Edit tour

Windows Analysis Report
QHLQyYBiH7.exe

Overview

General Information

Sample name:	QHLQyYBiH7.exe renamed because original name is a hash value
Original sample name:	5602b0e001ca58f3afa38ed2bebee63a.exe
Analysis ID:	1569562
MD5:	5602b0e001ca58f3afa38ed2bebee63a
SHA1:	684042eb078191c1ae776491aed3ae302315224c
SHA256:	d03990be37a53cf1ecb8189def43022ed7f04886b043c9640a32ea48fea1f1d4
Tags:	AsyncRATexeRATuser-abuse_ch
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Sigma detected: Potentially Suspicious Malware Callback Communication

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

QHLQyYBiH7.exe (PID: 4888 cmdline: "C:\Users\user\Desktop\QHLQyYBiH7.exe" MD5: 5602B0E001CA58F3AFA38ED2BEBEE63A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "195.26.255.81", "Ports": "6606,7707,8808,0077,1996,2106,7777", "Version": "| Edit by Vinom Rat", "Autorun": "false", "Install_Folder": "%AppData%", "Install_File": "Serv.exe", "AES_key": "x9K8SFfbc9rHbplQxeIAk3eFsy6rV3l4", "Mutex": "AsyncMutex_6SI8OkPnk", "AntiDetection": "true", "External_config_on_Pastebin": "true", "BDOS": "null", "Startup_Delay": "3", "HWID": "cmZpGwUhD3Q3V1iMbLVXav8uvPpzAtw4bzJPFTlbkTd+ccVIO2rmuKpEdkmUujJ4OcftVFceQCAEuOGjfHxnQQ==", "Certificate": "MIIE8jCCAtqgAwIBAgIQAMBXvryHIFhGdkjw26gQjzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjExMDI2MTQ0MzIxWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJD2GxJUHyTA9QZO0N7p5cJ8PvZk4qsoa/2Iv3RqmEvIUkT1Rjz4LIcv/iaqADsBOqWCdJtu+GSnp+JieUKMG2315yw4pycAGPh+dJHJQ68IEuGLI6XdzXm0bG0yH76mvmTjsRh05kOVZUjAe9Vc8yqfBIndJBj5Gr6nSqDJ+V5mhivt26yLDC4GUcd9yNar1yOL4tJ2aRICakfQGhQIMOKUf2DmekYlqM3aneaLR5byZHKmiNuce3koRvx87xdlgLFjTcNCSv52q4t+Q5UN6sPqVrj3VJbwT1iW85zbwd/7DdTQ2JMtoNWXnwNiSS68QWW6XBc6UVcFwhE+Yg4TQD8Zyq1Nr5t3XXD1TpsOg+MWNDyJxI1A5b3mEbzHO3+dHoLcQ9RQ+bFg2nqtjcAU9bNfwtKiyygEYZxgU8BoOhxloS6KhF9NG7pw9lesMzq4sFK+0ko545drME1QIu1VorD0Zp8+HvTLUHvUjGUn1BkQiV5CzUufzMlnQEsH5ldEHFYkHzk8MfqERnJLyV21XLZCr1DmYkr5v3ZB4plVfrf9GQ6j2640gdu6LLAZhBRaDZqAjHOjAlLG4VqRLxUSvrVQm1rbV8uvQzsMi+lqvbW2r8Fkln3TxyyxFbDGdtbfKWZcIHXRVD9TFlx6d2sZmJKuyE+w8wlunZ2FnXt3xMYhAgMBAAGjMjAwMB0GA1UdDgQWBBTn2gTEZrwxp3sRYiCSJ1160JNqZDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBU/BrVpV8yhvG+75g8+n1D+KZLPnlyem/K4JQpGq5KESruvdCvUb2x/8KNlopa6R+R3c46cogLt++2dk8vxpwMuQuj+luCws38h8YFw5n0k2Al2RI+k1Tt9RQERZnphVrzJ22u4qYhxXzRJvJQSHw7FP8SeDAoCC7Aj1A8jysJ7B1URC6Ao7wPrFH9Q/fyYGp0dFWHRg3dOS9AoS8npJLYsF9sUxaCmgMeSNGWd3sAErMAsdtSr1EnVTn2axh7DNqlsyP8MyypGNUtv+mhTVBsXh5c2Wg9PMhapj3UqRUk61Ma+R/7PTZTQiggqY5r02dtrAypV/m7ghDZqieXJs6tiPh9d05qJfQtXFhbEJi//NGmojp4KBX9P2B4QwmhgegTRsDyiqZ6E9+NJnb890uFMgnqfsctyuXp0IL8gZcqh8aw08QSeWwNem5bWveMOXZX+O4Nkbw1Cd+9y1HnStIekc1hFuVtQwILcWckUkjbGrFmhT4fZ6kR5b/wvYhAaFsanIXXmDYBY12dVWlo3FGwZZx47wc8LKm7bAPhy2LmqJ12C99PLR/LI89UNw+q7YuIE5JqmfCRRAwD+UZ26JwuIo2EMv10kNrpuqyrSA+OT0rJgnfagTV6Q3zX6rGnDgwYd89qYrEauLMb4LyKlVdfE2b3iEgOujN/YPzd93Zq/Q==", "ServerSignature": "K8KuGCGi6GbaC+fhnxy0xzTLxVXLlaLrV7S1Ve5PG2X1/FVTeHsvjes53nn7E9dhFyg8SramiA5oj5eeFk0oJQRZWPr2/ZCVCk+VCUm03v7Zpk9hWPiVpjVFYgoWg+rU/V0+3voSPA1tBLiE8JM3QaimeMLRg/So3xPrlCqUBGN1ratFgZG9UELKijQzfOrgD2EMdzzkGXr6UyjopQ0oj4V8pSLgFr7iU2wYJxCOoEqmkQeEvwHT512ClQtFyeJvOAV1KtCreYR3sxv1V4cekfydaNkt24J7c8+7Z2BGf7VE5iU71KCKHHojItI3EEOroZ2C9ssPwXK2JoVq6EATjqANvOEbm1J/LkNAHmzfpEZqzzDHm46tcTqhRXrpRFLQRJ9W40UnQLeRiyx05trqK7q/vncbZcJMYvk/ntFxjg3B/welUF/nkz5+sGd3NDhufH0sP6dNRcQyc9yLh0fdpkOHhRm/TpYlAaE1WcIolJ6XWHmVb+bP23Q3FE2IYSUd1NGGFIItn6X2UZ55Cab+BYKR/JsFi0/7kC5hQZJyehv8NH9dX7J0MT55Det1FvlrAVub4VDyH6RAAbT8OrLM/RL0mdas7ujBMBnxlu1svxrppwh+Tz043gBiFtK7jBo26nAS2TH/iOjy6Hfn4U1FZtiOjXPwv2ujYrG0EQyxbYs=", "Group": "Default"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
QHLQyYBiH7.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
QHLQyYBiH7.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
QHLQyYBiH7.exe	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd18e:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x99b4:$a3: get_ActivatePong 0xd3a6:$a4: vmware 0xd21e:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa8f9:$a6: get_SslClient
QHLQyYBiH7.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd220:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xcf8e:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10238:$a2: Stub.exe 0x102c8:$a2: Stub.exe 0x97b4:$a3: get_ActivatePong 0xd1a6:$a4: vmware 0xd01e:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa6f9:$a6: get_SslClient
00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd020:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.4534132615.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: QHLQyYBiH7.exe PID: 4888	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: QHLQyYBiH7.exe PID: 4888	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x288d3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.QHLQyYBiH7.exe.6a0000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.QHLQyYBiH7.exe.6a0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.QHLQyYBiH7.exe.6a0000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd18e:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x99b4:$a3: get_ActivatePong 0xd3a6:$a4: vmware 0xd21e:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa8f9:$a6: get_SslClient
0.0.QHLQyYBiH7.exe.6a0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd220:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 195.26.255.81, DestinationIsIpv6: false, DestinationPort: 7777, EventID: 3, Image: C:\Users\user\Desktop\QHLQyYBiH7.exe, Initiated: true, ProcessId: 4888, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49708

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T21:01:59.087278+0100	2035595	1	Domain Observed Used for C2 Detected	195.26.255.81	7777	192.168.2.6	49708	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T21:01:59.087278+0100	2035607	1	Domain Observed Used for C2 Detected	195.26.255.81	7777	192.168.2.6	49708	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T21:01:59.087278+0100	2842478	1	Malware Command and Control Activity Detected	195.26.255.81	7777	192.168.2.6	49708	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: QHLQyYBiH7.exe

Avira: detected

Found malware configuration

Source: QHLQyYBiH7.exe

Malware Configuration Extractor: AsyncRAT {"Server": "195.26.255.81", "Ports": "6606,7707,8808,0077,1996,2106,7777", "Version": "| Edit by Vinom Rat", "Autorun": "false", "Install_Folder": "%AppData%", "Install_File": "Serv.exe", "AES_key": "x9K8SFfbc9rHbplQxeIAk3eFsy6rV3l4", "Mutex": "AsyncMutex_6SI8OkPnk", "AntiDetection": "true", "External_config_on_Pastebin": "true", "BDOS": "null", "Startup_Delay": "3", "HWID": "cmZpGwUhD3Q3V1iMbLVXav8uvPpzAtw4bzJPFTlbkTd+ccVIO2rmuKpEdkmUujJ4OcftVFceQCAEuOGjfHxnQQ==", "Certificate": "MIIE8jCCAtqgAwIBAgIQAMBXvryHIFhGdkjw26gQjzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjExMDI2MTQ0MzIxWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJD2GxJUHyTA9QZO0N7p5cJ8PvZk4qsoa/2Iv3RqmEvIUkT1Rjz4LIcv/iaqADsBOqWCdJtu+GSnp+JieUKMG2315yw4pycAGPh+dJHJQ68IEuGLI6XdzXm0bG0yH76mvmTjsRh05kOVZUjAe9Vc8yqfBIndJBj5Gr6nSqDJ+V5mhivt26yLDC4GUcd9yNar1yOL4tJ2aRICakfQGhQIMOKUf2DmekYlqM3aneaLR5byZHKmiNuce3koRvx87xdlgLFjTcNCSv52q4t+Q5UN6sPqVrj3VJbwT1iW85zbwd/7DdTQ2JMtoNWXnwNiSS68QWW6XBc6UVcFwhE+Yg4TQD8Zyq1Nr5t3XXD1TpsOg+MWNDyJxI1A5b3mEbzHO3+dHoLcQ9RQ+bFg2nqtjcAU9bNfwtKiyygEYZxgU8BoOhxloS6KhF9NG7pw9lesMzq4sFK+0ko545drME1QIu1VorD0Zp8+HvTLUHvUjGUn1BkQiV5CzUufzMlnQEsH5ldEHFYkHzk8MfqERnJLyV21XLZCr1DmYkr5v3ZB4plVfrf9GQ6j2640gdu6LLAZhBRaDZqAjHOjAlLG4VqRLxUSvrVQm1rbV8uvQzsMi+lqvbW2r8Fkln3TxyyxFbDGdtbfKWZcIHXRVD9TFlx6d2sZmJKuyE+w8wlunZ2FnXt3xMYhAgMBAAGjMjAwMB0GA1UdDgQWBBTn2gTEZrwxp3sRYiCSJ1160JNqZDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBU/BrVpV8yhvG+75g8+n1D+KZLPnlyem/K4JQpGq5KESruvdCvUb2x/8KNlopa6R+R3c46cogLt++2dk8vxpwMuQuj+luCws38h8YFw5n0k2Al2RI+k1Tt9RQERZnphVrzJ22u4qYhxXzRJvJQSHw7FP8SeDAoCC7Aj1A8jysJ7B1URC6Ao7wPrFH9Q/fyYGp0dFWHRg3dOS9AoS8npJLYsF9sUxaCmgMeSNGWd3sAErMAsdtSr1EnVTn2axh7DNqlsyP8MyypGNUtv+mhTVBsXh5c2Wg9PMhapj3UqRUk61Ma+R/7PTZTQiggqY5r02dtrAypV/m7ghDZqieXJs6tiPh9d05qJfQtXFhbEJi//NGmojp4KBX9P2B4QwmhgegTRsDyiqZ6E9+NJnb890uFMgnqfsctyuXp0IL8gZcqh8aw08QSeWwNem5bWveMOXZX+O4Nkbw1Cd+9y1HnStIekc1hFuVtQwILcWckUkjbGrFmhT4fZ6kR5b/wvYhAaFsanIXXmDYBY12dVWlo3FGwZZx47wc8LKm7bAPhy2LmqJ12C99PLR/LI89UNw+q7YuIE5JqmfCRRAwD+UZ26JwuIo2EMv10kNrpuqyrSA+OT0rJgnfagTV6Q3zX6rGnDgwYd89qYrEauLMb4LyKlVdfE2b3iEgOujN/YPzd93Zq/Q==", "ServerSignature": "K8KuGCGi6GbaC+fhnxy0xzTLxVXLlaLrV7S1Ve5PG2X1/FVTeHsvjes53nn7E9dhFyg8SramiA5oj5eeFk0oJQRZWPr2/ZCVCk+VCUm03v7Zpk9hWPiVpjVFYgoWg+rU/V0+3voSPA1tBLiE8JM3QaimeMLRg/So3xPrlCqUBGN1ratFgZG9UELKijQzfOrgD2EMdzzkGXr6UyjopQ0oj4V8pSLgFr7iU2wYJxCOoEqmkQeEvwHT512ClQtFyeJvOAV1KtCreYR3sxv1V4cekfydaNkt24J7c8+7Z2BGf7VE5iU71KCKHHojItI3EEOroZ2C9ssPwXK2JoVq6EATjqANvOEbm1J/LkNAHmzfpEZqzzDHm46tcTqhRXrpRFLQRJ9W40UnQLeRiyx05trqK7q/vncbZcJMYvk/ntFxjg3B/welUF/nkz5+sGd3NDhufH0sP6dNRcQyc9yLh0fdpkOHhRm/TpYlAaE1WcIolJ6XWHmVb+bP23Q3FE2IYSUd1NGGFIItn6X2UZ55Cab+BYKR/JsFi0/7kC5hQZJyehv8NH9dX7J0MT55Det1FvlrAVub4VDyH6RAAbT8OrLM/RL0mdas7ujBMBnxlu1svxrppwh+Tz043gBiFtK7jBo26nAS2TH/iOjy6Hfn4U1FZtiOjXPwv2ujYrG0EQyxbYs=", "Group": "Default"}

Multi AV Scanner detection for submitted file

Source: QHLQyYBiH7.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: QHLQyYBiH7.exe

Joe Sandbox ML: detected

Source: QHLQyYBiH7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: QHLQyYBiH7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 195.26.255.81:7777 -> 192.168.2.6:49708
Source: Network traffic	Suricata IDS: 2030673 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 195.26.255.81:7777 -> 192.168.2.6:49708
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 195.26.255.81:7777 -> 192.168.2.6:49708
Source: Network traffic	Suricata IDS: 2035607 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 195.26.255.81:7777 -> 192.168.2.6:49708

Yara detected Generic Downloader

Source: Yara match	File source: QHLQyYBiH7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QHLQyYBiH7.exe.6a0000.0.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:49708 -> 195.26.255.81:7777

Source: Joe Sandbox View

ASN Name: KCOM-SPNService-ProviderNetworkex-MistralGB KCOM-SPNService-ProviderNetworkex-MistralGB

Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.255.81

Source: QHLQyYBiH7.exe, 00000000.00000002.4535149787.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: QHLQyYBiH7.exe, 00000000.00000002.4535315737.0000000005027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab82
Source: QHLQyYBiH7.exe, 00000000.00000002.4535149787.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?08d1d078f9e52
Source: QHLQyYBiH7.exe, 00000000.00000002.4535149787.0000000004F6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enS
Source: QHLQyYBiH7.exe, 00000000.00000002.4534132615.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: QHLQyYBiH7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QHLQyYBiH7.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4534132615.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QHLQyYBiH7.exe PID: 4888, type: MEMORYSTR

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: QHLQyYBiH7.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: QHLQyYBiH7.exe, type: SAMPLE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.0.QHLQyYBiH7.exe.6a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.0.QHLQyYBiH7.exe.6a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: QHLQyYBiH7.exe PID: 4888, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Code function: 0_2_00D460C1	0_2_00D460C1
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Code function: 0_2_00D44158	0_2_00D44158
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Code function: 0_2_00D44A28	0_2_00D44A28
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Code function: 0_2_00D43E10	0_2_00D43E10
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Code function: 0_2_07061B10	0_2_07061B10

Source: QHLQyYBiH7.exe, 00000000.00000002.4535670373.0000000005829000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs QHLQyYBiH7.exe
Source: QHLQyYBiH7.exe, 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs QHLQyYBiH7.exe
Source: QHLQyYBiH7.exe	Binary or memory string: OriginalFilenameStub.exe" vs QHLQyYBiH7.exe

Source: QHLQyYBiH7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: QHLQyYBiH7.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: QHLQyYBiH7.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.0.QHLQyYBiH7.exe.6a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.0.QHLQyYBiH7.exe.6a0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: QHLQyYBiH7.exe PID: 4888, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: QHLQyYBiH7.exe, OAIZfrObiiX.cs

Base64 encoded string: 'vYQPlde0UPe6gVdYAmHYgqZQ3du3H7um5bckqwj8RJFN9OGxgcpxX2fK2o9DWWsRCrvvWx41oEMSDjESYda8a7+kgeLWGiXni+kJGKbV//v5i0Hq8A9gIC6YSQwL0X8/', 'I5vk7WSD2/T6jn2zXIbpBlRPIQRGI+casWYMaAJAye6+gNZRGUd2Vn40HtOWl8/wU/Q7VdOHYdlt6ZmIvLWTrA==', 'yETXdKWfYdHgpP5DdST8Fusc3iWC/weRvIITufKOWnDJMRZzavu3a1ndUAjwTDD3MD4orU/nzO5BA9q3KAEz+t0zKfGZgf0M0y1Loh6Xxkw=', 'nDNqhUBloQ9Du/kzGgLJKch+1s5pn8hRmsrXSJ4TNJDsBJ4gYBduiGDCrtPgZk+Px7U3YfVtzOET5u/zuYh/f0mSISYmWyqXC+IluYc+dzEFts4EcT+CsjqXIr/igucUZ/pXJPZjvIAwnuI35xbgs0Ty+p3mmW9JtMNB4nSJ0BEdOV5HPkbvQS+S3TzzTN0YSQlfBa6UPmDs0yGoYi5aEuofpOJdeZ9H5BoUSkEc479Ln0rYssnJYJQjMFoN55G6MTt8DyCEd5DXRwO7jx8ef/ZDxxYJDRBw3DoYtS2y9Md0ZAWD7SFNvwlIjjvV4vRQDuyz/fGG3aJ0z0rX7EZfugJY1XcRT3Zk6ggwr9t/IQgV7ak15J+8dR9u6JsJMkRlECdy0TxcUu8ZWNlQreWjQBiNoUKL8zuxbnP7q/hqJbqwLW4wbFhrM8FSw+iVvdzIf8GdY8rmNtGg/59eL+qDBr+1sb5BXPuwUa52rWrNOcEZaHu0FkTgo6oDDMQ4qtp5SFeS9xUoOYDwLkPkqaBaAG+Qu6+7pNvlQ5DUHM2fJPKRKZC1O1ZdErHD+6uzIY2uvjcA3Ae/UnHgCqzpFKs4l/zCiYSXtqzL5h3hLrGmcX7s7NjIcJolzD+EOIPt2Ly+LntJa0IAifP/WDxCw1CqmqEDQW7TaxBT6yFyEZtpP2tFSkRLdEqgv2+9AZI6tJfjW7X2ix/0Ws2dkAzDVd0LSq9PABy1pIRsr6AXOvCj/6MAdyh0V8/5L10B5Qr/dYssbY6sA5Lwx5uCjJT2ukz6x/N2zv8eGyNU2bGejMvjrcFdHIdRjPvApHvWQt5QOJS6ZcSbmyPenmjWvTg84wn+e2PqaCD9lNbYzhWoxZX5Ix8/DCx2x3H/VuA4cw6Xgd5amvVecozTAfBmWcnnxro6oV3HMJ59S04a814YU3p2dvCWf9SqDvnG+ndmb1jL3XfE/HnGuBL9mAEhONtezQZcO/QLTqEu3kJCdtfjr+ajL+rGjG081A54bR0vspFrURJRDmJ1hMX4E/zWm2I6ZJgMSRlYcF7pHMwps5ZLvYA+l9eQHTjOuruE1CqGuL6nqyVMpWWt2q5Iz5qkfdTAxJ4EknmVWRUUcUPM91LxekonotOX1ho0KbpSS9K/jAUeNR/NwKd4SxNBxEC3GfeUOS81B0pDKwBakKl+z8tfeurwCyx3e6yC8OMZDQ7mDuwUZSfb6rC2t7yPdJS6o+eFL3pa48uKfZLNaT8Nj71QBgfIPvwpbeQREEM623L3YZJSmQDP/HLGjPkHFBuAbWKecGMFl0G9j3lkw76QROAoCMkrtUBKHnH2huvGsQHZjgWmgmwoh357jvAFnq0T1NYBA9fHkMgc4Ufq2oRp6re1IW0tW3ILX1HjhsfUS7udhE2GHfql5i+xQ+Es0khDUW0uwI6vyWQGEoZ92P/3uZWgOGhJLEhvsah0fVPmRrazEGscjAOaJ3vrmJ/sGlS3sRXngiH6KS3kzuB32tLaYXDCJ5O9Dg0XKAoebJ/ZG3oPKMETycF1ctElyZ2SxRQFdnBb/QGKqbiyen2V8A/iafpM4gyCe1JqX96Odn4QndG/FOvggCboqP7AUusCWqocNlumZO2XrmJeUuHfUTJwYSNaO9rBzMMfU0625CCNdBbm0mqntz55puyTwTJDMU1U8MRSMEeFcWa+PvFRjP0x2VRHznwrbomYFxFwRFbMgKCK5cDac9DozwfgRrSvPlKIKmrnFkdlgsp4XeQbZcu5LR7g9LOGLuCssd5lZ5tpQMTrjZLk7HgkshRnDY00jy9dE0O7lM7k+MIHFMbiNLx9kmtCkjKYMizF39IYI6a3bL2vnJdoWTMll0lnRZbVAmD9RtrgefC+udeXmNRjKm3/9l6OD6EwBnDxvR40pyQ0kMDRerk8cGYIKbPkZWZtqzTI/zHEQRcreb3Jg0+KdBc+hiyiH4tv/Srer0rC35yQ5ypi5JGRPqP2WuDb352TA2zn8scrKaSQMx8kGTJ7xpSCUoyPkXp+DU9EWIjmX+Jv2Wougls7F9z1eEoGLv1UKSpvoSaq3/k3XRdiKwwL+GZbgLNSrWroIukJ7wyXXuNK33+m7tb1YQOooGa/dV5mO68s8yydH6rUbuDK8uQ6cPlQB6UgxpxmWm3d4paO6HxkuQM9Zh+WtxdUMF5DGhx48LC5e+oCUuKcIFCsn8ilXHFdzAwLbQ5yjIbQd5GNfW3AwHHlNsIfxqhgAkMdTp9G2ene33efTKjfXTazCZLNzTtuNnt4fbN2djvDGm3icl4qUOCW9HODSxiuTND7Xm0N2oaYxHDhCFZjwQM2LG1YxbhBQ6xxjLyNz6k=', 'Ju42sd9yC0R++ie+7FwszOkHoZkI+hN+pJ0q5XEmFiwIkLi2T2jcgADOjkurtA/iFzJLPfKi+u0CCwKyC3avsw==', 'u26jCfq32NV6dU2iUe8gSJfFb9rfUzdACMJ5LY+LF22TuwIFdGuvtWorK2e/HJuUQO1mf0Gdx2SxiZ0lsQ2DQQ==', 'K4xLBzOdGXJl+1q7pyXLvk7pELs0GE1M1tiysqJXgOlPBU18gt7evVBqfLjJvVNQpDib+DbzgpYO9SMA0bsEoQ==', 'sMQWVujgYLt0YLhonO0oA5ULz71cv3X0S+T

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/2@0/1

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk

Source: QHLQyYBiH7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QHLQyYBiH7.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QHLQyYBiH7.exe

ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Section loaded: cabinet.dll	Jump to behavior

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: QHLQyYBiH7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QHLQyYBiH7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: QHLQyYBiH7.exe, UeqpxmZCsQcdFXS.cs

.Net Code: FpVTGbXzsH System.AppDomain.Load(byte[])

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Code function: 0_2_00D406AF push esp; retf 0000h	0_2_00D406BA
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Code function: 0_2_00D40637 push edi; retf 0000h	0_2_00D40652
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Code function: 0_2_00D40637 push ecx; retf 0000h	0_2_00D406AA
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Code function: 0_2_00D45D97 push esp; retf 0000h	0_2_00D45DA2
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Code function: 0_2_00D45D8D push esp; retf 0000h	0_2_00D45D92
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Code function: 0_2_0706193A push esp; retf	0_2_07061941

Source: QHLQyYBiH7.exe, UOLIAdNfJK.cs

High entropy of concatenated method names: 'lCtCxTPYSkA', 'IymLzaGndBxD', 'cMCDadTrwXJ', 'sDNyZFHvbusPWP', 'iHzQSJygPmLLYF', 'yriamNYzTTy', 'uQGzYlMExjqaKGg', 'BvZrweJdnSdJDHr', 'tbtPMmrwnjUzo', 'IdrUJzqwbWKLWnQ'

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: QHLQyYBiH7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QHLQyYBiH7.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4534132615.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QHLQyYBiH7.exe PID: 4888, type: MEMORYSTR

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: QHLQyYBiH7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QHLQyYBiH7.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4534132615.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QHLQyYBiH7.exe PID: 4888, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: QHLQyYBiH7.exe

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Memory allocated: D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Memory allocated: 2A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Memory allocated: F60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Window / User API: threadDelayed 1278			Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Window / User API: threadDelayed 8504			Jump to behavior

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe TID: 4900	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe TID: 5692	Thread sleep time: -5534023222112862s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: QHLQyYBiH7.exe	Binary or memory string: vmware
Source: QHLQyYBiH7.exe, 00000000.00000002.4535149787.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0u;
Source: QHLQyYBiH7.exe, 00000000.00000002.4536184026.00000000063B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

Code function: 0_2_00D41CE8 CheckRemoteDebuggerPresent,

0_2_00D41CE8

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Queries volume information: C:\Users\user\Desktop\QHLQyYBiH7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QHLQyYBiH7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: QHLQyYBiH7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QHLQyYBiH7.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4534132615.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QHLQyYBiH7.exe PID: 4888, type: MEMORYSTR

Source: QHLQyYBiH7.exe, 00000000.00000002.4535149787.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp, QHLQyYBiH7.exe, 00000000.00000002.4533747302.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\QHLQyYBiH7.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Disable or Modify Tools	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	51 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
QHLQyYBiH7.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRat
QHLQyYBiH7.exe	100%	Avira	TR/Dropper.Gen
QHLQyYBiH7.exe	100%	Joe Sandbox ML

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	QHLQyYBiH7.exe, 00000000.00000002.4534132615.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.26.255.81	unknown	United Kingdom		8897	KCOM-SPNService-ProviderNetworkex-MistralGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569562
Start date and time:	2024-12-05 21:01:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QHLQyYBiH7.exe renamed because original name is a hash value
Original Sample Name:	5602b0e001ca58f3afa38ed2bebee63a.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/2@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 21 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 2.22.50.131, 2.22.50.144
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: QHLQyYBiH7.exe

Simulations

Behavior and APIs

Time	Type	Description
15:02:00	API Interceptor	9413355x Sleep call for process: QHLQyYBiH7.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
KCOM-SPNService-ProviderNetworkex-MistralGB	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.56.42.100
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	212.32.119.233
	sora.arm.elf	Get hash	malicious	Mirai	Browse	159.15.212.211
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	159.15.236.49
	nabspc.elf	Get hash	malicious	Unknown	Browse	217.154.244.153
	m68k.elf	Get hash	malicious	Unknown	Browse	194.62.44.61
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	213.254.176.44
	owari.arm7.elf	Get hash	malicious	Mirai	Browse	158.179.210.2
	xd.x86.elf	Get hash	malicious	Mirai	Browse	159.15.172.114
	specifications and technical requirements.pdf	Get hash	malicious	HTMLPhisher	Browse	194.164.76.123

Process:	C:\Users\user\Desktop\QHLQyYBiH7.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\QHLQyYBiH7.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.144086598890895
Encrypted:	false
SSDEEP:	6:kKukNlD9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:2ElaDnLNkPlE99SNxAhUe/3
MD5:	47F2F0DCBCAFBD5A3CFF588D41753F1D
SHA1:	74E9580C9FB8471DAE3344E034EE879B3E4AF63C
SHA-256:	8E67625B44CF0D3EA54F36752CF24CF0F8F73CE2F617AD16D78A3D560A7CEFC4
SHA-512:	783330FD085EB020C12053DBE009C256AEEF318D79CF20D2DDDDB4BEF7A932AF3F1ACDFB02EFCBA1B439B407B73BD6E8758A42C8DEDD0C7E2BAB2D9F60F8F4DB
Malicious:	false
Reputation:	low
Preview:	p...... ...........PG..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.515091461303841
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	QHLQyYBiH7.exe
File size:	67'584 bytes
MD5:	5602b0e001ca58f3afa38ed2bebee63a
SHA1:	684042eb078191c1ae776491aed3ae302315224c
SHA256:	d03990be37a53cf1ecb8189def43022ed7f04886b043c9640a32ea48fea1f1d4
SHA512:	f0a0198b9dc44f106b4e4b0ff5100a4dfe389ffddf5def718efdd639a4bd4573fe82d8d41549210c02cebd6587c25746405d1bd68ca88857bbd4a9012772e655
SSDEEP:	1536:XKh5Bk58k/GWZOKuvUYFs2un/HuTZbFHgJkMAcZWO7KHS1Uzr+TGlx:XK/Bk58kAKuvUYFQvkbFHgKM7ZWJS6zx
TLSH:	D063F7053BE99019F3BECF7469F2668446FAF5AF2D12D90D1C8510DE0632B829941BFB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d................................. ... ....@.. .......................`............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x411abe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64A6F687 [Thu Jul 6 17:14:47 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11a68	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x7ff	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xfac4	0xfc00	fc00794a973d4144c15987988eb91275	False	0.4963107638888889	data	5.554372380284745	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x7ff	0x800	33cdbc5c50f34a35b4f0e61582ac7f11	False	0.41650390625	data	4.884866150337139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xc	0x200	afd0ad1ae585a6077b299a3e7f3a1dd1	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x120a0	0x2cc	data			0.43575418994413406
RT_MANIFEST	0x1236c	0x493	exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.43381725021349277

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-05T21:01:59.087278+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	195.26.255.81	7777	192.168.2.6	49708	TCP
2024-12-05T21:01:59.087278+0100	2030673	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	195.26.255.81	7777	192.168.2.6	49708	TCP
2024-12-05T21:01:59.087278+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	195.26.255.81	7777	192.168.2.6	49708	TCP
2024-12-05T21:01:59.087278+0100	2035607	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	195.26.255.81	7777	192.168.2.6	49708	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 21:01:57.680845976 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:01:57.800904036 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:01:57.801039934 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:01:57.814014912 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:01:57.933729887 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:01:58.962038040 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:01:58.962208033 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:01:58.962260008 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:01:58.967458010 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:01:59.087277889 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:01:59.308942080 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:01:59.348579884 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:01.577548027 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:01.699846029 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:01.699922085 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:01.819631100 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:07.178138971 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:07.298580885 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:07.298654079 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:07.418639898 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:08.605051041 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:08.645488024 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:08.796912909 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:08.807884932 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:08.927568913 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:08.927676916 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:09.047514915 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:12.788834095 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:12.908518076 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:12.908572912 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:13.028297901 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:14.716715097 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:14.770601988 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:15.877456903 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:15.879437923 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:15.999578953 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:15.999650002 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:16.120050907 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:18.396177053 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:18.515873909 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:18.516064882 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:18.636193037 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:19.369589090 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:19.412798882 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:19.572165966 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:19.574287891 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:19.694780111 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:19.694868088 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:19.814595938 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:24.005378962 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:24.125109911 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:24.125161886 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:24.250222921 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:25.081026077 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:25.129909992 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:25.272866964 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:25.274811029 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:25.394610882 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:25.394678116 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:25.514478922 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:29.615021944 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:29.735651016 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:29.735744953 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:29.855499983 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:30.532176971 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:30.583038092 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:30.723807096 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:30.725784063 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:30.845669985 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:30.845923901 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:30.969383001 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:35.224368095 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:35.344352961 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:35.344427109 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:35.465928078 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:36.136672974 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:36.176837921 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:36.328315020 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:36.330291033 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:36.450205088 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:36.450339079 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:36.572931051 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:40.833515882 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:40.953253984 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:40.956887007 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:41.076669931 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:41.790385008 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:41.833086014 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:41.982189894 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:41.983834028 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:42.103857994 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:42.103935003 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:42.223843098 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:46.443101883 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:46.562958002 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:46.563318014 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:46.683454037 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:47.069699049 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:47.114370108 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:47.249376059 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:47.251285076 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:47.371057987 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:47.371153116 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:47.490890026 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:52.052277088 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:52.172117949 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:52.172183990 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:52.291961908 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:53.619349003 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:53.661309004 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:53.811256886 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:53.817150116 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:53.937069893 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:53.937139988 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:54.056951046 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:57.661684036 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:57.781457901 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:57.781548977 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:57.901443958 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:59.002417088 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:59.051930904 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:59.194336891 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:59.196048975 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:59.315840960 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:02:59.315907955 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:02:59.436685085 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:03.298259020 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:03.418315887 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:03.418363094 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:03.538306952 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:04.237421989 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:04.286269903 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:04.429270029 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:04.431632996 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:04.551498890 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:04.551574945 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:04.671472073 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:08.911794901 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:09.031514883 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:09.031565905 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:09.155147076 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:09.585930109 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:09.630054951 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:09.777806044 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:09.779711962 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:09.899552107 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:09.899626970 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:10.019733906 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:14.521166086 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:14.640937090 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:14.641021013 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:14.760839939 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:15.499118090 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:15.548001051 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:15.690993071 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:15.692754984 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:15.812583923 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:15.812690020 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:15.932929993 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:20.132975101 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:20.252974033 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:20.256345034 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:20.376244068 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:21.147795916 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:21.192593098 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:21.344963074 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:21.347162008 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:21.470721006 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:21.470985889 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:21.594943047 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:23.833604097 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:23.953532934 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:23.953644991 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:24.073441982 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:24.318140984 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:24.439204931 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:24.439330101 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:24.499619007 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:24.552989960 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:24.559181929 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:24.635128975 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:24.639708042 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:24.759506941 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:24.759586096 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:24.861649036 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:24.879400015 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:24.911465883 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:24.951530933 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:24.954536915 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:25.074523926 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:25.074579000 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:25.194405079 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:29.927526951 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:30.047609091 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:30.053006887 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:30.172749996 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:30.615238905 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:30.661393881 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:30.807821035 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:30.810158968 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:30.934322119 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:30.934415102 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:31.056898117 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:35.536863089 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:35.657327890 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:35.657383919 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:35.777452946 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:35.786703110 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:35.906788111 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:35.906961918 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:36.026802063 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:36.407089949 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:36.458271980 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:36.599129915 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:36.606559038 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:36.726531029 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:36.726720095 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:36.846497059 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:38.040406942 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:38.085024118 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:38.829360962 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:38.881020069 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:41.396508932 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:41.516588926 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:41.516638994 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:41.636481047 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:41.636538982 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:41.756303072 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:42.341017962 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:42.395761013 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:42.534584045 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:42.536763906 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:42.656692028 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:42.657438040 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:42.777245045 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:47.196049929 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:47.315870047 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:47.316116095 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:47.435916901 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:47.887873888 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:47.942641020 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:48.081329107 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:48.085748911 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:48.205600023 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:48.205794096 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:48.325808048 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:50.052447081 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:50.172327042 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:50.177150965 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:50.297161102 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:50.751019001 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:50.802021980 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:50.943088055 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:50.946319103 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:51.066009998 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:51.066055059 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:51.185966969 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:51.443212032 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:51.562963963 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:51.563035965 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:51.683435917 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:52.001202106 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:52.053081036 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:52.193308115 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:52.195600033 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:52.315473080 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:52.315566063 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:52.435697079 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:57.055016994 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:57.174813032 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:57.174860954 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:57.294760942 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:57.554167986 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:57.598932028 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:57.745743036 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:57.747476101 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:57.867352009 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:03:57.867439032 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:03:57.987221956 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:02.661860943 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:02.781994104 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:02.782063007 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:02.901803017 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:03.378787994 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:03.427103996 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:03.570664883 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:03.572402954 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:03.692394972 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:03.692547083 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:03.812443018 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:05.178010941 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:05.297916889 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:05.297966003 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:05.418023109 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:05.769640923 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:05.813364029 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:05.961654902 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:05.967407942 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:06.087234974 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:06.093121052 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:06.212913036 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:10.787087917 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:10.907169104 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:10.907258987 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:11.027162075 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:11.753684998 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:11.802139997 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:11.945532084 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:11.947302103 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:12.067231894 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:12.069224119 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:12.189101934 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:16.396473885 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:16.516479015 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:16.516634941 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:16.636677980 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:17.985280991 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:18.036528111 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:18.177187920 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:18.186757088 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:18.307004929 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:18.309217930 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:18.429060936 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:22.005790949 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:22.126112938 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:22.126199007 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:22.247488022 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:22.915297031 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:22.958692074 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:23.107184887 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:23.109344959 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:23.229224920 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:23.229283094 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:23.349163055 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:23.537329912 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:23.657286882 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:23.657341003 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:23.777348995 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:24.334908009 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:24.380254030 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:24.527004004 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:24.529156923 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:24.649117947 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:24.649193048 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:24.769215107 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:29.146264076 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:29.266190052 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:29.266264915 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:29.386888981 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:30.050858021 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:30.099040031 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:30.242724895 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:30.244503975 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:30.364320993 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:30.364387989 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:30.486624002 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:34.757190943 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:34.877211094 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:34.877367973 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:34.998857975 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:35.624648094 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:35.677191019 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:35.816133976 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:35.819716930 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:35.939704895 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:35.939764023 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:36.059644938 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:40.364988089 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:40.485065937 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:40.485260963 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:40.606105089 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:41.824579954 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:41.880304098 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:42.016805887 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:42.018359900 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:42.138437033 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:42.145229101 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:42.271989107 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:45.974509001 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:46.094750881 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:46.094866991 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:46.215106010 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:46.659441948 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:46.709220886 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:46.851438999 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:46.854641914 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:46.974596977 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:46.974677086 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:47.043087959 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:47.083513021 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:47.094733953 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:51.583806038 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:51.704366922 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:51.704536915 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:51.824636936 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:52.640672922 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:52.693237066 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:52.832746983 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:52.835478067 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:52.955507994 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:52.957353115 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:53.077245951 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:53.302963972 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:53.422844887 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:53.422898054 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:53.542850971 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:53.971940994 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:54.020932913 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:54.181607962 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:54.190567970 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:54.310483932 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:54.313335896 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:54.433113098 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:58.912051916 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:59.032536030 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:04:59.032639980 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:04:59.153004885 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:00.065677881 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:00.114708900 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:00.884149075 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:00.890659094 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:01.010693073 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:01.013365030 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:01.133482933 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:04.521439075 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:04.641278982 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:04.641457081 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:04.761327028 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:05.306876898 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:05.349091053 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:05.506428003 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:05.508028030 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:05.628181934 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:05.628238916 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:05.748049021 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:10.130863905 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:10.250783920 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:10.250977993 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:10.370738983 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:10.667145967 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:10.708494902 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:10.858988047 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:10.862654924 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:10.982783079 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:10.982878923 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:11.102968931 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:15.740200043 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:15.860213995 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:15.860276937 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:15.980304003 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:16.706239939 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:16.756071091 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:16.898113012 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:16.900094986 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:17.020322084 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:17.020395994 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:17.140657902 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:21.349519968 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:21.469535112 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:21.469610929 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:21.589410067 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:22.277028084 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:22.333534002 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:22.468812943 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:22.475016117 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:22.596971035 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:22.597369909 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:22.717144966 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:26.985328913 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:27.105379105 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:27.105506897 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:27.229567051 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:27.720133066 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:27.771162033 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:27.922334909 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:27.923926115 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:28.043699980 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:28.043756962 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:28.163474083 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:32.584497929 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:32.704253912 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:32.705459118 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:32.825311899 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:33.157694101 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:33.302474976 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:33.349669933 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:33.351733923 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:33.471550941 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:33.471596956 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:33.591367960 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:36.005814075 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:36.126085997 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:36.126161098 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:36.246184111 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:36.783243895 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:36.883357048 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:36.975374937 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:36.982160091 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:37.102313042 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:37.103387117 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:37.225030899 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:41.613957882 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:41.733747959 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:41.733798027 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:41.853645086 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:42.193025112 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:42.380440950 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:42.385277033 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:42.386739969 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:42.506966114 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:42.507177114 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:42.626926899 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:45.263612986 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:45.383876085 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:45.383932114 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:45.503859997 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:46.079152107 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:46.119771004 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:46.278232098 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:46.280875921 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:46.401992083 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:46.402095079 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:46.521828890 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:47.850012064 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:47.971730947 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:47.971786976 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:48.092489004 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:48.502266884 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:48.555380106 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:48.693975925 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:48.695702076 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:48.815603018 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:48.816759109 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:48.937413931 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:53.460495949 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:53.581470013 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:53.581517935 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:53.701354027 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:54.226083040 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:54.271106005 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:54.417927027 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:54.430656910 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:54.550674915 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:54.553575039 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:54.673834085 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:55.146445990 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:55.266308069 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:55.266355991 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:55.386176109 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:56.096194029 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:56.146094084 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:56.284825087 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:56.289402008 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:56.410073042 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:56.413583040 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:56.533381939 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:58.102792978 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:58.222587109 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:58.222637892 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:58.342919111 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:58.717483044 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:58.771112919 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:58.909282923 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:58.909899950 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:59.029650927 CET	7777	49708	195.26.255.81	192.168.2.6
Dec 5, 2024 21:05:59.029709101 CET	49708	7777	192.168.2.6	195.26.255.81
Dec 5, 2024 21:05:59.149904966 CET	7777	49708	195.26.255.81	192.168.2.6

Target ID:	0
Start time:	15:01:52
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\QHLQyYBiH7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QHLQyYBiH7.exe"
Imagebase:	0x6a0000
File size:	67'584 bytes
MD5 hash:	5602B0E001CA58F3AFA38ED2BEBEE63A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000000.2083755341.00000000006A2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.4534132615.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.1%
Total number of Nodes:	33
Total number of Limit Nodes:	1

Executed Functions

Function 00D41CE8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(00000000,?), ref: 00D457FF

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: a5fffe3d1051821dabfe64417fa5939eabf571b67c0e013777385303a1248e76
Instruction ID: a09896e3d0096760496893d185771ffa9a393f5608d26a4fb0734718f6fdd566
Opcode Fuzzy Hash: a5fffe3d1051821dabfe64417fa5939eabf571b67c0e013777385303a1248e76
Instruction Fuzzy Hash: AF2148B1800659CFCB10CF9AD884BEEBBF4BF48324F14846AE559A3341D778A944CFA0

Function 00D44158 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V[n, xrefs: 00D4440F

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID: \V[n
API String ID: 0-1005319620
Opcode ID: 4fd826287f4913ef18e0c5e49649db85a2b992280284da35f89b529e3008a9cb
Instruction ID: 820075f1313f422d97d55b29857ba70f23bf4f1804aecfa73b7431676ac77214
Opcode Fuzzy Hash: 4fd826287f4913ef18e0c5e49649db85a2b992280284da35f89b529e3008a9cb
Instruction Fuzzy Hash: 51B15170E00649CFDF14CFA9C88579DBBF2BF88714F188129E819A7254EB749885CFA5

Function 00D44A28 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c97f05b2feb79e88fc06c17dec9a706d73b60969c9eff5483aae18855e30af82
Instruction ID: 8c23869886eb9779c94b771917bade2d98d05c8a35d84a4fb55a127b1b338463
Opcode Fuzzy Hash: c97f05b2feb79e88fc06c17dec9a706d73b60969c9eff5483aae18855e30af82
Instruction Fuzzy Hash: C3B15F70E006098FDF10CFA9C89579DBBF2FF88715F188129D815E7254EB749885CB91

Function 00D460C1 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3764c19b6141353f7d5ed824ca6f80b796bfa62adc826c9b3fd0c0de0a4ab7cd
Instruction ID: dce391cb1e9631bcd6ae3f9a5e322667fcfb54554681fa0456ec23d3bee49cea
Opcode Fuzzy Hash: 3764c19b6141353f7d5ed824ca6f80b796bfa62adc826c9b3fd0c0de0a4ab7cd
Instruction Fuzzy Hash: 8B818C34B042589BDB08AF74985837F7BB3AFC9751B18852ED447E7298CE34DC0297A2

Function 00D474D0 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 00D47553

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 3f38e2f57f13109237e66e1b48cd06fc7d9b58c1497cd53dec3e2c3d0c4c2589
Instruction ID: a4e400f0239c4369fd0438b1fde1a72e1163f6003c643240fdd9ac08833bb778
Opcode Fuzzy Hash: 3f38e2f57f13109237e66e1b48cd06fc7d9b58c1497cd53dec3e2c3d0c4c2589
Instruction Fuzzy Hash: C34126B5D0421A8FDB14CFA9D844BEEBBF4BF88320F14851AE519A7250C774A944CFA1

Function 07060040 Relevance: 1.6, Instructions: 1574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4536480566.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3832387649e78e2b7a8dd050da132470ca53fed0640144bd54ffcdcde4bf6a21
Instruction ID: ee0785fefa136791f3a7a90b5c711ea18fee6821336e0f9cc397e7b1a423f81b
Opcode Fuzzy Hash: 3832387649e78e2b7a8dd050da132470ca53fed0640144bd54ffcdcde4bf6a21
Instruction Fuzzy Hash: 51D24670B112588FDB58BB74D4A863D77B3EBCA740B604A6CD4068B394DF36AC42DB81

Function 00D45782 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(00000000,?), ref: 00D457FF

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 3d81b25b1b1cabd9ad76ecd07c782ab22f4f54c231ee1fe8daf3df6e42e38cb8
Instruction ID: a473adad7d904d5d04612c214d3c246241161fca5dc56b1944fde1e687ec7ccc
Opcode Fuzzy Hash: 3d81b25b1b1cabd9ad76ecd07c782ab22f4f54c231ee1fe8daf3df6e42e38cb8
Instruction Fuzzy Hash: A42148B2800659CFCB14CF9AD884BEEFBF4BF48324F14846AE558A3251D778A944CF60

Function 00D4C154 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00D4C59E,?,?,?,?,?), ref: 00D4C65F

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9ca4aa1d3725fc9d956d89ec98d6ae866f33b255680610dde7c8b3439488337d
Instruction ID: 5e0f63785175a15d2665890034e8fecfee542a3547e80be8acf9a629f843919b
Opcode Fuzzy Hash: 9ca4aa1d3725fc9d956d89ec98d6ae866f33b255680610dde7c8b3439488337d
Instruction Fuzzy Hash: 3421E4B5901349EFDB10CFAAD984ADEBBF4FB48320F14845AE914A7310D374A950CFA4

Function 00D4C5D7 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00D4C59E,?,?,?,?,?), ref: 00D4C65F

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a7ca6698155edc2ff80ded0e388bc4f079c712587cb53808d424d9740bbeab10
Instruction ID: 3d0d139618f420b5bd71c7eb6fb72cb656b2f7c23653f4c9d3140128c6d83a7f
Opcode Fuzzy Hash: a7ca6698155edc2ff80ded0e388bc4f079c712587cb53808d424d9740bbeab10
Instruction Fuzzy Hash: 1C21C2B5901249DFDB10CFA9D984ADEBBF5FB48320F14841AE918A3350D378A954CF64

Function 00D474D8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 00D47553

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: a8c1486461bdea847683f9532745e0e214a3cdcd9426d598e144cfbb6529316c
Instruction ID: e2f093683e8aab001588f7871cf7ce476bb01437f0e78c948a10e0bee1b573fa
Opcode Fuzzy Hash: a8c1486461bdea847683f9532745e0e214a3cdcd9426d598e144cfbb6529316c
Instruction Fuzzy Hash: BC2127B5D002498FDB14CFAAC844BDEFBF5BF88310F148419E519A7250C774A940CFA1

Function 00D464F5 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL(?,?,?), ref: 00D4655D

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 7ffadb74b4dfa0ddb51d1052c49d0dec0c732c20aa77f902afac98945c8f6172
Instruction ID: 315201be1379bef08c234e0a86942a896fba44d60c39a06f11e614c9a4e7b47f
Opcode Fuzzy Hash: 7ffadb74b4dfa0ddb51d1052c49d0dec0c732c20aa77f902afac98945c8f6172
Instruction Fuzzy Hash: DD1122B58042498FDB20DF9AD884BDEBFF0AF88310F208119D629A3250D3B4A944CFA1

Function 00D464F8 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL(?,?,?), ref: 00D4655D

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 0df4c4725eeb3eea5178cac891d7e467d66f2fe058342dd482f2b86df8b020aa
Instruction ID: 2957cb3b02129d76b40c26e554a1ac4134996acea164649b8de5a06b10519d33
Opcode Fuzzy Hash: 0df4c4725eeb3eea5178cac891d7e467d66f2fe058342dd482f2b86df8b020aa
Instruction Fuzzy Hash: E111F2B58002498FDB20DF9AC884BDEBBF4EB88320F208019D619A7250D7B4A944CFA5

Function 00D4C5D0 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00D4C59E,?,?,?,?,?), ref: 00D4C65F

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0658b376bcb09d3b1623ea1109e1a8d18661693cf380f832f364bd55edc542e5
Instruction ID: 75fd04fe776477d8cce59dc8c60afe3a48a8e4ceb85018ac683b9009752f3280
Opcode Fuzzy Hash: 0658b376bcb09d3b1623ea1109e1a8d18661693cf380f832f364bd55edc542e5
Instruction Fuzzy Hash: B81135B69002099FDB00CFA9D844BEEBBF4EF48314F14804AE918A7220C3789950CF61

Function 07060006 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4536480566.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0174cd9c0ee134f87ec52e3a297a7b8437eb049cc5a28db8354026dfc2ca5b
Instruction ID: a98c414d107b14fbcd19db98ba7d1882cff6e506d2d3d032bf646d99291956eb
Opcode Fuzzy Hash: ab0174cd9c0ee134f87ec52e3a297a7b8437eb049cc5a28db8354026dfc2ca5b
Instruction Fuzzy Hash: F731CE706453458FC7269738D8656AE7FF2DF86320B0409EAD149DB342DB348C46C7A2

Function 00C8D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533491672.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8d000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfdd41792b40c786f9ef62eb3df7de35adbf6330a36c77cbdd4ab83725bb8e5c
Instruction ID: d6bd654b090ffdc22ea704c691ba0afc795988f9274572795b6e6d5b4d78ddd8
Opcode Fuzzy Hash: bfdd41792b40c786f9ef62eb3df7de35adbf6330a36c77cbdd4ab83725bb8e5c
Instruction Fuzzy Hash: E02106B2504244DFDB05EF54D9C0B26BF65FB94328F20C16DE90A0B296C376D955CBA2

Function 00CAD0EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533554715.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ae7f0b086412d311f2d1bc4721ba11510d6342c4b8b68a17ee8f805ff12c17
Instruction ID: 85de16f4428f0020df52f309d64ec53e590b958962a8e87f75fbb2934d4f8edd
Opcode Fuzzy Hash: 81ae7f0b086412d311f2d1bc4721ba11510d6342c4b8b68a17ee8f805ff12c17
Instruction Fuzzy Hash: 472126B5504305EFDB04DF14D9C0B2ABBA5FB85328F20C56DEA0B4B692C776D846CBA1

Function 00CAD2B4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533554715.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceddf6eebcea7118b0f3e53be91c9cc2e93628543dd69abef5fe7d34f127c5a8
Instruction ID: 3d02d99392690166b43593d8627a0be81b8c8d45a46c9618974d54dc00226e48
Opcode Fuzzy Hash: ceddf6eebcea7118b0f3e53be91c9cc2e93628543dd69abef5fe7d34f127c5a8
Instruction Fuzzy Hash: E82134B5504205EFDF04DF10D9C0B2ABBB1FB85328F20C56DE90B4B662C77AD846CA62

Function 00C8D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533491672.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8d000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 2b4025c34e6c201a80dfa16e741e2aea93321b5769142f3943718c4fe65fc751
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: E311E9B6504240CFCF16DF14D5C4B16BF71FB94318F24C5AAD9060B256C336D956CB91

Function 00CAD2AF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533554715.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 3faa8579e1519d7974d9ee282b9bc69945808252f41b2831e92765738852af57
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: A011DD75504680CFCB01CF10D5C4B19BBB1FB85328F28C6A9D84A4B662C33AD94ACFA2

Function 00CAD0E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533554715.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: b3e97156a92e9e952aadfb99eaf0b41f4fddeea7bac2666be8f7bfacea6047a6
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: F711D075504284DFDB01CF10D9C4B19BBB1FB45328F24C6A9D90A4B666C33AD94ACF91

Function 07061942 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4536480566.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4a318a6df64b0de08a8d40ec979063799f8ff9377d149c1e4ecd73cba4a033
Instruction ID: 0d1cf5db03579b58831cb03b8d44c24d4b28727d139cd0c287beb694e54bfa59
Opcode Fuzzy Hash: 4f4a318a6df64b0de08a8d40ec979063799f8ff9377d149c1e4ecd73cba4a033
Instruction Fuzzy Hash: E511C471B101089FD7049B29C859B6EBBF6AF8C710F204059E502E73A0CF719D01CBA0

Non-executed Functions

Function 00D43E10 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\V[n, xrefs: 00D4405B

Memory Dump Source

Source File: 00000000.00000002.4533708091.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID: \V[n
API String ID: 0-1005319620
Opcode ID: d611a9fb926d0ca884701dc23511823ec28bec3e6db87d9f61e50912bcc58343
Instruction ID: c374dd4decbfd20dfcef7c2c848e53f37a5309c961af6e2b6943447b6482d3ac
Opcode Fuzzy Hash: d611a9fb926d0ca884701dc23511823ec28bec3e6db87d9f61e50912bcc58343
Instruction Fuzzy Hash: 99919E70E002498FDF10CFA8C98179EBBF2BF88714F188129E405A7294EB749995CFA1

Function 07061B10 Relevance: 1.0, Instructions: 1023COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4536480566.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_QHLQyYBiH7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baafe94d384da2f348e9a2ecb915194fc77dbcb213dfe27b89ec2c82c7c0a49e
Instruction ID: 27fedb30f9fbaf7f58fd6a683e04a95bb4f374d9c2d780f9b97b5d265c5ae43a
Opcode Fuzzy Hash: baafe94d384da2f348e9a2ecb915194fc77dbcb213dfe27b89ec2c82c7c0a49e
Instruction Fuzzy Hash: AC825B707002058FEB54EF69C898B2EBBE2BFC4704F60952DE5069B3A6CE759D06CB51

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QHLQyYBiH7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
QHLQyYBiH7.exe

Function 00D41CE8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Function 00D44158 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Function 00D474D0 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 00D45782 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 00D4C154 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 00D4C5D7 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 00D474D8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Function 00D464F5 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Function 00D464F8 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 00D4C5D0 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON