.139465094 CEST	49714	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:21.144424915 CEST	14355	49714	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:21.388170004 CEST	49715	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:21.393343925 CEST	14355	49715	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:21.393445969 CEST	49715	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:21.403273106 CEST	49715	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:21.408107042 CEST	14355	49715	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:21.408181906 CEST	49715	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:21.413006067 CEST	14355	49715	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:22.307636023 CEST	14355	49715	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:22.307707071 CEST	49715	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:24.310467005 CEST	49715	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:24.311316013 CEST	49717	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:24.315278053 CEST	14355	49715	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:24.316217899 CEST	14355	49717	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:24.316304922 CEST	49717	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:24.316827059 CEST	49717	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:24.321685076 CEST	14355	49717	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:24.321799994 CEST	49717	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:24.326653957 CEST	14355	49717	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:25.394229889 CEST	14355	49717	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:25.394304991 CEST	49717	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:27.404313087 CEST	49717	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:27.405493975 CEST	49718	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:27.810444117 CEST	49717	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:28.372874975 CEST	14355	49717	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:28.372891903 CEST	14355	49718	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:28.372900963 CEST	14355	49717	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:28.373023987 CEST	49718	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:28.373182058 CEST	49717	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:28.374155045 CEST	49718	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:28.379225969 CEST	14355	49718	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:28.379278898 CEST	49718	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:28.384155035 CEST	14355	49718	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:29.182723045 CEST	14355	49718	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:29.182812929 CEST	49718	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:31.206691027 CEST	49718	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:31.211673975 CEST	14355	49718	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:31.514025927 CEST	49719	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:31.518898010 CEST	14355	49719	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:31.519021034 CEST	49719	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:31.519603014 CEST	49719	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:31.524404049 CEST	14355	49719	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:31.623169899 CEST	49719	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:31.628112078 CEST	14355	49719	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:32.358258009 CEST	14355	49719	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:32.358386040 CEST	49719	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:34.373528004 CEST	49719	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:34.378421068 CEST	14355	49719	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:34.701489925 CEST	49720	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:34.831361055 CEST	14355	49720	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:34.831469059 CEST	49720	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:34.832588911 CEST	49720	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:34.837372065 CEST	14355	49720	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:34.837440968 CEST	49720	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:34.842319965 CEST	14355	49720	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:36.065593004 CEST	14355	49720	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:36.065835953 CEST	49720	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:38.081892967 CEST	49720	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:38.086931944 CEST	14355	49720	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:38.107593060 CEST	49721	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:38.112406015 CEST	14355	49721	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:38.112546921 CEST	49721	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:38.113336086 CEST	49721	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:38.118100882 CEST	14355	49721	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:38.118181944 CEST	49721	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:38.122983932 CEST	14355	49721	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:38.471729994 CEST	49721	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:38.810544014 CEST	49721	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:39.394062996 CEST	14355	49721	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:39.394145012 CEST	49721	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:39.394320011 CEST	14355	49721	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:39.395771980 CEST	14355	49721	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:39.395832062 CEST	49721	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:39.395845890 CEST	14355	49721	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:39.399857044 CEST	14355	49721	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:39.401642084 CEST	14355	49721	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:41.530139923 CEST	49722	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:42.178821087 CEST	14355	49722	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:42.178913116 CEST	49722	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:42.179629087 CEST	49722	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:42.184534073 CEST	14355	49722	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:42.184588909 CEST	49722	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:42.189588070 CEST	14355	49722	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:43.419039011 CEST	14355	49722	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:43.420006037 CEST	49722	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:45.435523033 CEST	49722	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:45.436697960 CEST	49723	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:45.440418959 CEST	14355	49722	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:45.441673040 CEST	14355	49723	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:45.441745996 CEST	49723	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:45.622432947 CEST	49723	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:45.627660036 CEST	14355	49723	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:45.627744913 CEST	49723	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:45.632905006 CEST	14355	49723	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:46.304214001 CEST	14355	49723	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:46.304306030 CEST	49723	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:48.357361078 CEST	49723	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:48.363301992 CEST	14355	49723	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:48.656390905 CEST	49724	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:48.661387920 CEST	14355	49724	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:48.661515951 CEST	49724	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:48.662189007 CEST	49724	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:48.666935921 CEST	14355	49724	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:48.667033911 CEST	49724	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:48.671818972 CEST	14355	49724	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:49.333849907 CEST	14355	49724	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:49.333928108 CEST	49724	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:51.341895103 CEST	49724	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:51.342801094 CEST	49725	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:51.346802950 CEST	14355	49724	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:51.347599983 CEST	14355	49725	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:51.347686052 CEST	49725	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:51.511706114 CEST	49725	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:51.516554117 CEST	14355	49725	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:51.516619921 CEST	49725	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:51.521434069 CEST	14355	49725	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:52.016061068 CEST	14355	49725	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:52.016160965 CEST	49725	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:54.086075068 CEST	49725	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:54.090950966 CEST	14355	49725	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:54.106347084 CEST	49726	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:54.111154079 CEST	14355	49726	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:54.112071991 CEST	49726	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:54.112896919 CEST	49726	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:54.117774010 CEST	14355	49726	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:54.117846966 CEST	49726	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:54.122721910 CEST	14355	49726	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:55.355279922 CEST	14355	49726	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:55.355411053 CEST	49726	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:57.357347965 CEST	49726	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:57.358124018 CEST	49728	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:57.362122059 CEST	14355	49726	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:57.362932920 CEST	14355	49728	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:57.363006115 CEST	49728	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:57.363487959 CEST	49728	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:57.368592024 CEST	14355	49728	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:57.368642092 CEST	49728	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:22:57.373501062 CEST	14355	49728	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:58.290011883 CEST	14355	49728	3.67.161.133	192.168.2.5
Oct 1, 2024 19:22:58.290087938 CEST	49728	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:23:00.308777094 CEST	49728	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:23:00.313604116 CEST	14355	49728	3.67.161.133	192.168.2.5
Oct 1, 2024 19:23:00.420675039 CEST	49729	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:23:00.425508022 CEST	14355	49729	3.67.161.133	192.168.2.5
Oct 1, 2024 19:23:00.425591946 CEST	49729	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:23:00.688538074 CEST	49729	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:23:00.693490028 CEST	14355	49729	3.67.161.133	192.168.2.5
Oct 1, 2024 19:23:00.693579912 CEST	49729	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:23:00.698306084 CEST	14355	49729	3.67.161.133	192.168.2.5
Oct 1, 2024 19:23:01.682166100 CEST	14355	49729	3.67.161.133	192.168.2.5
Oct 1, 2024 19:23:01.682241917 CEST	49729	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:23:03.778723001 CEST	49729	14355	192.168.2.5	3.67.161.133
Oct 1, 2024 19:23:03.783694983 CEST	14355	49729	3.67.161.133	192.168.2.5
Oct 1, 2024 19:23:04.253479004 CEST	49730	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:04.258761883 CEST	14355	49730	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:04.258862972 CEST	49730	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:04.260351896 CEST	49730	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:04.265613079 CEST	14355	49730	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:04.265682936 CEST	49730	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:04.270622969 CEST	14355	49730	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:05.249814987 CEST	14355	49730	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:05.250030994 CEST	49730	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:07.282104969 CEST	49730	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:07.291776896 CEST	49731	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:07.304872036 CEST	14355	49730	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:07.304892063 CEST	14355	49731	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:07.304990053 CEST	49731	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:07.305485010 CEST	49731	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:07.310262918 CEST	14355	49731	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:07.310324907 CEST	49731	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:07.315156937 CEST	14355	49731	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:07.973817110 CEST	14355	49731	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:07.973929882 CEST	49731	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:10.008430004 CEST	49731	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:10.253190994 CEST	49732	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:10.310528040 CEST	49731	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:10.721420050 CEST	14355	49731	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:10.721438885 CEST	14355	49732	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:10.721447945 CEST	14355	49731	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:10.721549034 CEST	49731	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:10.722244024 CEST	49732	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:10.722244024 CEST	49732	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:10.726979971 CEST	14355	49732	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:10.727036953 CEST	49732	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:10.731829882 CEST	14355	49732	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:11.650341988 CEST	14355	49732	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:11.650439978 CEST	49732	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:13.659326077 CEST	49732	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:13.664244890 CEST	14355	49732	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:14.212970972 CEST	49733	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:14.218072891 CEST	14355	49733	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:14.218194008 CEST	49733	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:14.219259024 CEST	49733	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:14.224200010 CEST	14355	49733	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:14.224273920 CEST	49733	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:14.229105949 CEST	14355	49733	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:14.896898985 CEST	14355	49733	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:14.897003889 CEST	49733	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:16.904503107 CEST	49733	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:16.909699917 CEST	14355	49733	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:17.034636974 CEST	49734	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:17.039628983 CEST	14355	49734	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:17.039720058 CEST	49734	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:17.043160915 CEST	49734	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:17.047928095 CEST	14355	49734	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:17.047997952 CEST	49734	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:17.052869081 CEST	14355	49734	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:17.623087883 CEST	49734	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:17.627942085 CEST	14355	49734	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:18.727183104 CEST	14355	49734	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:18.727472067 CEST	49734	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:18.727539062 CEST	14355	49734	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:18.727597952 CEST	49734	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:18.727689028 CEST	14355	49734	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:18.727735996 CEST	49734	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:20.823441029 CEST	49734	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:20.828473091 CEST	14355	49734	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:21.149583101 CEST	49735	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:22.169809103 CEST	49735	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:22.203536034 CEST	14355	49735	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:22.203552961 CEST	14355	49735	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:22.203732014 CEST	49735	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:22.204240084 CEST	49735	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:22.209037066 CEST	14355	49735	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:22.209091902 CEST	49735	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:22.213906050 CEST	14355	49735	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:23.488065004 CEST	14355	49735	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:23.488152027 CEST	49735	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:25.504465103 CEST	49735	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:25.509366989 CEST	14355	49735	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:25.765696049 CEST	49736	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:25.771822929 CEST	14355	49736	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:25.771950960 CEST	49736	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:25.772943974 CEST	49736	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:25.777710915 CEST	14355	49736	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:25.777868032 CEST	49736	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:25.782695055 CEST	14355	49736	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:26.848176956 CEST	14355	49736	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:26.848360062 CEST	49736	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:28.865927935 CEST	49736	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:28.871071100 CEST	14355	49736	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:28.875679016 CEST	49737	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:28.880629063 CEST	14355	49737	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:28.880805016 CEST	49737	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:29.750221014 CEST	49737	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:29.755139112 CEST	14355	49737	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:29.755196095 CEST	49737	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:29.760008097 CEST	14355	49737	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:30.319767952 CEST	14355	49737	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:30.319958925 CEST	49737	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:32.326251984 CEST	49737	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:32.382282972 CEST	14355	49737	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:34.335273027 CEST	49738	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:34.340327024 CEST	14355	49738	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:34.340415955 CEST	49738	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:34.341099977 CEST	49738	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:34.346633911 CEST	14355	49738	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:34.346724987 CEST	49738	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:34.351551056 CEST	14355	49738	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:35.286156893 CEST	14355	49738	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:35.286354065 CEST	49738	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:37.303814888 CEST	49738	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:37.308726072 CEST	14355	49738	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:37.342005014 CEST	49739	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:37.346904993 CEST	14355	49739	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:37.347170115 CEST	49739	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:37.347851038 CEST	49739	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:37.352662086 CEST	14355	49739	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:37.352739096 CEST	49739	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:37.357614040 CEST	14355	49739	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:38.779978037 CEST	14355	49739	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:38.780050993 CEST	49739	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:38.780455112 CEST	14355	49739	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:38.780507088 CEST	49739	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:38.780878067 CEST	14355	49739	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:38.780921936 CEST	49739	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:40.809813976 CEST	49739	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:40.814824104 CEST	14355	49739	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:40.823441982 CEST	49740	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:40.828300953 CEST	14355	49740	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:40.828419924 CEST	49740	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:40.829036951 CEST	49740	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:40.833930016 CEST	14355	49740	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:40.834017038 CEST	49740	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:40.839405060 CEST	14355	49740	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:41.505377054 CEST	14355	49740	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:41.505461931 CEST	49740	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:43.513703108 CEST	49740	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:43.518706083 CEST	14355	49740	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:47.091957092 CEST	49741	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:47.097039938 CEST	14355	49741	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:47.097141027 CEST	49741	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:47.098118067 CEST	49741	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:47.102935076 CEST	14355	49741	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:47.103008032 CEST	49741	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:47.107868910 CEST	14355	49741	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:47.947573900 CEST	14355	49741	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:47.947721958 CEST	49741	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:49.967133999 CEST	49741	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:49.972326994 CEST	14355	49741	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:51.091944933 CEST	49742	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:51.097085953 CEST	14355	49742	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:51.097204924 CEST	49742	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:51.097856998 CEST	49742	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:51.102878094 CEST	14355	49742	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:51.102953911 CEST	49742	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:51.108036041 CEST	14355	49742	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:51.797533035 CEST	14355	49742	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:51.797605038 CEST	49742	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:53.963983059 CEST	49742	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:53.968976021 CEST	14355	49742	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:58.913691998 CEST	49743	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:58.918924093 CEST	14355	49743	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:58.919013977 CEST	49743	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:58.919701099 CEST	49743	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:58.924518108 CEST	14355	49743	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:58.924587965 CEST	49743	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:23:58.929856062 CEST	14355	49743	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:59.913670063 CEST	14355	49743	18.158.58.205	192.168.2.5
Oct 1, 2024 19:23:59.913918972 CEST	49743	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:24:01.989137888 CEST	49743	14355	192.168.2.5	18.158.58.205
Oct 1, 2024 19:24:01.994136095 CEST	14355	49743	18.158.58.205	192.168.2.5
Oct 1, 2024 19:24:06.325160980 CEST	49744	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:06.330260992 CEST	14355	49744	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:06.330411911 CEST	49744	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:06.331479073 CEST	49744	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:06.336591005 CEST	14355	49744	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:06.336677074 CEST	49744	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:06.341573000 CEST	14355	49744	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:07.320728064 CEST	14355	49744	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:07.320873022 CEST	49744	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:09.330497026 CEST	49744	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:09.335468054 CEST	14355	49744	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:12.446248055 CEST	49745	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:12.451380968 CEST	14355	49745	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:12.451471090 CEST	49745	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:13.906349897 CEST	49745	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:13.911627054 CEST	14355	49745	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:13.911710024 CEST	49745	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:13.916594982 CEST	14355	49745	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:14.443182945 CEST	14355	49745	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:14.443255901 CEST	49745	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:16.455329895 CEST	49745	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:16.484220982 CEST	49746	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:16.763550043 CEST	49745	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:17.372939110 CEST	49745	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:17.528258085 CEST	14355	49745	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:17.528275013 CEST	14355	49746	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:17.528284073 CEST	14355	49745	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:17.528386116 CEST	49745	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:17.529346943 CEST	49746	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:17.531692028 CEST	14355	49745	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:17.531740904 CEST	49745	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:24.978852034 CEST	49746	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:24.983742952 CEST	14355	49746	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:24.983815908 CEST	49746	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:24.988646984 CEST	14355	49746	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:25.020132065 CEST	49746	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:25.024945974 CEST	14355	49746	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:25.524611950 CEST	14355	49746	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:25.524668932 CEST	49746	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:27.575984955 CEST	49746	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:27.580914974 CEST	14355	49746	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:27.826560974 CEST	49747	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:27.831728935 CEST	14355	49747	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:27.831849098 CEST	49747	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:27.832465887 CEST	49747	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:27.837296963 CEST	14355	49747	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:27.837379932 CEST	49747	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:27.842178106 CEST	14355	49747	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:29.107357025 CEST	14355	49747	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:29.107435942 CEST	49747	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:31.126336098 CEST	49747	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:31.131186008 CEST	14355	49747	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:31.138966084 CEST	49748	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:31.143749952 CEST	14355	49748	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:31.143850088 CEST	49748	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:33.904490948 CEST	49748	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:34.263732910 CEST	49748	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:34.716494083 CEST	14355	49748	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:34.716511965 CEST	14355	49748	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:35.281356096 CEST	14355	49748	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:35.281431913 CEST	49748	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:37.294951916 CEST	49748	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:37.296243906 CEST	49749	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:37.299871922 CEST	14355	49748	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:37.301107883 CEST	14355	49749	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:37.301187038 CEST	49749	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:37.302131891 CEST	49749	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:37.306948900 CEST	14355	49749	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:37.307022095 CEST	49749	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:37.311830044 CEST	14355	49749	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:38.373837948 CEST	14355	49749	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:38.374038935 CEST	49749	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:40.413868904 CEST	49749	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:40.418781996 CEST	14355	49749	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:40.437951088 CEST	49750	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:40.442981005 CEST	14355	49750	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:40.443062067 CEST	49750	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:42.470604897 CEST	49750	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:42.779192924 CEST	49750	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:43.098786116 CEST	14355	49750	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:43.098807096 CEST	14355	49750	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:43.646085978 CEST	14355	49750	3.127.181.115	192.168.2.5
Oct 1, 2024 19:24:43.646178007 CEST	49750	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:45.677583933 CEST	49750	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:24:45.682485104 CEST	14355	49750	3.127.181.115	192.168.2.5
Oct 1, 2024 19:25:00.328857899 CEST	49751	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:25:00.928955078 CEST	14355	49751	3.127.181.115	192.168.2.5
Oct 1, 2024 19:25:00.929194927 CEST	49751	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:25:06.925611019 CEST	49751	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:25:06.930514097 CEST	14355	49751	3.127.181.115	192.168.2.5
Oct 1, 2024 19:25:06.930579901 CEST	49751	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:25:06.935456991 CEST	14355	49751	3.127.181.115	192.168.2.5
Oct 1, 2024 19:25:07.483666897 CEST	14355	49751	3.127.181.115	192.168.2.5
Oct 1, 2024 19:25:07.483889103 CEST	49751	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:25:09.628073931 CEST	49751	14355	192.168.2.5	3.127.181.115
Oct 1, 2024 19:25:09.633032084 CEST	14355	49751	3.127.181.115	192.168.2.5
Oct 1, 2024 19:25:20.810870886 CEST	49752	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:20.815771103 CEST	14355	49752	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:20.815874100 CEST	49752	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:20.816734076 CEST	49752	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:20.821580887 CEST	14355	49752	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:20.821656942 CEST	49752	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:20.826479912 CEST	14355	49752	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:21.737509012 CEST	14355	49752	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:21.737652063 CEST	49752	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:23.762590885 CEST	49752	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:23.767743111 CEST	14355	49752	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:28.777369022 CEST	49753	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:28.782799006 CEST	14355	49753	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:28.782898903 CEST	49753	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:28.783719063 CEST	49753	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:28.790216923 CEST	14355	49753	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:28.790292978 CEST	49753	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:28.796312094 CEST	14355	49753	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:29.823596001 CEST	14355	49753	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:29.823712111 CEST	49753	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:31.840001106 CEST	49753	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:31.854785919 CEST	49754	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:32.169795990 CEST	49753	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:32.674941063 CEST	14355	49753	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:32.674957037 CEST	14355	49754	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:32.674967051 CEST	14355	49753	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:32.675069094 CEST	49753	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:32.675749063 CEST	49754	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:32.675749063 CEST	49754	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:32.680511951 CEST	14355	49754	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:32.680588961 CEST	49754	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:32.686047077 CEST	14355	49754	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:33.929568052 CEST	14355	49754	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:33.929630995 CEST	49754	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:35.935606956 CEST	49754	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:35.936369896 CEST	49755	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:35.940599918 CEST	14355	49754	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:35.941224098 CEST	14355	49755	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:35.941293955 CEST	49755	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:36.785630941 CEST	49755	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:36.928989887 CEST	14355	49755	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:36.929075003 CEST	49755	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:36.934139013 CEST	14355	49755	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:37.463299990 CEST	14355	49755	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:37.463404894 CEST	49755	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:39.491530895 CEST	49755	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:39.496422052 CEST	14355	49755	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:39.501075029 CEST	49756	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:39.505939960 CEST	14355	49756	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:39.506017923 CEST	49756	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:39.506680012 CEST	49756	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:39.511504889 CEST	14355	49756	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:39.511579990 CEST	49756	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:39.516390085 CEST	14355	49756	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:40.429954052 CEST	14355	49756	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:40.430037022 CEST	49756	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:42.435775995 CEST	49756	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:42.440706968 CEST	14355	49756	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:42.970114946 CEST	49757	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:42.975058079 CEST	14355	49757	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:42.975128889 CEST	49757	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:42.979876995 CEST	49757	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:42.984811068 CEST	14355	49757	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:42.984878063 CEST	49757	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:42.989777088 CEST	14355	49757	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:44.221853018 CEST	14355	49757	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:44.221925974 CEST	49757	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:46.237648010 CEST	49757	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:46.242593050 CEST	14355	49757	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:46.580080986 CEST	49758	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:46.585179090 CEST	14355	49758	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:46.585270882 CEST	49758	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:46.883212090 CEST	49758	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:46.888175964 CEST	14355	49758	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:46.888237000 CEST	49758	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:46.893430948 CEST	14355	49758	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:47.498544931 CEST	14355	49758	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:47.498621941 CEST	49758	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:49.514934063 CEST	49758	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:49.519892931 CEST	14355	49758	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:50.701399088 CEST	49759	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:50.711623907 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:50.711759090 CEST	49759	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:50.712666035 CEST	49759	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:50.717658997 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:50.717741013 CEST	49759	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:50.722719908 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:52.232549906 CEST	49759	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:52.439167976 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:52.439250946 CEST	49759	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:52.440335989 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:52.440397024 CEST	49759	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:52.443689108 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:52.443742990 CEST	49759	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:52.445713997 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:52.445765972 CEST	49759	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:52.446474075 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:52.447756052 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:52.447763920 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:52.449863911 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:52.450581074 CEST	14355	49759	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:54.467287064 CEST	49760	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:54.472291946 CEST	14355	49760	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:54.472377062 CEST	49760	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:54.472863913 CEST	49760	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:54.477783918 CEST	14355	49760	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:54.477869987 CEST	49760	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:54.483050108 CEST	14355	49760	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:55.713640928 CEST	14355	49760	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:55.713866949 CEST	49760	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:57.716989994 CEST	49760	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:57.717919111 CEST	49761	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:57.722011089 CEST	14355	49760	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:57.722948074 CEST	14355	49761	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:57.723018885 CEST	49761	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:57.723542929 CEST	49761	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:57.728444099 CEST	14355	49761	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:57.728493929 CEST	49761	14355	192.168.2.5	3.64.4.198
Oct 1, 2024 19:25:57.733371973 CEST	14355	49761	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:58.968419075 CEST	14355	49761	3.64.4.198	192.168.2.5
Oct 1, 2024 19:25:58.970093012 CEST	49761	14355	192.168.2.5	3.64.4.198

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 19:22:02.586038113 CEST	52952	53	192.168.2.5	1.1.1.1
Oct 1, 2024 19:22:02.598268032 CEST	53	52952	1.1.1.1	192.168.2.5
Oct 1, 2024 19:23:03.983534098 CEST	50529	53	192.168.2.5	1.1.1.1
Oct 1, 2024 19:23:03.993117094 CEST	53	50529	1.1.1.1	192.168.2.5
Oct 1, 2024 19:24:04.218755007 CEST	57340	53	192.168.2.5	1.1.1.1
Oct 1, 2024 19:24:04.233175039 CEST	53	57340	1.1.1.1	192.168.2.5
Oct 1, 2024 19:25:10.947036982 CEST	54749	53	192.168.2.5	1.1.1.1
Oct 1, 2024 19:25:10.957207918 CEST	53	54749	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 19:22:02.586038113 CEST	192.168.2.5	1.1.1.1	0x992c	Standard query (0)	5.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:23:03.983534098 CEST	192.168.2.5	1.1.1.1	0x7bf	Standard query (0)	5.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:24:04.218755007 CEST	192.168.2.5	1.1.1.1	0x2306	Standard query (0)	5.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:25:10.947036982 CEST	192.168.2.5	1.1.1.1	0x323f	Standard query (0)	5.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 19:22:02.598268032 CEST	1.1.1.1	192.168.2.5	0x992c	No error (0)	5.tcp.eu.ngrok.io	3.67.161.133	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:23:03.993117094 CEST	1.1.1.1	192.168.2.5	0x7bf	No error (0)	5.tcp.eu.ngrok.io	18.158.58.205	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:24:04.233175039 CEST	1.1.1.1	192.168.2.5	0x2306	No error (0)	5.tcp.eu.ngrok.io	3.127.181.115	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:25:10.957207918 CEST	1.1.1.1	192.168.2.5	0x323f	No error (0)	5.tcp.eu.ngrok.io	3.64.4.198	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:21:52
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\nKHN8rvjmN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nKHN8rvjmN.exe"
Imagebase:	0xa0000
File size:	95'232 bytes
MD5 hash:	2545B47E98FFB00E68912DBEDCB8F5DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.2030472622.0000000003718000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.2002277926.00000000000A2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	13:21:54
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Local\Temp\server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\server.exe"
Imagebase:	0xf50000
File size:	95'232 bytes
MD5 hash:	2545B47E98FFB00E68912DBEDCB8F5DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000002.00000002.4452471336.0000000003521000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	13:21:55
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	13:21:55
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	13:21:57
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall delete allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe"
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	13:21:57
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	13:21:57
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	13:21:57
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	13:21:58
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\user\AppData\Local\Temp/StUpdate.exe
Imagebase:	0x420000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	13:21:58
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	13:21:59
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Local\Temp\StUpdate.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp/StUpdate.exe
Imagebase:	0x6e0000
File size:	95'232 bytes
MD5 hash:	2545B47E98FFB00E68912DBEDCB8F5DB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\StUpdate.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	13:22:01
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Local\Temp\StUpdate.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp/StUpdate.exe
Imagebase:	0xa30000
File size:	95'232 bytes
MD5 hash:	2545B47E98FFB00E68912DBEDCB8F5DB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	13:22:06
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe"
Imagebase:	0x8a0000
File size:	95'232 bytes
MD5 hash:	2545B47E98FFB00E68912DBEDCB8F5DB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	17
Start time:	13:22:09
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe"
Imagebase:	0xb20000
File size:	95'232 bytes
MD5 hash:	2545B47E98FFB00E68912DBEDCB8F5DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	18
Start time:	13:22:15
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe"
Imagebase:	0xc30000
File size:	95'232 bytes
MD5 hash:	2545B47E98FFB00E68912DBEDCB8F5DB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	19
Start time:	13:22:25
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe"
Imagebase:	0xec0000
File size:	95'232 bytes
MD5 hash:	2545B47E98FFB00E68912DBEDCB8F5DB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	21
Start time:	13:23:00
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Local\Temp\StUpdate.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp/StUpdate.exe
Imagebase:	0x3b0000
File size:	95'232 bytes
MD5 hash:	2545B47E98FFB00E68912DBEDCB8F5DB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	22
Start time:	13:24:00
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Local\Temp\StUpdate.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp/StUpdate.exe
Imagebase:	0x7ff632ac0000
File size:	95'232 bytes
MD5 hash:	2545B47E98FFB00E68912DBEDCB8F5DB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	23
Start time:	13:25:00
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Local\Temp\StUpdate.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp/StUpdate.exe
Imagebase:	0x230000
File size:	95'232 bytes
MD5 hash:	2545B47E98FFB00E68912DBEDCB8F5DB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true