Edit tour

Windows Analysis Report
jXBjxhHQgR.exe

Overview

General Information

Sample name:	jXBjxhHQgR.exe renamed because original name is a hash value
Original sample name:	8305c45696b7e6763ff343ca024682d1.exe
Analysis ID:	1444168
MD5:	8305c45696b7e6763ff343ca024682d1
SHA1:	b645f3fe56ac86ffde7d0e72ef48cd3eb4f48220
SHA256:	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e
Tags:	32CMSBruteexetrojan
Infos:

Detection

CMSBrute

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected CMSBrute

Contains functionality to inject code into remote processes

Drops PE files with benign system names

Found Tor onion address

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

May use the Tor software to hide its network traffic

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: Suspicious Process Parents

Sigma detected: System File Execution Location Anomaly

Connects to several IPs in different countries

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

jXBjxhHQgR.exe (PID: 6112 cmdline: "C:\Users\user\Desktop\jXBjxhHQgR.exe" MD5: 8305C45696B7E6763FF343CA024682D1)

jXBjxhHQgR.exe (PID: 4412 cmdline: "C:\Users\user\Desktop\jXBjxhHQgR.exe" MD5: 8305C45696B7E6763FF343CA024682D1)

csrss.exe (PID: 2792 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: 8305C45696B7E6763FF343CA024682D1)

csrss.exe (PID: 1468 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: 8305C45696B7E6763FF343CA024682D1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CMSBrute		No Attribution	https://securelist.com/the-shade-encryptor-a-double-threat/72087/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cmsbrute

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2101368330.0000000002291000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.2269982007.0000000002600000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.csrss.exe.400000.0.unpack	JoeSecurity_CMSBrute	Yara detected CMSBrute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\jXBjxhHQgR.exe, ProcessId: 4412, TargetFilename: C:\ProgramData\Drivers\csrss.exe

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 192.99.228.114, DestinationIsIpv6: false, DestinationPort: 666, EventID: 3, Image: C:\Users\user\Desktop\jXBjxhHQgR.exe, Initiated: true, ProcessId: 4412, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49739

Sigma detected: Suspicious Process Parents

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\ProgramData\Drivers\csrss.exe" , CommandLine: "C:\ProgramData\Drivers\csrss.exe" , CommandLine|base64offset|contains: , Image: C:\ProgramData\Drivers\csrss.exe, NewProcessName: C:\ProgramData\Drivers\csrss.exe, OriginalFileName: C:\ProgramData\Drivers\csrss.exe, ParentCommandLine: "C:\ProgramData\Drivers\csrss.exe" , ParentImage: C:\ProgramData\Drivers\csrss.exe, ParentProcessId: 2792, ParentProcessName: csrss.exe, ProcessCommandLine: "C:\ProgramData\Drivers\csrss.exe" , ProcessId: 1468, ProcessName: csrss.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\ProgramData\Drivers\csrss.exe" , CommandLine: "C:\ProgramData\Drivers\csrss.exe" , CommandLine|base64offset|contains: , Image: C:\ProgramData\Drivers\csrss.exe, NewProcessName: C:\ProgramData\Drivers\csrss.exe, OriginalFileName: C:\ProgramData\Drivers\csrss.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\ProgramData\Drivers\csrss.exe" , ProcessId: 2792, ProcessName: csrss.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 51.89.17.143, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\Desktop\jXBjxhHQgR.exe, Initiated: true, ProcessId: 4412, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49795

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Drivers\csrss.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\jXBjxhHQgR.exe, ProcessId: 4412, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\ProgramData\Drivers\csrss.exe" , CommandLine: "C:\ProgramData\Drivers\csrss.exe" , CommandLine|base64offset|contains: , Image: C:\ProgramData\Drivers\csrss.exe, NewProcessName: C:\ProgramData\Drivers\csrss.exe, OriginalFileName: C:\ProgramData\Drivers\csrss.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\ProgramData\Drivers\csrss.exe" , ProcessId: 2792, ProcessName: csrss.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: jXBjxhHQgR.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\ProgramData\Drivers\csrss.exe

Avira: detection malicious, Label: HEUR/AGEN.1311176

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Drivers\csrss.exe	ReversingLabs: Detection: 42%
Source: C:\ProgramData\Drivers\csrss.exe	Virustotal: Detection: 45%			Perma Link

Multi AV Scanner detection for submitted file

Source: jXBjxhHQgR.exe	ReversingLabs: Detection: 42%
Source: jXBjxhHQgR.exe	Virustotal: Detection: 45%			Perma Link

Machine Learning detection for dropped file

Source: C:\ProgramData\Drivers\csrss.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: jXBjxhHQgR.exe

Joe Sandbox ML: detected

Source: jXBjxhHQgR.exe, 00000002.00000003.2907239458.0000000003B2C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

memstr_0fcf652c-5

Source: jXBjxhHQgR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 130.225.244.90:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.154.106.60:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.148.53.59:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.148.150.100:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.16.147:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.64.217:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 98.115.87.163:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.216.223.2:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.252.175:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.157.136.251:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.93.180:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.251.116.82:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.199.55:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.20.35.116:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.143.81.27:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.148.53.59:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.16.147:443 -> 192.168.2.6:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.45.98.188:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.148.150.100:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.64.217:443 -> 192.168.2.6:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.212.72.189:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.107.176.31:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.251.116.82:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.148.53.59:443 -> 192.168.2.6:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.81.93.39:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.44.247.102:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.216.223.2:443 -> 192.168.2.6:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.252.175:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.210.123.24:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.92.34.123:443 -> 192.168.2.6:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.20.35.116:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.92.34.123:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.93.180:443 -> 192.168.2.6:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.251.116.82:443 -> 192.168.2.6:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.143.81.27:443 -> 192.168.2.6:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.199.55:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.45.98.188:443 -> 192.168.2.6:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.216.223.2:443 -> 192.168.2.6:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.199.55:443 -> 192.168.2.6:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.107.176.31:443 -> 192.168.2.6:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.157.136.251:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.92.34.123:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.93.180:443 -> 192.168.2.6:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.212.72.189:443 -> 192.168.2.6:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.92.34.123:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.162.229.73:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.6:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.93.180:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.6:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.6:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.6:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.66.35.11:443 -> 192.168.2.6:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.6:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.154.240.58:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.6:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.168.70.178:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.168.70.178:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.92.34.123:443 -> 192.168.2.6:49899 version: TLS 1.2

Networking

Found Tor onion address

Source: csrss.exe, 00000005.00000002.3335454812.0000000000824000.00000040.00000400.00020000.00000000.sdmp

String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{

Source: unknown

Network traffic detected: IP country count 20

Source: global traffic	TCP traffic: 192.168.2.6:49713 -> 147.92.88.67:9001
Source: global traffic	TCP traffic: 192.168.2.6:49714 -> 195.123.209.91:5092
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 178.17.170.13:9001
Source: global traffic	TCP traffic: 192.168.2.6:49728 -> 185.82.217.49:9001
Source: global traffic	TCP traffic: 192.168.2.6:49735 -> 148.251.41.235:9001
Source: global traffic	TCP traffic: 192.168.2.6:49738 -> 195.201.199.223:1234
Source: global traffic	TCP traffic: 192.168.2.6:49740 -> 51.210.103.252:9001
Source: global traffic	TCP traffic: 192.168.2.6:49742 -> 195.154.168.209:9500
Source: global traffic	TCP traffic: 192.168.2.6:49746 -> 193.142.146.239:9001
Source: global traffic	TCP traffic: 192.168.2.6:49748 -> 145.239.41.102:9100
Source: global traffic	TCP traffic: 192.168.2.6:49752 -> 107.189.8.12:9001
Source: global traffic	TCP traffic: 192.168.2.6:49753 -> 144.217.32.158:9001
Source: global traffic	TCP traffic: 192.168.2.6:49756 -> 193.11.114.46:9003
Source: global traffic	TCP traffic: 192.168.2.6:49758 -> 5.253.84.137:9100
Source: global traffic	TCP traffic: 192.168.2.6:49763 -> 185.220.101.154:11154
Source: global traffic	TCP traffic: 192.168.2.6:49764 -> 85.93.254.36:60443
Source: global traffic	TCP traffic: 192.168.2.6:49765 -> 91.234.199.232:9001
Source: global traffic	TCP traffic: 192.168.2.6:49767 -> 195.154.104.174:9001
Source: global traffic	TCP traffic: 192.168.2.6:49769 -> 193.105.134.186:9001
Source: global traffic	TCP traffic: 192.168.2.6:49770 -> 217.194.154.18:46856
Source: global traffic	TCP traffic: 192.168.2.6:49772 -> 15.204.140.9:8443
Source: global traffic	TCP traffic: 192.168.2.6:49773 -> 134.102.200.101:9001
Source: global traffic	TCP traffic: 192.168.2.6:49775 -> 51.222.24.62:9001
Source: global traffic	TCP traffic: 192.168.2.6:49776 -> 135.148.54.98:9001
Source: global traffic	TCP traffic: 192.168.2.6:49777 -> 185.243.218.202:13443
Source: global traffic	TCP traffic: 192.168.2.6:49779 -> 15.204.234.61:9100
Source: global traffic	TCP traffic: 192.168.2.6:49781 -> 185.220.101.196:8443
Source: global traffic	TCP traffic: 192.168.2.6:49783 -> 65.21.195.87:9001
Source: global traffic	TCP traffic: 192.168.2.6:49782 -> 89.58.34.53:9001
Source: global traffic	TCP traffic: 192.168.2.6:49784 -> 202.61.237.56:2087
Source: global traffic	TCP traffic: 192.168.2.6:49785 -> 109.104.152.127:9001
Source: global traffic	TCP traffic: 192.168.2.6:49788 -> 45.141.57.69:9001
Source: global traffic	TCP traffic: 192.168.2.6:49790 -> 96.234.180.68:9001
Source: global traffic	TCP traffic: 192.168.2.6:49791 -> 84.247.164.65:9001
Source: global traffic	TCP traffic: 192.168.2.6:49792 -> 5.255.109.214:9001
Source: global traffic	TCP traffic: 192.168.2.6:49795 -> 51.89.17.143:8080
Source: global traffic	TCP traffic: 192.168.2.6:49794 -> 37.1.204.243:9001
Source: global traffic	TCP traffic: 192.168.2.6:49868 -> 128.31.0.39:9101

Source: Joe Sandbox View	IP Address: 171.25.193.9 171.25.193.9
Source: Joe Sandbox View	IP Address: 171.25.193.9 171.25.193.9
Source: Joe Sandbox View	IP Address: 45.66.33.45 45.66.33.45

Source: Joe Sandbox View

JA3 fingerprint: 83d60721ecc423892660e275acc4dffd

Source: unknown	TCP traffic detected without corresponding DNS query: 130.225.244.90
Source: unknown	TCP traffic detected without corresponding DNS query: 130.225.244.90
Source: unknown	TCP traffic detected without corresponding DNS query: 130.225.244.90
Source: unknown	TCP traffic detected without corresponding DNS query: 130.225.244.90
Source: unknown	TCP traffic detected without corresponding DNS query: 130.225.244.90
Source: unknown	TCP traffic detected without corresponding DNS query: 130.225.244.90
Source: unknown	TCP traffic detected without corresponding DNS query: 147.92.88.67
Source: unknown	TCP traffic detected without corresponding DNS query: 147.92.88.67
Source: unknown	TCP traffic detected without corresponding DNS query: 147.92.88.67
Source: unknown	TCP traffic detected without corresponding DNS query: 195.123.209.91
Source: unknown	TCP traffic detected without corresponding DNS query: 195.123.209.91
Source: unknown	TCP traffic detected without corresponding DNS query: 195.123.209.91
Source: unknown	TCP traffic detected without corresponding DNS query: 147.92.88.67
Source: unknown	TCP traffic detected without corresponding DNS query: 147.92.88.67
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.106.60
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.106.60
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.33.45
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.106.60
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.33.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.33.45
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.106.60
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.106.60
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.106.60
Source: unknown	TCP traffic detected without corresponding DNS query: 195.123.209.91
Source: unknown	TCP traffic detected without corresponding DNS query: 195.123.209.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.33.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.33.45
Source: unknown	TCP traffic detected without corresponding DNS query: 178.17.170.13
Source: unknown	TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown	TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown	TCP traffic detected without corresponding DNS query: 178.17.170.13
Source: unknown	TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown	TCP traffic detected without corresponding DNS query: 178.17.170.13
Source: unknown	TCP traffic detected without corresponding DNS query: 178.17.170.13
Source: unknown	TCP traffic detected without corresponding DNS query: 178.17.170.13
Source: unknown	TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown	TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown	TCP traffic detected without corresponding DNS query: 185.82.217.49
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 185.82.217.49
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 185.82.217.49
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 185.82.217.49
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 185.82.217.49
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9

Source: csrss.exe, 00000005.00000002.3336796106.0000000002812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 4,~d,~www.yahoo.com equals www.yahoo.com (Yahoo)
Source: csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000005.00000002.3336796106.000000000281C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)
Source: csrss.exe, 00000005.00000002.3336796106.0000000002812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)

Source: csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlTYPE=2OpenSSL
Source: csrss.exe, 00000005.00000002.3335454812.0000000000824000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/re
Source: csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2
Source: csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: jXBjxhHQgR.exe, 00000002.00000003.2622001999.0000000002EF6000.00000004.00000020.00020000.00000000.sdmp, jXBjxhHQgR.exe, 00000002.00000003.3073536204.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, jXBjxhHQgR.exe, 00000002.00000003.3079199680.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, jXBjxhHQgR.exe, 00000002.00000003.2592881168.00000000036B1000.00000004.00000020.00020000.00000000.sdmp, jXBjxhHQgR.exe, 00000002.00000003.2596024674.0000000003A67000.00000004.00000020.00020000.00000000.sdmp, jXBjxhHQgR.exe, 00000002.00000003.2593135666.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, cached-microdesc-consensus.tmp.2.dr, unverified-microdesc-consensus.tmp.2.dr	String found in binary or memory: https://sabotage.net
Source: csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
Source: csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.torproject.org/
Source: csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.torproject.org/documentation.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	HTTPS traffic detected: 130.225.244.90:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.154.106.60:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.148.53.59:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.148.150.100:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.16.147:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.64.217:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 98.115.87.163:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.216.223.2:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.252.175:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.157.136.251:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.93.180:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.251.116.82:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.199.55:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.20.35.116:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.143.81.27:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.148.53.59:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.16.147:443 -> 192.168.2.6:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.45.98.188:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.148.150.100:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.64.217:443 -> 192.168.2.6:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.212.72.189:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.107.176.31:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.251.116.82:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.148.53.59:443 -> 192.168.2.6:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.81.93.39:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.44.247.102:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.216.223.2:443 -> 192.168.2.6:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.252.175:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 62.210.123.24:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.92.34.123:443 -> 192.168.2.6:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.20.35.116:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.92.34.123:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.93.180:443 -> 192.168.2.6:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.251.116.82:443 -> 192.168.2.6:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.143.81.27:443 -> 192.168.2.6:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.199.55:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.45.98.188:443 -> 192.168.2.6:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.216.223.2:443 -> 192.168.2.6:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.199.55:443 -> 192.168.2.6:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.107.176.31:443 -> 192.168.2.6:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.157.136.251:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.92.34.123:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.93.180:443 -> 192.168.2.6:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.212.72.189:443 -> 192.168.2.6:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.92.34.123:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.162.229.73:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.6:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.93.180:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.6:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.6:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.6:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.66.35.11:443 -> 192.168.2.6:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.6:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.154.240.58:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.6:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.168.70.178:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.168.70.178:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.92.34.123:443 -> 192.168.2.6:49899 version: TLS 1.2

E-Banking Fraud

Yara detected CMSBrute

Source: Yara match

File source: 5.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2101368330.0000000002291000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.2269982007.0000000002600000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_02450110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		0_2_02450110
Source: C:\ProgramData\Drivers\csrss.exe	Code function: 3_2_02800110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		3_2_02800110

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_0040F87A	0_2_0040F87A
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_00411897	0_2_00411897
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_004039D9	0_2_004039D9
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_0040F308	0_2_0040F308
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_0040C7F0	0_2_0040C7F0

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Code function: String function: 00404EE0 appears 34 times

Source: jXBjxhHQgR.exe	Binary or memory string: OriginalFilename vs jXBjxhHQgR.exe
Source: jXBjxhHQgR.exe, 00000000.00000000.2092683607.000000000061B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesFilezera> vs jXBjxhHQgR.exe
Source: jXBjxhHQgR.exe, 00000002.00000000.2100798216.000000000061B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesFilezera> vs jXBjxhHQgR.exe
Source: jXBjxhHQgR.exe	Binary or memory string: OriginalFilenamesFilezera> vs jXBjxhHQgR.exe

Source: jXBjxhHQgR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2101368330.0000000002291000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.2269982007.0000000002600000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/9@0/79

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Code function: 0_2_022917C6 CreateToolhelp32Snapshot,Module32First,

0_2_022917C6

Source: C:\ProgramData\Drivers\csrss.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

File created: C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\

Jump to behavior

Source: jXBjxhHQgR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: jXBjxhHQgR.exe	ReversingLabs: Detection: 42%
Source: jXBjxhHQgR.exe	Virustotal: Detection: 45%

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

File read: C:\Users\user\Desktop\jXBjxhHQgR.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\jXBjxhHQgR.exe "C:\Users\user\Desktop\jXBjxhHQgR.exe"
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Process created: C:\Users\user\Desktop\jXBjxhHQgR.exe "C:\Users\user\Desktop\jXBjxhHQgR.exe"
Source: unknown	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Process created: C:\Users\user\Desktop\jXBjxhHQgR.exe "C:\Users\user\Desktop\jXBjxhHQgR.exe"	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"	Jump to behavior

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: ubsec.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: ubsec.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: jXBjxhHQgR.exe

Static file information: File size 1950208 > 1048576

Source: jXBjxhHQgR.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1b9c00

Source: jXBjxhHQgR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_00411ACC push eax; ret	0_2_00411AEA
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_00404F25 push ecx; ret	0_2_00404F38
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_02338A35 push ds; ret	0_2_02338A36
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_023EBA51 push eax; retf	0_2_023EBA53
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_023EBAB0 push A7EF5AB4h; ret	0_2_023EBAB7
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_023DFAE0 push esi; iretd	0_2_023DFAEB
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_023042C0 push eax; iretd	0_2_023042C9
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_0231C3F1 push edx; ret	0_2_0231C3F3
Source: C:\ProgramData\Drivers\csrss.exe	Code function: 3_2_0275AA31 push eax; retf	3_2_0275AA33
Source: C:\ProgramData\Drivers\csrss.exe	Code function: 3_2_026A7A15 push ds; ret	3_2_026A7A16
Source: C:\ProgramData\Drivers\csrss.exe	Code function: 3_2_0274EAC0 push esi; iretd	3_2_0274EACB
Source: C:\ProgramData\Drivers\csrss.exe	Code function: 3_2_026732A0 push eax; iretd	3_2_026732A9
Source: C:\ProgramData\Drivers\csrss.exe	Code function: 3_2_0275AA90 push A7EF5AB4h; ret	3_2_0275AA97
Source: C:\ProgramData\Drivers\csrss.exe	Code function: 3_2_0268B3D1 push edx; ret	3_2_0268B3D3
Source: C:\ProgramData\Drivers\csrss.exe	Code function: 5_2_00696299 push ecx; ret	5_2_006962AC

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

File created: C:\ProgramData\Drivers\csrss.exe

Jump to dropped file

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

File created: C:\ProgramData\Drivers\csrss.exe

Jump to dropped file

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

File created: C:\ProgramData\Drivers\csrss.exe

Jump to dropped file

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run CSRSS			Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run CSRSS			Jump to behavior

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Source: csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: onion-port

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Code function: 0_2_004039D9 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004039D9

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Window / User API: threadDelayed 1879	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Window / User API: threadDelayed 7892	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Window / User API: threadDelayed 3119	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Window / User API: threadDelayed 6873	Jump to behavior

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-8553

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe TID: 4180	Thread sleep count: 1879 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe TID: 4180	Thread sleep time: -187900s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe TID: 4180	Thread sleep count: 7892 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe TID: 4180	Thread sleep time: -789200s >= -30000s	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 64	Thread sleep count: 3119 > 30	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 64	Thread sleep time: -311900s >= -30000s	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 64	Thread sleep count: 6873 > 30	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 64	Thread sleep time: -687300s >= -30000s	Jump to behavior

Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed

Source: csrss.exe, 00000005.00000002.3336626399.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: csrss.exe, 00000005.00000002.3336464632.0000000000C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

API call chain: ExitProcess graph end node

graph_0-8555

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Code function: 0_2_0040D1F4 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0040D1F4

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

0_2_0040D1F4

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_022910A3 push dword ptr fs:[00000030h]	0_2_022910A3
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_02450042 push dword ptr fs:[00000030h]	0_2_02450042
Source: C:\ProgramData\Drivers\csrss.exe	Code function: 3_2_02600083 push dword ptr fs:[00000030h]	3_2_02600083
Source: C:\ProgramData\Drivers\csrss.exe	Code function: 3_2_02800042 push dword ptr fs:[00000030h]	3_2_02800042

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Code function: 0_2_0041154F __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_0041154F

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_00407176 SetUnhandledExceptionFilter,		0_2_00407176
Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Code function: 0_2_004071A7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_004071A7

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Code function: 0_2_02450110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_02450110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Memory written: C:\Users\user\Desktop\jXBjxhHQgR.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Memory written: C:\ProgramData\Drivers\csrss.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe	Process created: C:\Users\user\Desktop\jXBjxhHQgR.exe "C:\Users\user\Desktop\jXBjxhHQgR.exe"			Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"			Jump to behavior

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Code function: 0_2_004043D6 cpuid

0_2_004043D6

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Code function: 0_2_00408873 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00408873

Source: C:\Users\user\Desktop\jXBjxhHQgR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	211 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	211 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Multi-hop Proxy	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	2 Proxy	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
jXBjxhHQgR.exe	42%	ReversingLabs
jXBjxhHQgR.exe	46%	Virustotal		Browse
jXBjxhHQgR.exe	100%	Avira	HEUR/AGEN.1311176
jXBjxhHQgR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\Drivers\csrss.exe	100%	Avira	HEUR/AGEN.1311176
C:\ProgramData\Drivers\csrss.exe	100%	Joe Sandbox ML
C:\ProgramData\Drivers\csrss.exe	42%	ReversingLabs
C:\ProgramData\Drivers\csrss.exe	46%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://sabotage.net	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
https://curl.se/docs/hsts.html	0%	Avira URL Cloud	safe
https://www.torproject.org/	0%	Avira URL Cloud	safe
https://curl.se/docs/alt-svc.html	0%	Avira URL Cloud	safe
https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2	0%	Avira URL Cloud	safe
http://www.openssl.org/support/faq.htmlTYPE=2OpenSSL	0%	Avira URL Cloud	safe
http://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/re	0%	Avira URL Cloud	safe
https://curl.se/docs/http-cookies.html	0%	Avira URL Cloud	safe
https://www.torproject.org/documentation.html	0%	Avira URL Cloud	safe
https://trac.torproject.org/projects/tor/ticket/14917.	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Virustotal		Browse
http://www.openssl.org/support/faq.htmlTYPE=2OpenSSL	0%	Virustotal		Browse
https://www.torproject.org/documentation.html	0%	Virustotal		Browse
https://trac.torproject.org/projects/tor/ticket/14917.	0%	Virustotal		Browse
https://curl.se/docs/http-cookies.html	0%	Virustotal		Browse
https://curl.se/docs/alt-svc.html	0%	Virustotal		Browse
https://www.torproject.org/	1%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://curl.se/docs/hsts.html	csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.htmlTYPE=2OpenSSL	csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.torproject.org/	csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html	csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2	csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html	csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/re	csrss.exe, 00000005.00000002.3335454812.0000000000824000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://sabotage.net	jXBjxhHQgR.exe, 00000002.00000003.2622001999.0000000002EF6000.00000004.00000020.00020000.00000000.sdmp, jXBjxhHQgR.exe, 00000002.00000003.3073536204.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, jXBjxhHQgR.exe, 00000002.00000003.3079199680.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, jXBjxhHQgR.exe, 00000002.00000003.2592881168.00000000036B1000.00000004.00000020.00020000.00000000.sdmp, jXBjxhHQgR.exe, 00000002.00000003.2596024674.0000000003A67000.00000004.00000020.00020000.00000000.sdmp, jXBjxhHQgR.exe, 00000002.00000003.2593135666.00000000037F3000.00000004.00000020.00020000.00000000.sdmp, cached-microdesc-consensus.tmp.2.dr, unverified-microdesc-consensus.tmp.2.dr	false	URL Reputation: safe	unknown
https://www.torproject.org/documentation.html	csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://trac.torproject.org/projects/tor/ticket/14917.	csrss.exe, 00000005.00000002.3335454812.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
171.25.193.9	unknown	Sweden	198093	DFRI-ASForeningenfordigitalafri-ochrattigheterSE	false
195.201.199.223	unknown	Germany	24940	HETZNER-ASDE	false
178.254.31.125	unknown	Germany	42730	EVANZOASDE	false
135.148.54.98	unknown	United States	18676	AVAYAUS	false
38.154.240.58	unknown	United States	174	COGENT-174US	false
89.58.34.53	unknown	Germany	5430	FREENETDEfreenetDatenkommunikationsGmbHDE	false
45.66.33.45	unknown	Netherlands	47482	SPECTRENL	false
5.253.84.137	unknown	Cyprus	57863	SAIBSA	false
109.104.152.127	unknown	Albania	48265	ITIRANA-AL-ASImportfromPronetAL	false
65.109.93.180	unknown	United States	11022	ALABANZA-BALTUS	false
185.220.101.154	unknown	Germany	208294	ASMKNL	false
185.220.101.196	unknown	Germany	208294	ASMKNL	false
83.212.72.189	unknown	Greece	9069	AthensEgaleoGREECEGR	false
217.194.154.18	unknown	United Kingdom	8513	SKYVISIONGB	false
23.157.136.251	unknown	Reserved	396101	NETCLOUD-ASNUS	false
96.234.180.68	unknown	United States	701	UUNETUS	false
51.89.17.143	unknown	France	16276	OVHFR	false
95.217.199.55	unknown	Germany	24940	HETZNER-ASDE	false
86.59.21.38	unknown	Austria	8437	UTA-ASAT	false
65.21.195.87	unknown	United States	199592	CP-ASDE	false
162.251.116.82	unknown	Reserved	6576	SUMMITCOMMUS	false
98.115.87.163	unknown	United States	701	UUNETUS	false
185.233.104.172	unknown	Germany	197540	NETCUP-ASnetcupGmbHDE	false
154.35.175.225	unknown	United States	14987	RETHEMHOSTINGUS	false
91.234.199.232	unknown	Ukraine	51252	DSSGROUP-ASUA	false
107.189.8.12	unknown	United States	53667	PONYNETUS	false
128.31.0.39	unknown	United States	3	MIT-GATEWAYSUS	false
195.154.106.60	unknown	France	12876	OnlineSASFR	false
185.243.218.202	unknown	Norway	56655	TERRAHOSTNO	false
45.66.35.11	unknown	Netherlands	47482	SPECTRENL	false
185.82.217.49	unknown	Bulgaria	59729	ITL-BG	false
204.13.164.118	unknown	United States	25700	25700US	false
195.154.104.174	unknown	France	12876	OnlineSASFR	false
147.135.31.134	unknown	United States	16276	OVHFR	false
37.1.204.243	unknown	Ukraine	58061	SCALAXY-ASNL	false
162.19.252.175	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
51.210.103.252	unknown	France	16276	OVHFR	false
23.92.34.123	unknown	United States	54098	LIONLINK-NETWORKSUS	false
134.102.200.101	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
5.255.109.214	unknown	Netherlands	60404	LITESERVERNL	false
144.217.32.158	unknown	Canada	16276	OVHFR	false
202.61.237.56	unknown	Australia	4842	TH-AS-APTianhaiInfoTechCN	false
193.23.244.244	unknown	Germany	50472	CHAOS-ASDE	false
62.210.123.24	unknown	France	12876	OnlineSASFR	false
95.217.112.218	unknown	Germany	24940	HETZNER-ASDE	false
147.92.88.67	unknown	United States	396097	SAIL-INETUS	false
147.135.64.217	unknown	United States	16276	OVHFR	false
88.216.223.2	unknown	Lithuania	47838	SOCIUSLT	false
185.220.101.211	unknown	Germany	208294	ASMKNL	false
46.20.35.116	unknown	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	false
147.135.16.147	unknown	United States	16276	OVHFR	false
15.204.234.61	unknown	United States	71	HP-INTERNET-ASUS	false
77.162.229.73	unknown	Netherlands	1136	KPNKPNNationalEU	false
51.81.93.39	unknown	United States	16276	OVHFR	false
148.251.41.235	unknown	Germany	24940	HETZNER-ASDE	false
192.99.228.114	unknown	Canada	16276	OVHFR	true
135.148.53.59	unknown	United States	18676	AVAYAUS	false
142.44.247.102	unknown	Canada	16276	OVHFR	false
131.188.40.189	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
15.204.140.9	unknown	United States	71	HP-INTERNET-ASUS	false
193.11.114.46	unknown	Sweden	1653	SUNETSUNETSwedishUniversityNetworkEU	false
176.107.176.31	unknown	Ukraine	42331	FREEHOSTUA	false
195.123.209.91	unknown	Bulgaria	50979	ITL-LV	false
130.225.244.90	unknown	Denmark	1835	FSKNET-DKForskningsnettet-DanishnetworkforResearchand	false
91.143.81.27	unknown	Germany	35366	ISPPRO-ASISPPRO-AScoversthenetworksofISPproDE	false
145.239.41.102	unknown	France	16276	OVHFR	false
199.58.81.140	unknown	Canada	7765	KOUMBITCA	false
193.105.134.186	unknown	Sweden	42237	ICMESE	false
195.154.168.209	unknown	France	12876	OnlineSASFR	false
89.168.70.178	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
84.247.164.65	unknown	Norway	29300	AS-DIRECTCONNECTNO	false
5.45.98.188	unknown	Germany	197540	NETCUP-ASnetcupGmbHDE	false
135.148.150.100	unknown	United States	18676	AVAYAUS	false
45.141.57.69	unknown	Germany	30823	COMBAHTONcombahtonGmbHDE	false
193.142.146.239	unknown	Netherlands	208046	HOSTSLICK-GERMANYNL	false
85.93.254.36	unknown	Norway	61275	ASN-NEASNO	false
178.17.170.13	unknown	Moldova Republic of	43289	TRABIAMD	false
51.222.24.62	unknown	France	16276	OVHFR	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1444168
Start date and time:	2024-05-20 09:22:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jXBjxhHQgR.exe renamed because original name is a hash value
Original Sample Name:	8305c45696b7e6763ff343ca024682d1.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/9@0/79
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target csrss.exe, PID 1468 because there are no executed function
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:23:40	API Interceptor	1760682x Sleep call for process: jXBjxhHQgR.exe modified
03:23:55	API Interceptor	836309x Sleep call for process: csrss.exe modified
09:23:06	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run CSRSS "C:\ProgramData\Drivers\csrss.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
171.25.193.9	R53a3ZJHBQ.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9/tor/status-vote/current/consensus
	x3WX1kHqcx.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9/tor/status-vote/current/consensus
	oGO7Hy4YCH.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9/tor/status-vote/current/consensus
	SPXp2YHDFz.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	ILI1MGzcig.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	lwRhzjuYIg.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	OVrJ9mtD6Y.exe	Get hash	malicious	TinyNuke	Browse	171.25.193.9/tor/status-vote/current/consensus
	F75rJPKdGb.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	ozJy5Zf5cf.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	zfpLjnr5P9.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
178.254.31.125	Mcb5K3TOWT.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse
	01b9T4tDdG.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	Unknown	Browse
135.148.54.98	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
38.154.240.58	38gmTjpc3Y.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse
38.154.240.58	RlvKA19dEC.exe	Get hash	malicious	BazaLoader	Browse
45.66.33.45	PHHOjspjmp.exe	Get hash	malicious	CMSBrute	Browse
	Mcb5K3TOWT.exe	Get hash	malicious	Unknown	Browse
	906o5yr1NE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse
	KWwpSm0Cec.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse
	SKHOtnHl7J.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse
	1AIemYSAZy.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse
	ENEDGCErLu.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc, SystemBC	Browse
	OShRqF6jNV.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc, SystemBC, Xmrig	Browse
	MCYq2AqNU0.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse
	e6sLDuysz9.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EVANZOASDE	Mcb5K3TOWT.exe	Get hash	malicious	Unknown	Browse	178.254.31.125
	iHdfLpj7dF.elf	Get hash	malicious	Mirai	Browse	178.254.19.6
	https://379388.seu2.cleverreach.com/c/91435175/9b36c77c185-s82q1v	Get hash	malicious	Unknown	Browse	178.254.10.205
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	178.254.31.125
	http://www.trim-glb.de	Get hash	malicious	Unknown	Browse	178.254.10.72
	uetfu6ZLWZ.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Stealc	Browse	178.254.26.126
	01b9T4tDdG.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	178.254.31.125
	SyD1FiOG1p.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	178.254.24.208
	Bznx8G6dMz.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	178.254.12.152
	file.exe	Get hash	malicious	Unknown	Browse	178.254.31.125
AVAYAUS	GK9sEyIS4f.elf	Get hash	malicious	Mirai	Browse	135.57.160.207
	cOADrrPFLT.elf	Get hash	malicious	Mirai	Browse	135.83.183.45
	N4OvIeLPCh.elf	Get hash	malicious	Mirai	Browse	135.81.180.185
	9MKcu3Fa7q.elf	Get hash	malicious	Mirai	Browse	135.60.217.87
	16blfU3HlS.elf	Get hash	malicious	Mirai	Browse	198.158.115.221
	fKfXkNYfLY.elf	Get hash	malicious	Mirai	Browse	198.155.83.118
	qMh36Rvh4J.elf	Get hash	malicious	Mirai	Browse	135.83.183.84
	EE9yU8bN9i.elf	Get hash	malicious	Unknown	Browse	135.60.205.63
	4DSN0Zi9Og.elf	Get hash	malicious	Unknown	Browse	135.80.96.182
	NnS9ImJPht.elf	Get hash	malicious	Unknown	Browse	135.105.43.31
COGENT-174US	PO#RMS9877946001 RMSMARINE SERVICE.com.exe	Get hash	malicious	Remcos, GuLoader	Browse	38.15.131.137
	AAwUREvt6b.elf	Get hash	malicious	Mirai	Browse	38.176.106.82
	xRBySTKZ8E.elf	Get hash	malicious	Mirai	Browse	38.61.98.154
	TxXQ106ErI.elf	Get hash	malicious	Mirai	Browse	38.191.248.9
	RE Draft BL for BK#440019497 REF#388855.exe	Get hash	malicious	FormBook	Browse	38.47.232.37
	GK9sEyIS4f.elf	Get hash	malicious	Mirai	Browse	38.120.27.193
	eyKGju2MU8.elf	Get hash	malicious	Mirai	Browse	206.232.91.81
	IUzBqUNYMK.elf	Get hash	malicious	Unknown	Browse	38.250.231.36
	file.exe	Get hash	malicious	SystemBC	Browse	154.55.194.116
	https://pixeldrain.com/l/fXxFweL2	Get hash	malicious	Babadeda, Blank Grabber, Osno	Browse	50.7.236.50
HETZNER-ASDE	RE Draft BL for BK#440019497 REF#388855.exe	Get hash	malicious	FormBook	Browse	116.203.164.244
	https://mobile-sides-vertical-2.xv2.us/	Get hash	malicious	Unknown	Browse	78.46.3.4
	https://kko10-secondary.z8.web.core.windows.net/werrx01USAHTML/?bcda=02331-9759-835	Get hash	malicious	Unknown	Browse	195.201.57.90
	IUzBqUNYMK.elf	Get hash	malicious	Unknown	Browse	148.251.179.178
	file.exe	Get hash	malicious	SystemBC	Browse	176.9.131.126
	file.exe	Get hash	malicious	Vidar	Browse	116.202.5.235
	https://pixeldrain.com/l/fXxFweL2	Get hash	malicious	Babadeda, Blank Grabber, Osno	Browse	78.47.86.208
	file.exe	Get hash	malicious	Vidar	Browse	116.202.5.235
	qbs5CBr95m.exe	Get hash	malicious	CryptOne, Vidar	Browse	116.202.5.235
	Xy52lgBlGY.exe	Get hash	malicious	CryptOne, Vidar	Browse	116.202.5.235
DFRI-ASForeningenfordigitalafri-ochrattigheterSE	c8sDO7umrx.exe	Get hash	malicious	CMSBrute	Browse	171.25.193.9
	PHHOjspjmp.exe	Get hash	malicious	CMSBrute	Browse	171.25.193.9
	77system.vbs	Get hash	malicious	Xmrig	Browse	171.25.193.20
	Mcb5K3TOWT.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	7VzdKNO227.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	LIRR4A0xzv.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	171.25.193.9
	m5EyzJ7S8S.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse	171.25.193.9
	906o5yr1NE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse	171.25.193.9
	PjgTyZiVh0.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc, Xmrig	Browse	171.25.193.9
	xZnG1FFx7L.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	171.25.193.9

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
83d60721ecc423892660e275acc4dffd	c8sDO7umrx.exe	Get hash	malicious	CMSBrute	Browse	62.210.123.24 38.154.240.58 147.135.64.217 88.216.223.2 65.109.93.180 46.20.35.116 83.212.72.189 147.135.16.147 77.162.229.73 23.157.136.251 95.217.199.55 98.115.87.163 162.251.116.82 51.81.93.39 135.148.53.59 142.44.247.102 131.188.40.189 176.107.176.31 195.154.106.60 45.66.35.11 130.225.244.90 91.143.81.27 204.13.164.118 199.58.81.140 89.168.70.178 162.19.252.175 5.45.98.188 135.148.150.100 23.92.34.123 193.23.244.244
	PHHOjspjmp.exe	Get hash	malicious	CMSBrute	Browse	62.210.123.24 38.154.240.58 147.135.64.217 88.216.223.2 65.109.93.180 46.20.35.116 83.212.72.189 147.135.16.147 77.162.229.73 23.157.136.251 95.217.199.55 98.115.87.163 162.251.116.82 51.81.93.39 135.148.53.59 142.44.247.102 131.188.40.189 176.107.176.31 195.154.106.60 45.66.35.11 130.225.244.90 91.143.81.27 204.13.164.118 199.58.81.140 89.168.70.178 162.19.252.175 5.45.98.188 135.148.150.100 23.92.34.123 193.23.244.244
	Mcb5K3TOWT.exe	Get hash	malicious	Unknown	Browse	62.210.123.24 38.154.240.58 147.135.64.217 88.216.223.2 65.109.93.180 46.20.35.116 83.212.72.189 147.135.16.147 77.162.229.73 23.157.136.251 95.217.199.55 98.115.87.163 162.251.116.82 51.81.93.39 135.148.53.59 142.44.247.102 131.188.40.189 176.107.176.31 195.154.106.60 45.66.35.11 130.225.244.90 91.143.81.27 204.13.164.118 199.58.81.140 89.168.70.178 162.19.252.175 5.45.98.188 135.148.150.100 23.92.34.123 193.23.244.244
	7VzdKNO227.exe	Get hash	malicious	Unknown	Browse	62.210.123.24 38.154.240.58 147.135.64.217 88.216.223.2 65.109.93.180 46.20.35.116 83.212.72.189 147.135.16.147 77.162.229.73 23.157.136.251 95.217.199.55 98.115.87.163 162.251.116.82 51.81.93.39 135.148.53.59 142.44.247.102 131.188.40.189 176.107.176.31 195.154.106.60 45.66.35.11 130.225.244.90 91.143.81.27 204.13.164.118 199.58.81.140 89.168.70.178 162.19.252.175 5.45.98.188 135.148.150.100 23.92.34.123 193.23.244.244
	fonts-util	Get hash	malicious	Unknown	Browse	62.210.123.24 38.154.240.58 147.135.64.217 88.216.223.2 65.109.93.180 46.20.35.116 83.212.72.189 147.135.16.147 77.162.229.73 23.157.136.251 95.217.199.55 98.115.87.163 162.251.116.82 51.81.93.39 135.148.53.59 142.44.247.102 131.188.40.189 176.107.176.31 195.154.106.60 45.66.35.11 130.225.244.90 91.143.81.27 204.13.164.118 199.58.81.140 89.168.70.178 162.19.252.175 5.45.98.188 135.148.150.100 23.92.34.123 193.23.244.244
	cups-utils-helper	Get hash	malicious	Unknown	Browse	62.210.123.24 38.154.240.58 147.135.64.217 88.216.223.2 65.109.93.180 46.20.35.116 83.212.72.189 147.135.16.147 77.162.229.73 23.157.136.251 95.217.199.55 98.115.87.163 162.251.116.82 51.81.93.39 135.148.53.59 142.44.247.102 131.188.40.189 176.107.176.31 195.154.106.60 45.66.35.11 130.225.244.90 91.143.81.27 204.13.164.118 199.58.81.140 89.168.70.178 162.19.252.175 5.45.98.188 135.148.150.100 23.92.34.123 193.23.244.244
	LIRR4A0xzv.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	62.210.123.24 38.154.240.58 147.135.64.217 88.216.223.2 65.109.93.180 46.20.35.116 83.212.72.189 147.135.16.147 77.162.229.73 23.157.136.251 95.217.199.55 98.115.87.163 162.251.116.82 51.81.93.39 135.148.53.59 142.44.247.102 131.188.40.189 176.107.176.31 195.154.106.60 45.66.35.11 130.225.244.90 91.143.81.27 204.13.164.118 199.58.81.140 89.168.70.178 162.19.252.175 5.45.98.188 135.148.150.100 23.92.34.123 193.23.244.244
	SecuriteInfo.com.Win32.RansomX-gen.4067.126.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, RedLine, SmokeLoader	Browse	62.210.123.24 38.154.240.58 147.135.64.217 88.216.223.2 65.109.93.180 46.20.35.116 83.212.72.189 147.135.16.147 77.162.229.73 23.157.136.251 95.217.199.55 98.115.87.163 162.251.116.82 51.81.93.39 135.148.53.59 142.44.247.102 131.188.40.189 176.107.176.31 195.154.106.60 45.66.35.11 130.225.244.90 91.143.81.27 204.13.164.118 199.58.81.140 89.168.70.178 162.19.252.175 5.45.98.188 135.148.150.100 23.92.34.123 193.23.244.244
	m5EyzJ7S8S.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse	62.210.123.24 38.154.240.58 147.135.64.217 88.216.223.2 65.109.93.180 46.20.35.116 83.212.72.189 147.135.16.147 77.162.229.73 23.157.136.251 95.217.199.55 98.115.87.163 162.251.116.82 51.81.93.39 135.148.53.59 142.44.247.102 131.188.40.189 176.107.176.31 195.154.106.60 45.66.35.11 130.225.244.90 91.143.81.27 204.13.164.118 199.58.81.140 89.168.70.178 162.19.252.175 5.45.98.188 135.148.150.100 23.92.34.123 193.23.244.244
	7vMi37TpMO.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	62.210.123.24 38.154.240.58 147.135.64.217 88.216.223.2 65.109.93.180 46.20.35.116 83.212.72.189 147.135.16.147 77.162.229.73 23.157.136.251 95.217.199.55 98.115.87.163 162.251.116.82 51.81.93.39 135.148.53.59 142.44.247.102 131.188.40.189 176.107.176.31 195.154.106.60 45.66.35.11 130.225.244.90 91.143.81.27 204.13.164.118 199.58.81.140 89.168.70.178 162.19.252.175 5.45.98.188 135.148.150.100 23.92.34.123 193.23.244.244

Process:	C:\Users\user\Desktop\jXBjxhHQgR.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1950208
Entropy (8bit):	7.959914992966583
Encrypted:	false
SSDEEP:	49152:WlsJPNJLt1TzK2m8Q2AajccD1RTsTmeC2yHL+Hq:WOJPNJDm8Q2Q4Tf2Y6
MD5:	8305C45696B7E6763FF343CA024682D1
SHA1:	B645F3FE56AC86FFDE7D0E72EF48CD3EB4F48220
SHA-256:	649A88EF17DAFB0BD1F0D55E752DE143E2428927DD5E754B65B5B4B251069C1E
SHA-512:	0140F7B9F17EF4491E901EAE2B6D882975E679594E1D208FC13E19BC88670B274F7B36F79F94A0F03BAF1413C87AEB5CF42687D41AE4B85F9C98B7C38F54474A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42% Antivirus: Virustotal, Detection: 46%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[7..:Y.:Y.:Y.h..:Y.h...:Y.h..:Y.B..:Y.:X..:Y.1...:Y.h..:Y.1...:Y.Rich.:Y.........................PE..L....[.c.....................>!......=....... ....@..........................`"......;.........................................d.....!.............................8................................x..@............ ..d............................text...3........................... ..`.rdata...k... ...l..................@..@.data..... ..........\|..............@....rsrc.........!.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4KPV6A~1\cached-certs (copy)

Download File

Process:	C:\Users\user\Desktop\jXBjxhHQgR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20852
Entropy (8bit):	6.0533350090263625
Encrypted:	false
SSDEEP:	384:y/40VVq1h8PXt9MY4JVtG1hIcCy5U411HVz1h7b50IU4mV91h5/ea4igBVA1hrqw:oJiO9BELGf/Wmxvb+3jnt2a9gBSySyLu
MD5:	E4AFF22D0F098D3FFE3BB5DCD93A4E7F
SHA1:	EE1330D68C176F2FCD03BA0AB684E99EC02FDE47
SHA-256:	99D9C86697CFBE13981752FAF0980122B95FAE9FF1CD6EAF828D72E52CD40BC9
SHA-512:	3BA7D72C586CA88D3380E2810302227C86E959183D4CBBE1A7E62F6E019937AD7EBFE3ECB6930BD3C315D84510DA09DE8A3BA4F309687B19DA7EDFB40EC2AB10
Malicious:	false
Reputation:	low
Preview:	dir-key-certificate-version 3..fingerprint 23D15D965BC35114467363C165C4F724B64B4F66..dir-key-published 2023-09-02 14:31:55..dir-key-expires 2024-09-02 14:31:55..dir-identity-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEAlv6XS+VppPaQzOgor0YFlcXLWeXiMn5N3VBneXuw8maLOu9oPJ9z..2/oMQN8a+VOWTf+/jebGzOBK6MamXpgsIZPQWiT18gZMsYdR8mcqBYqVP3khwUWh..9QYkV+m+Auxa0TLzTrsi6dLDJ384XdpDweU+YJghMJNZ1NqiT8ogj84hxs5Tf+Qf..bn7EBIcU7SAKr5Lw25KrMb5e3AZSC5MilBS/KLgVTq/GiWb7pKd5pxGwlGolNX8a..PccZ2ZT2DrSQsct4wVxhSbUqANI3PfMpXvmUDxWWBgbQwLF02/4gi+13snlHtqwl..y1WjE55HVfx1CTX13SStwmF/N3SFtFf1qil3j5qrHdHtKlAYOaTfqab1eLVH1l83..LI5QWD7ri9GpPqIjlh6PuaHjaO2FW20SouZtS9jJKwi1l1G3ef1tSlha1cxkRxIp..U/ngvQBsoa9X26VfQA4MieZgVVdMVwjCNh2YC9aEXc/KxfcBueZkM1194qP88cVu..dOFYaftOkuGPAgMBAAE=..-----END RSA PUBLIC KEY-----..dir-signing-key..-----BEGIN RSA PUBLIC KEY-----..MIIBCgKCAQEAsTgcO/j4mOopmrzOci9YXEWg9n1Dd7rFfeZcse/IV6wPbleb/Z0z..C6XQFfbtEPahRACpBbTH3fPEqSrR0wnrMzezD0jSUH6YjcKnPH3gxqcMH4rRbB0P..XrBmuCaEV0TzdorruxxKJvTTTB0Z

C:\Users\user\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus (copy)

Download File

Process:	C:\Users\user\Desktop\jXBjxhHQgR.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2602942
Entropy (8bit):	5.609188387971644
Encrypted:	false
SSDEEP:	12288:ZrvOrwNzZoGSfoKbtYtJhx5x2MRexCMOqtsZAsCXByqX5Sb:ZrTNzRJBRMxOobsCAs5+
MD5:	85989AD48363B4F972FFFB50C90CD77F
SHA1:	0D1570E8EF32E485917011BA6BBFC313133D0D61
SHA-256:	C598182A7CA2FF63DCE744A72C5CF877DECDDD339A3AE88921B12D97C5F9C50D
SHA-512:	3C522410A466CA0F2C0286D5738E7FD28A2E0440281D091F363C60103B72B4D28C670A5CCD7986C8A8CF10E2DEF857EC5F628190FF873FEAD57FB4DA229F7181
Malicious:	false
Reputation:	low
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2024-05-20 07:00:00.fresh-until 2024-05-20 08:00:00.valid-until 2024-05-20 10:00:00.voting-delay 300 300.client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11.server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.params AuthDirMaxServersPerAdd

C:\Users\user\AppData\Local\Temp\4KPV6A~1\state (copy)

Download File

Process:	C:\Users\user\Desktop\jXBjxhHQgR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9790
Entropy (8bit):	5.30326842218623
Encrypted:	false
SSDEEP:	192:HbydFlUfLONQGC4zvM4Ik4yZjvN/SgT5z2tKoWL:7ydXUfKNQjEdI3gsi
MD5:	1619B2A5FB6DF383CACE463E5CEE6FCA
SHA1:	25B3A97CA58C5036AC740A9E489006AD6942B6DF
SHA-256:	3EA62B92962EF8FFADA7F29331AEAA3BBABB6616D85A02DBFB790022BCB0442D
SHA-512:	E59A30A373408FD6944C5C30B7CB552F7A505763CAE2EB99F92626BF8A09EC9A865809472AFFDA117542BED72FBF63AF43F07DC7F647E7FF3CDA5461BA0183D3
Malicious:	false
Reputation:	low
Preview:	# Tor state file last generated on 2024-05-20 17:55:47 local time..# Other times below are in UTC..# You do not need to edit this file.....Dormant 0..Guard in=default rsa_id=0EAAFDA08C5066DAB083B9D03980A3B9F3B54C5E nickname=biancacensori sampled_on=2024-05-17T07:59:33 sampled_idx=0 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=5CDEC940C15EA7DABBFA8F58CD8945B875DA80C6 nickname=kikimora sampled_on=2024-05-15T02:28:26 sampled_idx=1 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=FC1E441E097BA36930AA2F615EFB325AF76D2595 nickname=torcatgirlcloud sampled_on=2024-05-09T20:40:18 sampled_idx=2 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=99839C211B81FE5D08D2E1E7EF0734EAFC013999 nickname=Unnamed sampled_on=2024-05-15T14:18:15 sampled_idx=3 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=ECEA80FA730FE334D96FDABD2D6829DE52C3F849 nickname=Nightmare sampled_on=2024-05-16T18:47:44 sampled_idx=4 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=53AD3B560F118E2D0B2433DD4F4

C:\Users\user\AppData\Local\Temp\4KPV6A~1\unverified-microdesc-consensus (copy)

Download File

Process:	C:\Users\user\Desktop\jXBjxhHQgR.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2602942
Entropy (8bit):	5.609188387971644
Encrypted:	false
SSDEEP:	12288:ZrvOrwNzZoGSfoKbtYtJhx5x2MRexCMOqtsZAsCXByqX5Sb:ZrTNzRJBRMxOobsCAs5+
MD5:	85989AD48363B4F972FFFB50C90CD77F
SHA1:	0D1570E8EF32E485917011BA6BBFC313133D0D61
SHA-256:	C598182A7CA2FF63DCE744A72C5CF877DECDDD339A3AE88921B12D97C5F9C50D
SHA-512:	3C522410A466CA0F2C0286D5738E7FD28A2E0440281D091F363C60103B72B4D28C670A5CCD7986C8A8CF10E2DEF857EC5F628190FF873FEAD57FB4DA229F7181
Malicious:	false
Reputation:	low
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2024-05-20 07:00:00.fresh-until 2024-05-20 08:00:00.valid-until 2024-05-20 10:00:00.voting-delay 300 300.client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11.server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.params AuthDirMaxServersPerAdd

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\cached-certs.tmp

Download File

Process:	C:\Users\user\Desktop\jXBjxhHQgR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20852
Entropy (8bit):	6.0533350090263625
Encrypted:	false
SSDEEP:	384:y/40VVq1h8PXt9MY4JVtG1hIcCy5U411HVz1h7b50IU4mV91h5/ea4igBVA1hrqw:oJiO9BELGf/Wmxvb+3jnt2a9gBSySyLu
MD5:	E4AFF22D0F098D3FFE3BB5DCD93A4E7F
SHA1:	EE1330D68C176F2FCD03BA0AB684E99EC02FDE47
SHA-256:	99D9C86697CFBE13981752FAF0980122B95FAE9FF1CD6EAF828D72E52CD40BC9
SHA-512:	3BA7D72C586CA88D3380E2810302227C86E959183D4CBBE1A7E62F6E019937AD7EBFE3ECB6930BD3C315D84510DA09DE8A3BA4F309687B19DA7EDFB40EC2AB10
Malicious:	false
Reputation:	low
Preview:	dir-key-certificate-version 3..fingerprint 23D15D965BC35114467363C165C4F724B64B4F66..dir-key-published 2023-09-02 14:31:55..dir-key-expires 2024-09-02 14:31:55..dir-identity-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEAlv6XS+VppPaQzOgor0YFlcXLWeXiMn5N3VBneXuw8maLOu9oPJ9z..2/oMQN8a+VOWTf+/jebGzOBK6MamXpgsIZPQWiT18gZMsYdR8mcqBYqVP3khwUWh..9QYkV+m+Auxa0TLzTrsi6dLDJ384XdpDweU+YJghMJNZ1NqiT8ogj84hxs5Tf+Qf..bn7EBIcU7SAKr5Lw25KrMb5e3AZSC5MilBS/KLgVTq/GiWb7pKd5pxGwlGolNX8a..PccZ2ZT2DrSQsct4wVxhSbUqANI3PfMpXvmUDxWWBgbQwLF02/4gi+13snlHtqwl..y1WjE55HVfx1CTX13SStwmF/N3SFtFf1qil3j5qrHdHtKlAYOaTfqab1eLVH1l83..LI5QWD7ri9GpPqIjlh6PuaHjaO2FW20SouZtS9jJKwi1l1G3ef1tSlha1cxkRxIp..U/ngvQBsoa9X26VfQA4MieZgVVdMVwjCNh2YC9aEXc/KxfcBueZkM1194qP88cVu..dOFYaftOkuGPAgMBAAE=..-----END RSA PUBLIC KEY-----..dir-signing-key..-----BEGIN RSA PUBLIC KEY-----..MIIBCgKCAQEAsTgcO/j4mOopmrzOci9YXEWg9n1Dd7rFfeZcse/IV6wPbleb/Z0z..C6XQFfbtEPahRACpBbTH3fPEqSrR0wnrMzezD0jSUH6YjcKnPH3gxqcMH4rRbB0P..XrBmuCaEV0TzdorruxxKJvTTTB0Z

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\cached-microdesc-consensus.tmp

Download File

Process:	C:\Users\user\Desktop\jXBjxhHQgR.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2602942
Entropy (8bit):	5.609188387971644
Encrypted:	false
SSDEEP:	12288:ZrvOrwNzZoGSfoKbtYtJhx5x2MRexCMOqtsZAsCXByqX5Sb:ZrTNzRJBRMxOobsCAs5+
MD5:	85989AD48363B4F972FFFB50C90CD77F
SHA1:	0D1570E8EF32E485917011BA6BBFC313133D0D61
SHA-256:	C598182A7CA2FF63DCE744A72C5CF877DECDDD339A3AE88921B12D97C5F9C50D
SHA-512:	3C522410A466CA0F2C0286D5738E7FD28A2E0440281D091F363C60103B72B4D28C670A5CCD7986C8A8CF10E2DEF857EC5F628190FF873FEAD57FB4DA229F7181
Malicious:	false
Reputation:	low
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2024-05-20 07:00:00.fresh-until 2024-05-20 08:00:00.valid-until 2024-05-20 10:00:00.voting-delay 300 300.client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11.server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.params AuthDirMaxServersPerAdd

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\state.tmp

Download File

Process:	C:\Users\user\Desktop\jXBjxhHQgR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	9790
Entropy (8bit):	5.30326842218623
Encrypted:	false
SSDEEP:	192:HbydFlUfLONQGC4zvM4Ik4yZjvN/SgT5z2tKoWL:7ydXUfKNQjEdI3gsi
MD5:	1619B2A5FB6DF383CACE463E5CEE6FCA
SHA1:	25B3A97CA58C5036AC740A9E489006AD6942B6DF
SHA-256:	3EA62B92962EF8FFADA7F29331AEAA3BBABB6616D85A02DBFB790022BCB0442D
SHA-512:	E59A30A373408FD6944C5C30B7CB552F7A505763CAE2EB99F92626BF8A09EC9A865809472AFFDA117542BED72FBF63AF43F07DC7F647E7FF3CDA5461BA0183D3
Malicious:	false
Reputation:	low
Preview:	# Tor state file last generated on 2024-05-20 17:55:47 local time..# Other times below are in UTC..# You do not need to edit this file.....Dormant 0..Guard in=default rsa_id=0EAAFDA08C5066DAB083B9D03980A3B9F3B54C5E nickname=biancacensori sampled_on=2024-05-17T07:59:33 sampled_idx=0 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=5CDEC940C15EA7DABBFA8F58CD8945B875DA80C6 nickname=kikimora sampled_on=2024-05-15T02:28:26 sampled_idx=1 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=FC1E441E097BA36930AA2F615EFB325AF76D2595 nickname=torcatgirlcloud sampled_on=2024-05-09T20:40:18 sampled_idx=2 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=99839C211B81FE5D08D2E1E7EF0734EAFC013999 nickname=Unnamed sampled_on=2024-05-15T14:18:15 sampled_idx=3 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=ECEA80FA730FE334D96FDABD2D6829DE52C3F849 nickname=Nightmare sampled_on=2024-05-16T18:47:44 sampled_idx=4 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=53AD3B560F118E2D0B2433DD4F4

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\unverified-microdesc-consensus.tmp

Download File

Process:	C:\Users\user\Desktop\jXBjxhHQgR.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2602942
Entropy (8bit):	5.609188387971644
Encrypted:	false
SSDEEP:	12288:ZrvOrwNzZoGSfoKbtYtJhx5x2MRexCMOqtsZAsCXByqX5Sb:ZrTNzRJBRMxOobsCAs5+
MD5:	85989AD48363B4F972FFFB50C90CD77F
SHA1:	0D1570E8EF32E485917011BA6BBFC313133D0D61
SHA-256:	C598182A7CA2FF63DCE744A72C5CF877DECDDD339A3AE88921B12D97C5F9C50D
SHA-512:	3C522410A466CA0F2C0286D5738E7FD28A2E0440281D091F363C60103B72B4D28C670A5CCD7986C8A8CF10E2DEF857EC5F628190FF873FEAD57FB4DA229F7181
Malicious:	false
Reputation:	low
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2024-05-20 07:00:00.fresh-until 2024-05-20 08:00:00.valid-until 2024-05-20 10:00:00.voting-delay 300 300.client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11.server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.params AuthDirMaxServersPerAdd

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.959914992966583
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	jXBjxhHQgR.exe
File size:	1'950'208 bytes
MD5:	8305c45696b7e6763ff343ca024682d1
SHA1:	b645f3fe56ac86ffde7d0e72ef48cd3eb4f48220
SHA256:	649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e
SHA512:	0140f7b9f17ef4491e901eae2b6d882975e679594e1d208fc13e19bc88670b274f7b36f79f94a0f03baf1413c87aeb5cf42687d41ae4b85f9c98b7c38f54474a
SSDEEP:	49152:WlsJPNJLt1TzK2m8Q2AajccD1RTsTmeC2yHL+Hq:WOJPNJDm8Q2Q4Tf2Y6
TLSH:	C495230335D7C031E9B7C135582486F54A3BFC329923DADB676C2B0FA4761A28A376B5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[7..:Y..:Y..:Y..h...:Y..h...:Y..h...:Y..B...:Y..:X..:Y.1....:Y..h...:Y.1....:Y.Rich.:Y.........................PE..L....[.c...

File Icon


Icon Hash:	71514529494c444b

Static PE Info

General

Entrypoint:	0x403d86
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63F95BC9 [Sat Feb 25 00:52:25 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	37b83adc183001c9e38660b73f251c40

Entrypoint Preview

Instruction
call 00007F218C7DFB2Dh
jmp 00007F218C7DAEC4h
cmp ecx, dword ptr [00419428h]
jne 00007F218C7DB044h
rep ret
jmp 00007F218C7DFC9Ch
push ebp
mov ebp, esp
sub esp, 20h
push esi
push edi
push 00000008h
pop ecx
mov esi, 004130E0h
lea edi, dword ptr [ebp-20h]
rep movsd
mov esi, dword ptr [ebp+0Ch]
mov edi, dword ptr [ebp+08h]
test esi, esi
je 00007F218C7DB055h
test byte ptr [esi], 00000010h
je 00007F218C7DB050h
mov ecx, dword ptr [edi]
sub ecx, 04h
push ecx
mov eax, dword ptr [ecx]
mov esi, dword ptr [eax+18h]
call dword ptr [eax+20h]
mov dword ptr [ebp-08h], edi
mov dword ptr [ebp-04h], esi
test esi, esi
je 00007F218C7DB04Eh
test byte ptr [esi], 00000008h
je 00007F218C7DB049h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [00412098h]
pop edi
pop esi
mov esp, ebp
pop ebp
retn 0008h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00419428h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push ebp
mov ebp, esp
push esi
cld
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [esi+08h]
xor ecx, esi
call 00007F218C7DAF8Bh
push 00000000h
push esi

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x183d4	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x21b000	0xa810	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x18438	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x178b8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x12000	0x164	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10b33	0x10c00	a586dc1c1bcbae50023233037b66bb59	False	0.6024661847014925	data	6.705983144416262	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x6bf2	0x6c00	34898aa02e7f8adb08110703eeb76928	False	0.3904079861111111	data	4.736117568977362	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19000	0x201308	0x1b9c00	6e375cace8477e6abf70b8be6f6e553e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x21b000	0xa810	0xaa00	991d710e835cc3a012f3f76b89f60075	False	0.45762867647058825	data	5.070490495297634	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x222700	0x2	data			5.0
YUYE	0x221390	0x136f	ASCII text, with very long lines (4975), with no line terminators	Japanese	Japan	0.594572864321608
RT_CURSOR	0x222708	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0			0.1948529411764706
RT_CURSOR	0x222a38	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.33223684210526316
RT_CURSOR	0x222b90	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x223a38	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x2242e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_ICON	0x21b4f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Japanese	Japan	0.43230277185501065
RT_ICON	0x21c398	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Japanese	Japan	0.555956678700361
RT_ICON	0x21cc40	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.581221198156682
RT_ICON	0x21d308	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Japanese	Japan	0.601878612716763
RT_ICON	0x21d870	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.445643153526971
RT_ICON	0x21fe18	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Japanese	Japan	0.4915572232645403
RT_ICON	0x220ec0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.5203900709219859
RT_STRING	0x224ad0	0x42e	data	Japanese	Japan	0.4532710280373832
RT_STRING	0x224f00	0x66e	data	Japanese	Japan	0.43195625759416767
RT_STRING	0x225570	0x29a	StarOffice Gallery theme e, 0 objects	Japanese	Japan	0.48348348348348347
RT_GROUP_CURSOR	0x222b68	0x22	data			1.0294117647058822
RT_GROUP_CURSOR	0x224848	0x30	data			0.9375
RT_GROUP_ICON	0x221328	0x68	data	Japanese	Japan	0.6826923076923077
RT_VERSION	0x224878	0x258	data			0.535

Imports

DLL	Import
KERNEL32.dll	GetTickCount, TzSpecificLocalTimeToSystemTime, WriteConsoleW, GetSystemDirectoryA, SetComputerNameExW, IsBadStringPtrA, GetLastError, SetLastError, GetProcAddress, LoadLibraryA, GetConsoleAliasA, GetNumberFormatW, CreateEventW, RemoveDirectoryW, GetModuleFileNameA, BuildCommDCBA, VirtualProtect, PurgeComm, SetFileAttributesW, GetVolumeInformationW, CloseHandle, CreateFileW, GetStringTypeW, LocalAlloc, LoadLibraryExW, OutputDebugStringW, GetConsoleCP, IsProcessorFeaturePresent, EncodePointer, DecodePointer, ExitProcess, GetModuleHandleExW, AreFileApisANSI, MultiByteToWideChar, WideCharToMultiByte, GetCommandLineW, RaiseException, RtlUnwind, IsDebuggerPresent, HeapAlloc, HeapSize, EnterCriticalSection, LeaveCriticalSection, HeapFree, ReadFile, SetFilePointerEx, DeleteCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetModuleHandleW, GetStdHandle, WriteFile, GetModuleFileNameW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCurrentThreadId, GetProcessHeap, GetFileType, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, LCMapStringW, GetConsoleMode, ReadConsoleW, SetStdHandle, FlushFileBuffers, SetEndOfFile
USER32.dll	GetMenuItemID, ChangeDisplaySettingsW
GDI32.dll	GetCharWidthI
ole32.dll	CoMarshalHresult

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 20, 2024 09:23:04.537004948 CEST	49712	443	192.168.2.6	130.225.244.90
May 20, 2024 09:23:04.537048101 CEST	443	49712	130.225.244.90	192.168.2.6
May 20, 2024 09:23:04.537132978 CEST	49712	443	192.168.2.6	130.225.244.90
May 20, 2024 09:23:04.542603970 CEST	49712	443	192.168.2.6	130.225.244.90
May 20, 2024 09:23:04.542629957 CEST	443	49712	130.225.244.90	192.168.2.6
May 20, 2024 09:23:05.544045925 CEST	443	49712	130.225.244.90	192.168.2.6
May 20, 2024 09:23:05.544138908 CEST	49712	443	192.168.2.6	130.225.244.90
May 20, 2024 09:23:05.548300028 CEST	49712	443	192.168.2.6	130.225.244.90
May 20, 2024 09:23:05.548316956 CEST	443	49712	130.225.244.90	192.168.2.6
May 20, 2024 09:23:05.548748016 CEST	443	49712	130.225.244.90	192.168.2.6
May 20, 2024 09:23:05.548995972 CEST	49712	443	192.168.2.6	130.225.244.90
May 20, 2024 09:23:05.592114925 CEST	443	49712	130.225.244.90	192.168.2.6
May 20, 2024 09:23:06.407011986 CEST	49713	9001	192.168.2.6	147.92.88.67
May 20, 2024 09:23:06.482223988 CEST	9001	49713	147.92.88.67	192.168.2.6
May 20, 2024 09:23:06.482373953 CEST	49713	9001	192.168.2.6	147.92.88.67
May 20, 2024 09:23:06.483628035 CEST	49713	9001	192.168.2.6	147.92.88.67
May 20, 2024 09:23:06.498759985 CEST	9001	49713	147.92.88.67	192.168.2.6
May 20, 2024 09:23:07.408863068 CEST	49714	5092	192.168.2.6	195.123.209.91
May 20, 2024 09:23:07.438178062 CEST	5092	49714	195.123.209.91	192.168.2.6
May 20, 2024 09:23:07.438348055 CEST	49714	5092	192.168.2.6	195.123.209.91
May 20, 2024 09:23:07.442372084 CEST	49714	5092	192.168.2.6	195.123.209.91
May 20, 2024 09:23:07.450512886 CEST	5092	49714	195.123.209.91	192.168.2.6
May 20, 2024 09:23:14.861973047 CEST	9001	49713	147.92.88.67	192.168.2.6
May 20, 2024 09:23:14.862040997 CEST	49713	9001	192.168.2.6	147.92.88.67
May 20, 2024 09:23:14.862143040 CEST	49713	9001	192.168.2.6	147.92.88.67
May 20, 2024 09:23:14.862675905 CEST	49716	443	192.168.2.6	195.154.106.60
May 20, 2024 09:23:14.862704992 CEST	443	49716	195.154.106.60	192.168.2.6
May 20, 2024 09:23:14.862777948 CEST	49716	443	192.168.2.6	195.154.106.60
May 20, 2024 09:23:14.862910032 CEST	49717	443	192.168.2.6	45.66.33.45
May 20, 2024 09:23:14.862967014 CEST	443	49717	45.66.33.45	192.168.2.6
May 20, 2024 09:23:14.863023996 CEST	49716	443	192.168.2.6	195.154.106.60
May 20, 2024 09:23:14.863035917 CEST	443	49716	195.154.106.60	192.168.2.6
May 20, 2024 09:23:14.863059044 CEST	49717	443	192.168.2.6	45.66.33.45
May 20, 2024 09:23:14.863187075 CEST	49717	443	192.168.2.6	45.66.33.45
May 20, 2024 09:23:14.863198042 CEST	443	49717	45.66.33.45	192.168.2.6
May 20, 2024 09:23:14.915441036 CEST	9001	49713	147.92.88.67	192.168.2.6
May 20, 2024 09:23:15.717621088 CEST	443	49716	195.154.106.60	192.168.2.6
May 20, 2024 09:23:15.717767000 CEST	49716	443	192.168.2.6	195.154.106.60
May 20, 2024 09:23:15.737056017 CEST	49716	443	192.168.2.6	195.154.106.60
May 20, 2024 09:23:15.737081051 CEST	443	49716	195.154.106.60	192.168.2.6
May 20, 2024 09:23:15.737453938 CEST	443	49716	195.154.106.60	192.168.2.6
May 20, 2024 09:23:15.737632036 CEST	49716	443	192.168.2.6	195.154.106.60
May 20, 2024 09:23:15.780157089 CEST	443	49716	195.154.106.60	192.168.2.6
May 20, 2024 09:23:15.797590971 CEST	5092	49714	195.123.209.91	192.168.2.6
May 20, 2024 09:23:15.797678947 CEST	49714	5092	192.168.2.6	195.123.209.91
May 20, 2024 09:23:15.797919989 CEST	49714	5092	192.168.2.6	195.123.209.91
May 20, 2024 09:23:15.848534107 CEST	5092	49714	195.123.209.91	192.168.2.6
May 20, 2024 09:23:31.845134020 CEST	443	49717	45.66.33.45	192.168.2.6
May 20, 2024 09:23:31.845253944 CEST	49717	443	192.168.2.6	45.66.33.45
May 20, 2024 09:23:31.845383883 CEST	49717	443	192.168.2.6	45.66.33.45
May 20, 2024 09:23:31.845427990 CEST	443	49717	45.66.33.45	192.168.2.6
May 20, 2024 09:23:31.851613045 CEST	49725	9001	192.168.2.6	178.17.170.13
May 20, 2024 09:23:31.851752996 CEST	49726	443	192.168.2.6	154.35.175.225
May 20, 2024 09:23:31.851838112 CEST	443	49726	154.35.175.225	192.168.2.6
May 20, 2024 09:23:31.851917982 CEST	49726	443	192.168.2.6	154.35.175.225
May 20, 2024 09:23:31.856671095 CEST	9001	49725	178.17.170.13	192.168.2.6
May 20, 2024 09:23:31.856749058 CEST	49725	9001	192.168.2.6	178.17.170.13
May 20, 2024 09:23:31.856892109 CEST	49726	443	192.168.2.6	154.35.175.225
May 20, 2024 09:23:31.856928110 CEST	443	49726	154.35.175.225	192.168.2.6
May 20, 2024 09:23:31.857016087 CEST	49725	9001	192.168.2.6	178.17.170.13
May 20, 2024 09:23:31.908929110 CEST	9001	49725	178.17.170.13	192.168.2.6
May 20, 2024 09:23:33.625159025 CEST	9001	49725	178.17.170.13	192.168.2.6
May 20, 2024 09:23:33.625272989 CEST	49725	9001	192.168.2.6	178.17.170.13
May 20, 2024 09:23:33.625397921 CEST	49725	9001	192.168.2.6	178.17.170.13
May 20, 2024 09:23:33.686856985 CEST	9001	49725	178.17.170.13	192.168.2.6
May 20, 2024 09:23:48.788610935 CEST	443	49726	154.35.175.225	192.168.2.6
May 20, 2024 09:23:48.788737059 CEST	49726	443	192.168.2.6	154.35.175.225
May 20, 2024 09:23:48.788896084 CEST	49726	443	192.168.2.6	154.35.175.225
May 20, 2024 09:23:48.788913012 CEST	443	49726	154.35.175.225	192.168.2.6
May 20, 2024 09:23:48.806704044 CEST	49728	9001	192.168.2.6	185.82.217.49
May 20, 2024 09:23:48.806840897 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:48.819488049 CEST	9001	49728	185.82.217.49	192.168.2.6
May 20, 2024 09:23:48.819529057 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:48.819629908 CEST	49728	9001	192.168.2.6	185.82.217.49
May 20, 2024 09:23:48.819931984 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:48.819935083 CEST	49728	9001	192.168.2.6	185.82.217.49
May 20, 2024 09:23:48.820053101 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:48.833754063 CEST	9001	49728	185.82.217.49	192.168.2.6
May 20, 2024 09:23:48.833789110 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:49.526485920 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:49.530174971 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:49.535154104 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:49.589772940 CEST	9001	49728	185.82.217.49	192.168.2.6
May 20, 2024 09:23:49.593220949 CEST	49728	9001	192.168.2.6	185.82.217.49
May 20, 2024 09:23:49.603976011 CEST	9001	49728	185.82.217.49	192.168.2.6
May 20, 2024 09:23:49.764991999 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:49.765379906 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:49.784188986 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:49.936708927 CEST	9001	49728	185.82.217.49	192.168.2.6
May 20, 2024 09:23:49.963777065 CEST	49728	9001	192.168.2.6	185.82.217.49
May 20, 2024 09:23:49.980727911 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:49.985460997 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:49.985546112 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:49.990499020 CEST	9001	49728	185.82.217.49	192.168.2.6
May 20, 2024 09:23:49.993221998 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:49.998492956 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.204541922 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.204860926 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.209907055 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.417654037 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.418644905 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.418732882 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.419631004 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.419668913 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.419704914 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.419720888 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.421627045 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.421664953 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.421683073 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.423578978 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.423615932 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.423640013 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.425578117 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.425616026 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.425643921 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.427515030 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.427570105 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.428318024 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.428354025 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.428386927 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.428401947 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.468782902 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.503391027 CEST	9001	49728	185.82.217.49	192.168.2.6
May 20, 2024 09:23:50.508090019 CEST	9001	49728	185.82.217.49	192.168.2.6
May 20, 2024 09:23:50.508188963 CEST	49728	9001	192.168.2.6	185.82.217.49
May 20, 2024 09:23:50.518682003 CEST	49728	9001	192.168.2.6	185.82.217.49
May 20, 2024 09:23:50.526778936 CEST	9001	49728	185.82.217.49	192.168.2.6
May 20, 2024 09:23:50.526814938 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.527308941 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.527358055 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.528230906 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.529241085 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.529309988 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.530214071 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.531188965 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.531224966 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.531286955 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.532179117 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.532239914 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.532980919 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.533016920 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.533065081 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.534497976 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.534533978 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.534579992 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.534663916 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.536020994 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.536056042 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.536079884 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.536107063 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.537565947 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.537602901 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.537616968 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.537647009 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.539135933 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.539174080 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.539187908 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.539208889 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.539220095 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.539254904 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.540714979 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.540750980 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.540769100 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.540797949 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.542237043 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.542285919 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.591223955 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.591258049 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.591355085 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.636184931 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.636507988 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.636578083 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.637192011 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.637893915 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.637928009 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.637960911 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.638618946 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.638669968 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.639298916 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.640014887 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.640073061 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.640692949 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.640856981 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.641429901 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.641464949 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.641496897 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.641525030 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.642812967 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.642872095 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.643666983 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.643702030 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.643731117 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.643734932 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.643758059 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.643779039 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.644659996 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.644695044 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.644722939 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.644750118 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.645788908 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.645823956 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.645839930 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.645868063 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.646877050 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.646912098 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.646941900 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.646975040 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.648013115 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.648067951 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.648083925 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.648130894 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.648715973 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.648751020 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.648766994 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.648799896 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.649794102 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.649851084 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.650420904 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.650455952 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.650481939 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.650505066 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.651504993 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.651554108 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.651555061 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.652527094 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.652575970 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.653088093 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.653124094 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.653156996 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.653167009 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.653245926 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.654066086 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.654124022 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.654491901 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.654546022 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.659215927 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.703140020 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.710062027 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.752827883 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.752994061 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.753196955 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.753518105 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.754093885 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.754131079 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.754148006 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.755146027 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.755181074 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.755199909 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.756194115 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.756239891 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.756728888 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.756764889 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.756798029 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.756820917 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.757821083 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.757857084 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.757882118 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.758863926 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.758900881 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.758908033 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.759928942 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.759964943 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.759974003 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.760094881 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.760855913 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.760891914 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.760909081 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.760925055 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.760934114 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.760966063 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.761640072 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.761676073 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.761689901 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.761714935 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.762505054 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.762541056 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.762557983 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.762579918 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.763350010 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.763386011 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.763402939 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.763423920 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.764199972 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.764235020 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.764245987 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.764277935 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.765048981 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.765085936 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.765096903 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.765120983 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.765126944 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.765158892 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.765892982 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.765928030 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.765943050 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.765965939 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.766762018 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.766798019 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.766814947 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.766835928 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.767556906 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.767591953 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.767608881 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.767631054 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.768341064 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.768377066 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.768389940 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.768412113 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.768424988 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.768455029 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.769109011 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.769145966 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.769160986 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.769188881 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.769851923 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.769887924 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.769900084 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.769928932 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.770648003 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.770683050 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.770697117 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.770721912 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.771401882 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.771437883 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.771455050 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.771477938 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.772156954 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.772191048 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.772203922 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.772226095 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.772231102 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.772265911 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.772847891 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.772883892 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.772917032 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.772938013 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.773530960 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.773566008 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.773571014 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.773610115 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.773617029 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.781290054 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.790951014 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.843313932 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.858201981 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.858320951 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.858340979 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.858496904 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.858753920 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.858804941 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.859064102 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.859100103 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.859112024 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.859141111 CEST	49729	80	192.168.2.6	171.25.193.9
May 20, 2024 09:23:50.859636068 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.859669924 CEST	80	49729	171.25.193.9	192.168.2.6
May 20, 2024 09:23:50.859685898 CEST	49729	80	192.1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jXBjxhHQgR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Drivers\csrss.exe

C:\Users\user\AppData\Local\Temp\4KPV6A~1\cached-certs (copy)

C:\Users\user\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus (copy)

C:\Users\user\AppData\Local\Temp\4KPV6A~1\state (copy)

C:\Users\user\AppData\Local\Temp\4KPV6A~1\unverified-microdesc-consensus (copy)

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\cached-certs.tmp

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\cached-microdesc-consensus.tmp

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\state.tmp

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\unverified-microdesc-consensus.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
jXBjxhHQgR.exe