Edit tour

Windows Analysis Report
1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Overview

General Information

Sample name:	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
Analysis ID:	1587332
MD5:	91d66cb0c8827d4910ccfcbc47c47341
SHA1:	bddc6177a0b1e74766aad733e3bf2a9d4a8d2fa8
SHA256:	9535dad2b91fa8471968970c7cd34dff2123511f5b451f200a7d7acef8c738f9
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

AsyncRAT, DcRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

Yara detected DcRat

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe (PID: 6220 cmdline: "C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe" MD5: 91D66CB0C8827D4910CCFCBC47C47341)

cmd.exe (PID: 5676 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp9468.tmp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5656 cmdline: timeout 3 MD5: 100065E21CFBBDE57CBA2838921F84D6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "drlas.duckdns.org,", "Ports": "5999", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "ONIEYu5TdgzF27FrSbiruzYVeQWKFfpu", "Mutex": "DcRatMutex_qwqdanchun", "Certificate": "MIICMDCCAZmgAwIBAgIVAIhNlmebb6nSe6ECHjMpYKJ1i7gvMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDEyODA1MzU1N1oXDTMxMTEwNzA1MzU1N1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALz18kcXxyYRNtzNciIOitqVEEKYOOJZOGjSaWOLKz3M/Df8QpKzt86Y+GK3639BYF/OzJ6i8PyJcI4jCe+L56ytnlJDfAYTzg7df+pvpE6bSgYYgBSEMcKBPrpx6bV5z/V8FOCVqlt9xfM47rHzIs6kOkc0Xu0TqFGxVfi3Koj/AgMBAAGjMjAwMB0GA1UdDgQWBBQOZShjgdZ92lUVGT5AalbF4rcBrDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBABuRWEmIgb/BjPElBrcq4LuUTHLBWgnJN3yXXtFA+Nl/+mYto5FZMUmzz3mbjKRHuzo79jdei4h1vSO9+2gTFWw1mY8HoeEoyL0YExBQMCoUPjpLJEuAydiWBMXXBmv0zPzE3W7zhG6DRe8pXQkZ2yu8c9G4KxXS1ITmSrlJqBQ6", "ServerSignature": "LUl+TSA5OfYpNCFirGnKVY2PgFqE//sbmddNOLSMH0n+guFtXitTu57o5KL9UVY6AdSPshxtsmNPz+jIc58b7tVHubUfTMuLPeeSRtO9g5rhtyHIRJ1ccmoF6gMeFImBPGtA6RfONX4v4ooFNlds2HDgTXxKLMqme2ugxPVuS3s=", "BDOS": "null", "External_config_on_Pastebin": "false"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65fb:$a1: havecamera 0x9aec:$a2: timeout 3 > NUL 0x9b0c:$a3: START "" " 0x9997:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a4c:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0xa146:$str01: DcRatByqwqdanchun 0x9a4c:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x9808:$str03: Po_ng 0x97de:$str04: Pac_ket 0x9eea:$str05: Perfor_mance 0x9f2e:$str06: Install_ed 0x66dd:$str07: get_IsConnected 0x7036:$str08: get_ActivatePo_ng 0x79be:$str09: isVM_by_wim_temper 0x9824:$str10: save_Plugin 0x9aec:$str11: timeout 3 > NUL 0x9b5e:$str12: ProcessHacker.exe 0x9cce:$str13: Select * from Win32_CacheMemory
1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a4c:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x9997:$s2: L2Mgc2NodGFza3MgL2 0x9916:$s3: QW1zaVNjYW5CdWZmZXI 0x9964:$s4: VmlydHVhbFByb3RlY3Q
1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cce:$q1: Select * from Win32_CacheMemory 0x9d0e:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d5c:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9daa:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa146:$s1: DcRatBy
Click to see the 1 entries

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xa05f0:$b2: DcRat By qwqdanchun1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2547808998.00000000030D5000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x5eec:$a2: timeout 3 > NUL 0x5f24:$a3: START "" " 0x4914:$b2: DcRat By qwqdanchun1 0x4b64:$b2: DcRat By qwqdanchun1
00000000.00000002.2549612060.000000001BA44000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x234c:$b2: DcRat By qwqdanchun1
00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x63fb:$a1: havecamera 0x98ec:$a2: timeout 3 > NUL 0x990c:$a3: START "" " 0x9797:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x984c:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000000.00000002.2549225816.000000001B809000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x231d0:$b2: DcRat By qwqdanchun1
00000000.00000002.2549225816.000000001B7D0000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xd3b0:$b2: DcRat By qwqdanchun1
00000000.00000002.2550355256.000000001CA00000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x30885:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x307d4:$s2: L2Mgc2NodGFza3MgL2
00000000.00000002.2547482160.0000000001255000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x4cb6c:$b2: DcRat By qwqdanchun1
00000000.00000002.2547808998.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000000.00000002.2547808998.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x5488:$b1: DcRatByqwqdanchun 0x40f94:$b2: DcRat By qwqdanchun1
00000000.00000002.2547808998.00000000030F0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000000.00000002.2547808998.00000000030F0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xaf3f4:$b2: DcRat By qwqdanchun1 0x10f708:$b2: DcRat By qwqdanchun1 0x11742c:$b2: DcRat By qwqdanchun1 0x11767c:$b2: DcRat By qwqdanchun1
Process Memory Space: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe PID: 6220	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe PID: 6220	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe PID: 6220	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x97f6e:$a1: havecamera 0x24a6:$b1: DcRatByqwqdanchun 0x9cb51:$b1: DcRatByqwqdanchun 0xdf88:$b2: DcRat By qwqdanchun1 0xeda1:$b2: DcRat By qwqdanchun1 0x3c4f5:$b2: DcRat By qwqdanchun1 0x778de:$b2: DcRat By qwqdanchun1 0x7c421:$b2: DcRat By qwqdanchun1 0x83813:$b2: DcRat By qwqdanchun1 0x860b7:$b2: DcRat By qwqdanchun1
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65fb:$a1: havecamera 0x9aec:$a2: timeout 3 > NUL 0x9b0c:$a3: START "" " 0x9997:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a4c:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0xa146:$str01: DcRatByqwqdanchun 0x9a4c:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x9808:$str03: Po_ng 0x97de:$str04: Pac_ket 0x9eea:$str05: Perfor_mance 0x9f2e:$str06: Install_ed 0x66dd:$str07: get_IsConnected 0x7036:$str08: get_ActivatePo_ng 0x79be:$str09: isVM_by_wim_temper 0x9824:$str10: save_Plugin 0x9aec:$str11: timeout 3 > NUL 0x9b5e:$str12: ProcessHacker.exe 0x9cce:$str13: Select * from Win32_CacheMemory
0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a4c:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x9997:$s2: L2Mgc2NodGFza3MgL2 0x9916:$s3: QW1zaVNjYW5CdWZmZXI 0x9964:$s4: VmlydHVhbFByb3RlY3Q
0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cce:$q1: Select * from Win32_CacheMemory 0x9d0e:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d5c:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9daa:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa146:$s1: DcRatBy
0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.12fcbd50.1.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x2ea85:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x2e9d4:$s2: L2Mgc2NodGFza3MgL2
0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.1ca00000.2.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x2ea85:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x2e9d4:$s2: L2Mgc2NodGFza3MgL2
0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.1ca00000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x30885:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x307d4:$s2: L2Mgc2NodGFza3MgL2
0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.12fcbd50.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x30885:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x307d4:$s2: L2Mgc2NodGFza3MgL2
Click to see the 5 entries

Suricata Signatures

ET MALWARE Observed Malicious SSL Cert (AsyncRAT)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T07:50:29.002132+0100	2034847	1	Domain Observed Used for C2 Detected	45.135.232.38	5999	192.168.2.6	49826	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T07:50:29.002132+0100	2842478	1	Malware Command and Control Activity Detected	45.135.232.38	5999	192.168.2.6	49826	TCP
2025-01-10T07:50:44.670989+0100	2842478	1	Malware Command and Control Activity Detected	45.135.232.38	5999	192.168.2.6	49919	TCP

ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T07:50:29.002132+0100	2848048	1	Domain Observed Used for C2 Detected	45.135.232.38	5999	192.168.2.6	49826	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Avira: detected

Found malware configuration

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Malware Configuration Extractor: AsyncRAT {"Server": "drlas.duckdns.org,", "Ports": "5999", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "ONIEYu5TdgzF27FrSbiruzYVeQWKFfpu", "Mutex": "DcRatMutex_qwqdanchun", "Certificate": "MIICMDCCAZmgAwIBAgIVAIhNlmebb6nSe6ECHjMpYKJ1i7gvMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDEyODA1MzU1N1oXDTMxMTEwNzA1MzU1N1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALz18kcXxyYRNtzNciIOitqVEEKYOOJZOGjSaWOLKz3M/Df8QpKzt86Y+GK3639BYF/OzJ6i8PyJcI4jCe+L56ytnlJDfAYTzg7df+pvpE6bSgYYgBSEMcKBPrpx6bV5z/V8FOCVqlt9xfM47rHzIs6kOkc0Xu0TqFGxVfi3Koj/AgMBAAGjMjAwMB0GA1UdDgQWBBQOZShjgdZ92lUVGT5AalbF4rcBrDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBABuRWEmIgb/BjPElBrcq4LuUTHLBWgnJN3yXXtFA+Nl/+mYto5FZMUmzz3mbjKRHuzo79jdei4h1vSO9+2gTFWw1mY8HoeEoyL0YExBQMCoUPjpLJEuAydiWBMXXBmv0zPzE3W7zhG6DRe8pXQkZ2yu8c9G4KxXS1ITmSrlJqBQ6", "ServerSignature": "LUl+TSA5OfYpNCFirGnKVY2PgFqE//sbmddNOLSMH0n+guFtXitTu57o5KL9UVY6AdSPshxtsmNPz+jIc58b7tVHubUfTMuLPeeSRtO9g5rhtyHIRJ1ccmoF6gMeFImBPGtA6RfONX4v4ooFNlds2HDgTXxKLMqme2ugxPVuS3s=", "BDOS": "null", "External_config_on_Pastebin": "false"}

Multi AV Scanner detection for submitted file

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49989 version: TLS 1.2

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 45.135.232.38:5999 -> 192.168.2.6:49826
Source: Network traffic	Suricata IDS: 2034847 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT) : 45.135.232.38:5999 -> 192.168.2.6:49826
Source: Network traffic	Suricata IDS: 2848048 - Severity 1 - ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT) : 45.135.232.38:5999 -> 192.168.2.6:49826
Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 45.135.232.38:5999 -> 192.168.2.6:49919

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: drlas.duckdns.org
Source: Malware configuration extractor	URLs:

Uses dynamic DNS services

Source: unknown

DNS query: name: drlas.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.6:49826 -> 45.135.232.38:5999

Source: Joe Sandbox View

IP Address: 45.135.232.38 45.135.232.38

Source: Joe Sandbox View

ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199

Source: global traffic

DNS traffic detected: DNS query: drlas.duckdns.org

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547482160.00000000012B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547482160.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547808998.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547808998.00000000030F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49989 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe PID: 6220, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.12fcbd50.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.1ca00000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.1ca00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.12fcbd50.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 00000000.00000002.2547808998.00000000030D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2549612060.000000001BA44000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2549225816.000000001B809000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2549225816.000000001B7D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2550355256.000000001CA00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 00000000.00000002.2547482160.0000000001255000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2547808998.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2547808998.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe PID: 6220, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD348ADD50	0_2_00007FFD348ADD50
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD3489F7E8	0_2_00007FFD3489F7E8
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD348A0030	0_2_00007FFD348A0030
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD348930E5	0_2_00007FFD348930E5
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD34899132	0_2_00007FFD34899132
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD3489C07F	0_2_00007FFD3489C07F
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD3489FBED	0_2_00007FFD3489FBED
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD34898386	0_2_00007FFD34898386
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD3489DBCD	0_2_00007FFD3489DBCD
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD3489FCFA	0_2_00007FFD3489FCFA
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD3489773D	0_2_00007FFD3489773D
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD34897E89	0_2_00007FFD34897E89

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2548846884.0000000012F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOptions.dll" vs 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000000.2204262220.0000000000C6E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe" vs 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2550355256.000000001CA00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOptions.dll" vs 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547808998.0000000002F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOptions.dll" vs 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Binary or memory string: OriginalFilenameClient.exe" vs 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.12fcbd50.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.1ca00000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.1ca00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.12fcbd50.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 00000000.00000002.2547808998.00000000030D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2549612060.000000001BA44000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2549225816.000000001B809000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2549225816.000000001B7D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2550355256.000000001CA00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 00000000.00000002.2547482160.0000000001255000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2547808998.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2547808998.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe PID: 6220, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/5@1/2

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1824:120:WilError_03
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Mutant created: \Sessions\1\BaseNamedObjects\DcRatMutex_qwqdanchun

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

File created: C:\Users\user\AppData\Local\Temp\tmp9468.tmp

Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp9468.tmp.bat""

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

ReversingLabs: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe "C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe"
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp9468.tmp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp9468.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD3489082F push ss; ret	0_2_00007FFD3489083E
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD348900BD pushad ; iretd	0_2_00007FFD348900C1
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Code function: 0_2_00007FFD3489F3B8 push esi; retf 5BBDh	0_2_00007FFD348B6D27

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe PID: 6220, type: MEMORYSTR

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\D0166E0128922C00CE6B F7A2CF016280A5E7A24A46D6E81A704BFCCD6486B35AFEFC4601A8330895F85F

Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe PID: 6220, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Memory allocated: 11B0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Memory allocated: 1AF00000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Window / User API: threadDelayed 8038			Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Window / User API: threadDelayed 1792			Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe TID: 6708	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe TID: 6248	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe TID: 5960	Thread sleep count: 8038 > 30	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe TID: 5960	Thread sleep count: 1792 > 30	Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547482160.00000000012B2000.00000004.00000020.00020000.00000000.sdmp, 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547482160.00000000012D6000.00000004.00000020.00020000.00000000.sdmp, 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2549379433.000000001B8BD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp9468.tmp.bat""			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3			Jump to behavior

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547808998.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547808998.0000000003235000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547808998.0000000003235000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Queries volume information: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe PID: 6220, type: MEMORYSTR

Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: MSASCui.exe
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: procexp.exe
Source: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000000.00000002.2547808998.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2547808998.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe PID: 6220, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000000.00000002.2547808998.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2547808998.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe PID: 6220, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scripting	1 Scheduled Task/Job	1 Modify Registry	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Virtualization/Sandbox Evasion	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	22 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT
1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	100%	Avira	HEUR/AGEN.1307404
1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
drlas.duckdns.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
drlas.duckdns.org	45.135.232.38	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
	true		unknown
drlas.duckdns.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547808998.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe, 00000000.00000002.2547808998.00000000030F0000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.135.232.38	drlas.duckdns.org	Russian Federation		49392	ASBAXETNRU	true

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587332
Start date and time:	2025-01-10 07:49:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/5@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 56% Number of executed functions: 11 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.210.172, 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:50:29	API Interceptor	1x Sleep call for process: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.135.232.38	17345062850621022e2a034193497843f70f72ad0e2a6d5b0e23bb6cd0de4c41fac1759029833.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	1733858044dd572d66bc3a8dabfe408fb29ad3eddb6c690affcab2d50d59673d0019848271178.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	1732748284fd56a2da13edf4ae4b865c44fa6834581d27eb2edbfe3fc50ef131cb95db5639506.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	17315457645970cbc5e5c3aae0a844eb233aad28ea87b3b8a58910e225655f6d041f399ede930.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	17312358643e2349e1394349def751b6d9e1f5f7d806ef332905ce99f25fe32ff480e138d6557.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	1730879944d691bb811f5e0f33d6d0d5afc86cdfb09b3d0562ee86d2276a3358127f125d3c941.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse
	172698102496c864a187aff64295ab0b70d4e0148fc884b8fdef49a9c604553959f0c4197e421.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	1726981024afb0b5261027cf8cb56ba2e74288f35f8a8f03f714e141da3004c24e1b6d3c16555.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	decode_3c3a2e81bb9b9ea689c7c8d6aa9e24c0af55f3915e14295a64263688c83f4ab7.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	gqIYXW7GfB.exe	Get hash	malicious	DCRat	Browse	199.232.214.172
	https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	1Ta6ojwHc6.exe	Get hash	malicious	DCRat	Browse	199.232.210.172
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	new.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5.zip	Get hash	malicious	Unknown	Browse	199.232.210.172
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	199.232.210.172
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASBAXETNRU	Hilix.m68k.elf	Get hash	malicious	Mirai	Browse	212.196.181.161
	nshppc.elf	Get hash	malicious	Mirai	Browse	212.196.181.181
	mips.elf	Get hash	malicious	Mirai	Browse	212.60.5.153
	ppc.elf	Get hash	malicious	Mirai	Browse	212.60.5.153
	nshkmpsl.elf	Get hash	malicious	Mirai	Browse	212.192.13.95
	billys.exe	Get hash	malicious	Meduza Stealer	Browse	45.130.145.152
	ruppert.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	SwJD3kiOwV.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	194.87.47.113
	8dw8GAvqmM.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	194.87.47.113
	UYJ0oreVew.exe	Get hash	malicious	Unknown	Browse	194.87.47.113

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://aqctslc.com/	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	https://sacredartscommunications.com/	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	http://stonecoldstalley.com/	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	RFQ-12202430_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	PaymentAdvice.html	Get hash	malicious	KnowBe4	Browse	40.113.110.67 40.113.103.199
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.113.103.199
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.113.103.199
	PO-12202432_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.113.103.199
	RFQ-12202430_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199

Process:	C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKwVGDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:YVGDiDImsLNkPlE99SNxAhUe/3
MD5:	170841B51CFB6DB18036C8AC2B4C58F1
SHA1:	13BD85FB77D71363D011DFED10092E36152C2634
SHA-256:	92734317C95EF193A37EC1F89567360224965C09A13734702D1C672EFC52E66C
SHA-512:	E90CD32E30C05E0C793FF246DF3352912905938EDC04BFB1B2F04122658D54ACE25820FEB2C825DCA4565864B004A0DD76FD6CDAA9E860BCC993DF4CD268E152
Malicious:	false
Reputation:	low
Preview:	p...... .........W\|.+c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.log

Download File

Process:	C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	5.375380268342155
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkl+vxp3/ell1qHGIs0HKJHNptLHqHj:iqbYqGSI6oPtzHeqKksZp/ellwmj0qJi
MD5:	4CEAC8E156C9A1D90AB03AF9133D7A38
SHA1:	39ACAE4267BF940B8995DD12CC797DE497B4D73E
SHA-256:	7BB4ADB915FC1C1076B35CC3D69402A22EB89878D6269FAF5826FF06958ED0D6
SHA-512:	597A202013C9E046449D71BF4C816E98BC7203EDBEB17F3D181400590C36E9E545B6FD7449635719EEF595B8730C066313912B1DA1A7F87AC818082B2C330A7B
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V

C:\Users\user\AppData\Local\Temp\tmp9468.tmp.bat

Download File

Process:	C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	5.295808172690044
Encrypted:	false
SSDEEP:	6:hWKqTtLN2KO9L0Ek8xK197XGw0rDNeN723fTXCk:wdtR2KO9w+xKW/rDN+aLXh
MD5:	3D05AAC2E39D259030F55B271D9A6989
SHA1:	F4DAD1F4E2432E5CA6462B2169974D7C8961B4F8
SHA-256:	82CC4FC6B35F59F1D6372A757511C16B82D46F8977465FD8BF8BC97EADDAC88F
SHA-512:	181191F787FC6F8D565375D2A8B01DF175C621CE43E41005A95A6A276363716726B15A62CABD61CE81501E494CA19F994EDB6F2DCD11422A7E441209FFA0EB06
Malicious:	false
Reputation:	low
Preview:	@echo off..timeout 3 > NUL..CD C:\Users\user\Desktop..DEL "1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe" /f /q..CD C:\Users\user\AppData\Local\Temp\..DEL "tmp9468.tmp.bat" /f /q..

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.61761828164522
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
File size:	48'640 bytes
MD5:	91d66cb0c8827d4910ccfcbc47c47341
SHA1:	bddc6177a0b1e74766aad733e3bf2a9d4a8d2fa8
SHA256:	9535dad2b91fa8471968970c7cd34dff2123511f5b451f200a7d7acef8c738f9
SHA512:	5c9ac570df36d4822889fa57ff16acf88fb0e55ed88e040443d5f385abae43fad7df5710a07393837edc6995e13fca5cd142c650430e5017a99c3e1acf176627
SSDEEP:	768:xGq+s3pUtDILNCCa+Di+0jd3gLqRp8A0PiBMYb5geHuFNxGNKvEgK/JLZVc6KN:8q+AGtQO+GaPAPDbWiyNsknkJLZVclN
TLSH:	F2236C0037D8C13AE2FD4BB5A9F2A1458279E6576903CB596CC811EA2F13BC597036FE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`................................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40cbbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x60930A0B [Wed May 5 21:11:39 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcb68	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0xdf7	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xabc4	0xac00	c45e84d071d614c5ee46942222967e66	False	0.5022256540697675	data	5.6433375334755755	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0xdf7	0xe00	2083376922615c09cdda9acfd9305376	False	0.4017857142857143	data	5.110607648061562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0xc	0x200	82148d01c3935cf90ef81a3dd1fad607	False	0.044921875	data	0.07763316234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe0a0	0x2d4	data			0.4350828729281768
RT_MANIFEST	0xe374	0xa83	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.40245261984392416

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T07:50:29.002132+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	45.135.232.38	5999	192.168.2.6	49826	TCP
2025-01-10T07:50:29.002132+0100	2034847	ET MALWARE Observed Malicious SSL Cert (AsyncRAT)	1	45.135.232.38	5999	192.168.2.6	49826	TCP
2025-01-10T07:50:29.002132+0100	2848048	ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT)	1	45.135.232.38	5999	192.168.2.6	49826	TCP
2025-01-10T07:50:44.670989+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	45.135.232.38	5999	192.168.2.6	49919	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 07:50:06.132013083 CET	49673	443	192.168.2.6	173.222.162.64
Jan 10, 2025 07:50:06.132019997 CET	49674	443	192.168.2.6	173.222.162.64
Jan 10, 2025 07:50:06.261193037 CET	49709	443	192.168.2.6	40.113.110.67
Jan 10, 2025 07:50:06.261229992 CET	443	49709	40.113.110.67	192.168.2.6
Jan 10, 2025 07:50:06.261428118 CET	49709	443	192.168.2.6	40.113.110.67
Jan 10, 2025 07:50:06.261869907 CET	49709	443	192.168.2.6	40.113.110.67
Jan 10, 2025 07:50:06.261883974 CET	443	49709	40.113.110.67	192.168.2.6
Jan 10, 2025 07:50:06.444556952 CET	49672	443	192.168.2.6	173.222.162.64
Jan 10, 2025 07:50:07.070242882 CET	443	49709	40.113.110.67	192.168.2.6
Jan 10, 2025 07:50:07.070452929 CET	49709	443	192.168.2.6	40.113.110.67
Jan 10, 2025 07:50:07.075671911 CET	49709	443	192.168.2.6	40.113.110.67
Jan 10, 2025 07:50:07.075691938 CET	443	49709	40.113.110.67	192.168.2.6
Jan 10, 2025 07:50:07.076077938 CET	443	49709	40.113.110.67	192.168.2.6
Jan 10, 2025 07:50:07.088617086 CET	49709	443	192.168.2.6	40.113.110.67
Jan 10, 2025 07:50:07.088645935 CET	49709	443	192.168.2.6	40.113.110.67
Jan 10, 2025 07:50:07.088653088 CET	443	49709	40.113.110.67	192.168.2.6
Jan 10, 2025 07:50:07.088787079 CET	49709	443	192.168.2.6	40.113.110.67
Jan 10, 2025 07:50:07.131324053 CET	443	49709	40.113.110.67	192.168.2.6
Jan 10, 2025 07:50:07.263334990 CET	443	49709	40.113.110.67	192.168.2.6
Jan 10, 2025 07:50:07.263423920 CET	443	49709	40.113.110.67	192.168.2.6
Jan 10, 2025 07:50:07.263500929 CET	49709	443	192.168.2.6	40.113.110.67
Jan 10, 2025 07:50:07.263667107 CET	49709	443	192.168.2.6	40.113.110.67
Jan 10, 2025 07:50:07.263689995 CET	443	49709	40.113.110.67	192.168.2.6
Jan 10, 2025 07:50:14.178601980 CET	49736	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:14.178612947 CET	443	49736	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:14.178675890 CET	49736	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:14.179434061 CET	49736	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:14.179445028 CET	443	49736	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:14.979967117 CET	443	49736	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:14.980057955 CET	49736	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:14.982486963 CET	49736	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:14.982500076 CET	443	49736	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:14.982780933 CET	443	49736	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:14.984657049 CET	49736	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:14.984708071 CET	49736	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:14.984718084 CET	443	49736	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:14.984834909 CET	49736	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:15.027331114 CET	443	49736	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:15.159013033 CET	443	49736	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:15.159106970 CET	443	49736	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:15.159671068 CET	49736	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:15.160243988 CET	49736	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:15.160264015 CET	443	49736	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:15.160284042 CET	49736	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:15.741614103 CET	49673	443	192.168.2.6	173.222.162.64
Jan 10, 2025 07:50:15.741709948 CET	49674	443	192.168.2.6	173.222.162.64
Jan 10, 2025 07:50:16.053922892 CET	49672	443	192.168.2.6	173.222.162.64
Jan 10, 2025 07:50:17.753611088 CET	443	49704	173.222.162.64	192.168.2.6
Jan 10, 2025 07:50:17.753699064 CET	49704	443	192.168.2.6	173.222.162.64
Jan 10, 2025 07:50:26.311728954 CET	49808	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:26.311770916 CET	443	49808	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:26.311855078 CET	49808	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:26.312566996 CET	49808	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:26.312581062 CET	443	49808	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:27.118375063 CET	443	49808	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:27.118663073 CET	49808	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:27.120063066 CET	49808	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:27.120078087 CET	443	49808	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:27.120291948 CET	443	49808	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:27.121932983 CET	49808	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:27.121932983 CET	49808	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:27.121954918 CET	443	49808	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:27.122195005 CET	49808	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:27.163338900 CET	443	49808	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:27.301204920 CET	443	49808	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:27.301446915 CET	443	49808	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:27.301565886 CET	49808	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:27.301743031 CET	49808	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:27.301760912 CET	443	49808	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:28.285481930 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:28.290518999 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:28.290604115 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:28.318129063 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:28.322922945 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:28.991379023 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:28.996828079 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:29.002131939 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:29.228600025 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:29.272576094 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:30.405498981 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:30.410283089 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:30.410341978 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:30.415164948 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.082490921 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.132076979 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.278964043 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.294898987 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.299710035 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.299777985 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.304645061 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754081964 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754190922 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754247904 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754256964 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754297972 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.754333973 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754343033 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754378080 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.754483938 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754493952 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754503965 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754514933 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754537106 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.754554033 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.754889965 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754937887 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754946947 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.754987001 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.755271912 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.755326033 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.759169102 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.759218931 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.759229898 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.759274960 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.884433031 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.885081053 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885132074 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885157108 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885170937 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885186911 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885194063 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.885200977 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885212898 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885230064 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.885287046 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.885371923 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885412931 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.885509014 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885523081 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885536909 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885593891 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.885593891 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.885672092 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885684013 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885698080 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.885737896 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.885747910 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.886276007 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.886291027 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.886303902 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.886344910 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.886384964 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.886415958 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.886435986 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.886449099 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.886462927 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.886475086 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.886502981 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.887139082 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.887166023 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.887182951 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.887219906 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.887243032 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:42.887294054 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.889205933 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.890016079 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:42.928868055 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.015384912 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.015433073 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.015444994 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.015494108 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.015502930 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.015583038 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.015611887 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.015625000 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.015666962 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.015789032 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.015801907 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.015815020 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.015827894 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.015851974 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.015875101 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.016062021 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.016067982 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.016105890 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.016438961 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.016541004 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.016583920 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.016592979 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.016654015 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.016668081 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.016695023 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.016791105 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.016803026 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.016815901 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.016827106 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.016833067 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.016861916 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.017015934 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.017028093 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.017060041 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.017560005 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.017580032 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.017592907 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.017601013 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.017626047 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.017795086 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.017807007 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.017818928 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.017831087 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.017838001 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.017877102 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.017986059 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.017997980 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.018034935 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.018503904 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.018547058 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.018558025 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.018589020 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.018691063 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.018703938 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.018732071 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.018868923 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.018881083 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.018892050 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.018903017 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.018909931 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.018927097 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.019475937 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.019486904 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.019514084 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.020302057 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.020313025 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.020340919 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.069504023 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.330516100 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330537081 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330555916 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330568075 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330578089 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330589056 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330600023 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330610991 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330624104 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.330629110 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330640078 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330651999 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330657005 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.330677986 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.330822945 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330833912 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330845118 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330857038 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330864906 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.330869913 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.330881119 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.330904961 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.331095934 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331106901 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331119061 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331129074 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331140995 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331140995 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.331176043 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.331196070 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331207991 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331218958 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331231117 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331232071 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.331240892 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331252098 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331257105 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.331263065 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331276894 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.331283092 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.331300020 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.332065105 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332078934 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332088947 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332099915 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332109928 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332112074 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.332118034 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.332122087 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332133055 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332144022 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332150936 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.332154989 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332165956 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332170963 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.332175970 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332184076 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.332187891 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332200050 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332211018 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.332225084 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.332247972 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.333029985 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.333043098 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.333053112 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.333064079 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.333072901 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.333072901 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.333085060 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.333098888 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.333126068 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.338272095 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.338325024 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.338335991 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.338360071 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.338454962 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.338466883 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.338493109 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.338570118 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.338609934 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.360733986 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.365525007 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.370356083 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.370417118 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.375286102 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.884471893 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.885837078 CET	49919	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.889458895 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.889544964 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.890759945 CET	5999	49919	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.890841007 CET	49919	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.891186953 CET	49919	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:43.894557953 CET	5999	49826	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:43.896001101 CET	5999	49919	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:44.665642023 CET	5999	49919	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:44.666248083 CET	49919	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:44.670989037 CET	5999	49919	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:44.701884031 CET	49919	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:44.706958055 CET	5999	49919	45.135.232.38	192.168.2.6
Jan 10, 2025 07:50:44.707055092 CET	49919	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:44.712488890 CET	49826	5999	192.168.2.6	45.135.232.38
Jan 10, 2025 07:50:44.890357018 CET	49925	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:44.890403986 CET	443	49925	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:44.890485048 CET	49925	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:44.891087055 CET	49925	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:44.891103983 CET	443	49925	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:45.778808117 CET	443	49925	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:45.778889894 CET	49925	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:45.782510042 CET	49925	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:45.782519102 CET	443	49925	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:45.782753944 CET	443	49925	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:45.784409046 CET	49925	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:45.784468889 CET	49925	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:45.784476042 CET	443	49925	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:45.784745932 CET	49925	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:45.827325106 CET	443	49925	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:45.963174105 CET	443	49925	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:45.963248968 CET	443	49925	40.113.103.199	192.168.2.6
Jan 10, 2025 07:50:45.963300943 CET	49925	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:45.963458061 CET	49925	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:50:45.963473082 CET	443	49925	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:08.623238087 CET	49988	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:08.623270988 CET	443	49988	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:08.623373032 CET	49988	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:08.623918056 CET	49988	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:08.623931885 CET	443	49988	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:09.423871994 CET	443	49988	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:09.423971891 CET	49988	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:09.425896883 CET	49988	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:09.425909042 CET	443	49988	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:09.426153898 CET	443	49988	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:09.427611113 CET	49988	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:09.427681923 CET	49988	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:09.427687883 CET	443	49988	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:09.427824974 CET	49988	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:09.475330114 CET	443	49988	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:09.606277943 CET	443	49988	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:09.606373072 CET	443	49988	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:09.606436968 CET	49988	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:09.607748985 CET	49988	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:09.607770920 CET	443	49988	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:40.984044075 CET	49989	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:40.984144926 CET	443	49989	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:40.984241009 CET	49989	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:40.984827995 CET	49989	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:40.984868050 CET	443	49989	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:41.760119915 CET	443	49989	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:41.760231018 CET	49989	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:41.762192011 CET	49989	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:41.762227058 CET	443	49989	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:41.762495995 CET	443	49989	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:41.764266014 CET	49989	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:41.764309883 CET	49989	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:41.764323950 CET	443	49989	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:41.764439106 CET	49989	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:41.807323933 CET	443	49989	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:41.934061050 CET	443	49989	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:41.934143066 CET	443	49989	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:41.934277058 CET	49989	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:41.934519053 CET	49989	443	192.168.2.6	40.113.103.199
Jan 10, 2025 07:51:41.934561014 CET	443	49989	40.113.103.199	192.168.2.6
Jan 10, 2025 07:51:47.078392029 CET	49703	443	192.168.2.6	20.190.159.4
Jan 10, 2025 07:51:47.085212946 CET	443	49703	20.190.159.4	192.168.2.6
Jan 10, 2025 07:51:47.085268021 CET	49703	443	192.168.2.6	20.190.159.4
Jan 10, 2025 07:51:49.648036957 CET	49707	443	192.168.2.6	20.190.159.4
Jan 10, 2025 07:51:49.655132055 CET	443	49707	20.190.159.4	192.168.2.6
Jan 10, 2025 07:51:49.655224085 CET	49707	443	192.168.2.6	20.190.159.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 07:50:28.179986954 CET	59101	53	192.168.2.6	1.1.1.1
Jan 10, 2025 07:50:28.284655094 CET	53	59101	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 07:50:28.179986954 CET	192.168.2.6	1.1.1.1	0x7ac	Standard query (0)	drlas.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 07:50:28.284655094 CET	1.1.1.1	192.168.2.6	0x7ac	No error (0)	drlas.duckdns.org	45.135.232.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 07:50:29.043571949 CET	1.1.1.1	192.168.2.6	0x5dc8	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 07:50:29.043571949 CET	1.1.1.1	192.168.2.6	0x5dc8	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 06:50:07 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 30 65 67 52 55 51 7a 32 58 45 75 35 4c 56 45 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 32 35 66 61 61 38 66 65 62 34 66 66 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: 0egRUQz2XEu5LVEm.1Context: 3025faa8feb4ff6
2025-01-10 06:50:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-10 06:50:07 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 30 65 67 52 55 51 7a 32 58 45 75 35 4c 56 45 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 32 35 66 61 61 38 66 65 62 34 66 66 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 49 38 74 53 6b 55 67 67 44 65 59 77 51 31 78 76 67 43 45 63 64 51 33 44 33 54 58 31 43 70 67 56 75 6e 50 66 54 79 74 6c 7a 4f 44 2b 68 35 52 4c 73 6b 7a 36 34 58 71 35 4e 6d 69 7a 6a 67 31 71 6a 4d 46 69 4f 74 4e 6e 70 68 73 35 4f 6f 7a 56 56 4b 59 5a 74 45 46 4d 53 4c 58 54 4b 72 71 66 57 51 33 50 2f 70 63 32 4b 70 2b 6b 77 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: 0egRUQz2XEu5LVEm.2Context: 3025faa8feb4ff6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcI8tSkUggDeYwQ1xvgCEcdQ3D3TX1CpgVunPfTytlzOD+h5RLskz64Xq5Nmizjg1qjMFiOtNnphs5OozVVKYZtEFMSLXTKrqfWQ3P/pc2Kp+kw
2025-01-10 06:50:07 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 30 65 67 52 55 51 7a 32 58 45 75 35 4c 56 45 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 32 35 66 61 61 38 66 65 62 34 66 66 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: 0egRUQz2XEu5LVEm.3Context: 3025faa8feb4ff6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-10 06:50:07 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-10 06:50:07 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 36 34 61 4c 74 4f 37 74 55 61 79 38 58 64 43 52 6d 31 44 6d 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: b64aLtO7tUay8XdCRm1DmQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49736	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 06:50:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 35 5a 35 44 51 61 36 6a 4e 45 47 59 41 2f 69 65 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 37 34 64 63 33 61 32 34 64 31 65 66 39 36 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 5Z5DQa6jNEGYA/ie.1Context: 174dc3a24d1ef96e
2025-01-10 06:50:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-10 06:50:14 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 35 5a 35 44 51 61 36 6a 4e 45 47 59 41 2f 69 65 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 37 34 64 63 33 61 32 34 64 31 65 66 39 36 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 49 38 74 53 6b 55 67 67 44 65 59 77 51 31 78 76 67 43 45 63 64 51 33 44 33 54 58 31 43 70 67 56 75 6e 50 66 54 79 74 6c 7a 4f 44 2b 68 35 52 4c 73 6b 7a 36 34 58 71 35 4e 6d 69 7a 6a 67 31 71 6a 4d 46 69 4f 74 4e 6e 70 68 73 35 4f 6f 7a 56 56 4b 59 5a 74 45 46 4d 53 4c 58 54 4b 72 71 66 57 51 33 50 2f 70 63 32 4b 70 2b 6b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 5Z5DQa6jNEGYA/ie.2Context: 174dc3a24d1ef96e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcI8tSkUggDeYwQ1xvgCEcdQ3D3TX1CpgVunPfTytlzOD+h5RLskz64Xq5Nmizjg1qjMFiOtNnphs5OozVVKYZtEFMSLXTKrqfWQ3P/pc2Kp+k
2025-01-10 06:50:14 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 35 5a 35 44 51 61 36 6a 4e 45 47 59 41 2f 69 65 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 37 34 64 63 33 61 32 34 64 31 65 66 39 36 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 5Z5DQa6jNEGYA/ie.3Context: 174dc3a24d1ef96e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-10 06:50:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-10 06:50:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 42 79 48 42 71 6e 62 31 6f 45 71 77 51 33 39 41 7a 35 51 46 43 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ByHBqnb1oEqwQ39Az5QFCA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49808	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 06:50:27 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 65 66 46 63 4f 47 54 62 55 2b 33 4c 78 4d 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 65 64 30 39 39 62 31 38 37 30 64 39 34 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: HefFcOGTbU+3LxMS.1Context: 2eed099b1870d94f
2025-01-10 06:50:27 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-10 06:50:27 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 48 65 66 46 63 4f 47 54 62 55 2b 33 4c 78 4d 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 65 64 30 39 39 62 31 38 37 30 64 39 34 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 49 38 74 53 6b 55 67 67 44 65 59 77 51 31 78 76 67 43 45 63 64 51 33 44 33 54 58 31 43 70 67 56 75 6e 50 66 54 79 74 6c 7a 4f 44 2b 68 35 52 4c 73 6b 7a 36 34 58 71 35 4e 6d 69 7a 6a 67 31 71 6a 4d 46 69 4f 74 4e 6e 70 68 73 35 4f 6f 7a 56 56 4b 59 5a 74 45 46 4d 53 4c 58 54 4b 72 71 66 57 51 33 50 2f 70 63 32 4b 70 2b 6b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: HefFcOGTbU+3LxMS.2Context: 2eed099b1870d94f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcI8tSkUggDeYwQ1xvgCEcdQ3D3TX1CpgVunPfTytlzOD+h5RLskz64Xq5Nmizjg1qjMFiOtNnphs5OozVVKYZtEFMSLXTKrqfWQ3P/pc2Kp+k
2025-01-10 06:50:27 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 48 65 66 46 63 4f 47 54 62 55 2b 33 4c 78 4d 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 65 64 30 39 39 62 31 38 37 30 64 39 34 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: HefFcOGTbU+3LxMS.3Context: 2eed099b1870d94f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-10 06:50:27 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-10 06:50:27 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 2f 41 57 6b 31 79 76 38 30 75 41 4a 66 59 73 56 69 50 32 38 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: L/AWk1yv80uAJfYsViP28w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49925	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 06:50:45 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 33 44 52 71 70 58 73 67 6e 6b 4b 6e 41 42 38 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 65 62 38 35 30 35 61 37 39 66 37 34 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: 3DRqpXsgnkKnAB8r.1Context: 51eb8505a79f746
2025-01-10 06:50:45 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-10 06:50:45 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 33 44 52 71 70 58 73 67 6e 6b 4b 6e 41 42 38 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 65 62 38 35 30 35 61 37 39 66 37 34 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 49 38 74 53 6b 55 67 67 44 65 59 77 51 31 78 76 67 43 45 63 64 51 33 44 33 54 58 31 43 70 67 56 75 6e 50 66 54 79 74 6c 7a 4f 44 2b 68 35 52 4c 73 6b 7a 36 34 58 71 35 4e 6d 69 7a 6a 67 31 71 6a 4d 46 69 4f 74 4e 6e 70 68 73 35 4f 6f 7a 56 56 4b 59 5a 74 45 46 4d 53 4c 58 54 4b 72 71 66 57 51 33 50 2f 70 63 32 4b 70 2b 6b 77 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: 3DRqpXsgnkKnAB8r.2Context: 51eb8505a79f746<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcI8tSkUggDeYwQ1xvgCEcdQ3D3TX1CpgVunPfTytlzOD+h5RLskz64Xq5Nmizjg1qjMFiOtNnphs5OozVVKYZtEFMSLXTKrqfWQ3P/pc2Kp+kw
2025-01-10 06:50:45 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 33 44 52 71 70 58 73 67 6e 6b 4b 6e 41 42 38 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 65 62 38 35 30 35 61 37 39 66 37 34 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: 3DRqpXsgnkKnAB8r.3Context: 51eb8505a79f746<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-10 06:50:45 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-10 06:50:45 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4e 53 52 79 7a 31 59 51 4c 55 2b 6f 47 4f 38 6e 47 4c 7a 4e 52 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: NSRyz1YQLU+oGO8nGLzNRw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49988	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 06:51:09 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 6e 61 67 58 4a 4d 4d 6b 46 55 65 56 74 6f 39 33 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 66 61 35 62 65 31 62 34 62 35 66 31 39 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: nagXJMMkFUeVto93.1Context: 5fa5be1b4b5f199
2025-01-10 06:51:09 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-10 06:51:09 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 6e 61 67 58 4a 4d 4d 6b 46 55 65 56 74 6f 39 33 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 66 61 35 62 65 31 62 34 62 35 66 31 39 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 49 38 74 53 6b 55 67 67 44 65 59 77 51 31 78 76 67 43 45 63 64 51 33 44 33 54 58 31 43 70 67 56 75 6e 50 66 54 79 74 6c 7a 4f 44 2b 68 35 52 4c 73 6b 7a 36 34 58 71 35 4e 6d 69 7a 6a 67 31 71 6a 4d 46 69 4f 74 4e 6e 70 68 73 35 4f 6f 7a 56 56 4b 59 5a 74 45 46 4d 53 4c 58 54 4b 72 71 66 57 51 33 50 2f 70 63 32 4b 70 2b 6b 77 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: nagXJMMkFUeVto93.2Context: 5fa5be1b4b5f199<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcI8tSkUggDeYwQ1xvgCEcdQ3D3TX1CpgVunPfTytlzOD+h5RLskz64Xq5Nmizjg1qjMFiOtNnphs5OozVVKYZtEFMSLXTKrqfWQ3P/pc2Kp+kw
2025-01-10 06:51:09 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 6e 61 67 58 4a 4d 4d 6b 46 55 65 56 74 6f 39 33 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 66 61 35 62 65 31 62 34 62 35 66 31 39 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: nagXJMMkFUeVto93.3Context: 5fa5be1b4b5f199<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-10 06:51:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-10 06:51:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 63 37 5a 34 34 48 32 75 4e 6b 53 6a 63 4f 33 77 35 46 6b 42 70 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: c7Z44H2uNkSjcO3w5FkBpw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49989	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 06:51:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 77 6a 2b 57 35 56 4b 54 6b 65 45 41 53 6d 33 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 63 34 31 62 63 39 63 33 64 61 39 62 33 37 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mwj+W5VKTkeEASm3.1Context: bc41bc9c3da9b371
2025-01-10 06:51:41 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-10 06:51:41 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 77 6a 2b 57 35 56 4b 54 6b 65 45 41 53 6d 33 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 63 34 31 62 63 39 63 33 64 61 39 62 33 37 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 49 38 74 53 6b 55 67 67 44 65 59 77 51 31 78 76 67 43 45 63 64 51 33 44 33 54 58 31 43 70 67 56 75 6e 50 66 54 79 74 6c 7a 4f 44 2b 68 35 52 4c 73 6b 7a 36 34 58 71 35 4e 6d 69 7a 6a 67 31 71 6a 4d 46 69 4f 74 4e 6e 70 68 73 35 4f 6f 7a 56 56 4b 59 5a 74 45 46 4d 53 4c 58 54 4b 72 71 66 57 51 33 50 2f 70 63 32 4b 70 2b 6b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: mwj+W5VKTkeEASm3.2Context: bc41bc9c3da9b371<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcI8tSkUggDeYwQ1xvgCEcdQ3D3TX1CpgVunPfTytlzOD+h5RLskz64Xq5Nmizjg1qjMFiOtNnphs5OozVVKYZtEFMSLXTKrqfWQ3P/pc2Kp+k
2025-01-10 06:51:41 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 77 6a 2b 57 35 56 4b 54 6b 65 45 41 53 6d 33 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 63 34 31 62 63 39 63 33 64 61 39 62 33 37 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: mwj+W5VKTkeEASm3.3Context: bc41bc9c3da9b371<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-10 06:51:41 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-10 06:51:41 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2b 2f 46 39 67 58 30 2b 67 45 6d 30 78 4d 72 31 56 64 79 49 70 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: +/F9gX0+gEm0xMr1VdyIpg.0Payload parsing failed.

Analysis Process: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exePID: 6220, Parent PID: 4004

General

Target ID:	0
Start time:	01:50:10
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe"
Imagebase:	0xc60000
File size:	48'640 bytes
MD5 hash:	91D66CB0C8827D4910CCFCBC47C47341
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2547808998.00000000030D5000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2549612060.000000001BA44000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000000.2204241936.0000000000C62000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2549225816.000000001B809000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2549225816.000000001B7D0000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts, Description: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc., Source: 00000000.00000002.2550355256.000000001CA00000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2547482160.0000000001255000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000000.00000002.2547808998.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2547808998.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000000.00000002.2547808998.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2547808998.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:50:43
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp9468.tmp.bat""
Imagebase:	0x7ff7538d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:50:43
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:50:43
Start date:	10/01/2025
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 3
Imagebase:	0x7ff6e1d60000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exePID: 6220, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	19.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD3489C07F Relevance: 13.0, Strings: 9, Instructions: 1711
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0ox4, xrefs: 00007FFD3489CA99
0ox4, xrefs: 00007FFD3489C20F
HAx4, xrefs: 00007FFD3489D031
0ox4, xrefs: 00007FFD3489C10F
HAx4, xrefs: 00007FFD3489CFEF
0ox4, xrefs: 00007FFD3489C98D
0ox4, xrefs: 00007FFD3489CD05
0ox4, xrefs: 00007FFD3489C8AB
0ox4, xrefs: 00007FFD3489CBD0

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID: 0ox4$0ox4$0ox4$0ox4$0ox4$0ox4$0ox4$HAx4$HAx4
API String ID: 0-630351626
Opcode ID: 3591842321db90a843528874145976763fa4096488f4af0fd62eb2752c5fd7af
Instruction ID: 3de8c1dd9f42adb6e6d2c708c4fcf5d545556869037a44ba61a7a7b3d0a4b106
Opcode Fuzzy Hash: 3591842321db90a843528874145976763fa4096488f4af0fd62eb2752c5fd7af
Instruction Fuzzy Hash: 6AB2E321B1CD4A4BEB68EB6884A567977D2FFAA310F14417AD50EC32D7DE3CB8429341

Function 00007FFD348A0030 Relevance: 4.4, Strings: 1, Instructions: 3128COMMON

Download Yara Rule

Strings

2L_H, xrefs: 00007FFD348BF273

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID: 2L_H
API String ID: 0-1203901355
Opcode ID: 5d7a44434a5ecc10e9476eed8f7366e0a38852b8e0780dd500def0511a563595
Instruction ID: ed2ef9acd82c90fa9093c0f8be7ac86136e79bfff43ae2abe92e32932ccac9f5
Opcode Fuzzy Hash: 5d7a44434a5ecc10e9476eed8f7366e0a38852b8e0780dd500def0511a563595
Instruction Fuzzy Hash: 0933407061CB858FD7B9DB58C4A5AAAB3E1FF99304F10457ED58DC3291CE38A841DB82

Function 00007FFD348ADD50 Relevance: 3.3, Strings: 2, Instructions: 776
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(gw4, xrefs: 00007FFD348AE2B7
]M_H, xrefs: 00007FFD348ADEC3

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID: (gw4$]M_H
API String ID: 0-2204827320
Opcode ID: 13640ee1d5f28d2fc7d3df991a0d99c345eadcda3af3f525dd69193b38c426ab
Instruction ID: 3cf3055dc412dfa4fb516c8ab7f0503bab1013329c695c72b737c82dc68f0bd2
Opcode Fuzzy Hash: 13640ee1d5f28d2fc7d3df991a0d99c345eadcda3af3f525dd69193b38c426ab
Instruction Fuzzy Hash: 8332D031B1DA498FEBD4EB1C84A4AB977E2FF99310F0405BAE54DC3296DE68EC418750

Function 00007FFD3489F7E8 Relevance: 3.1, Strings: 2, Instructions: 568
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

m, xrefs: 00007FFD348D22ED
(, xrefs: 00007FFD348D2764

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID: ($m
API String ID: 0-200552969
Opcode ID: 54dc49c2ffa6c83d8a3e0d3b069e2b47af363ddc21ef994a3c4085e78781f642
Instruction ID: c2d0ac6e0b984bc93106af3e3e845ca83ae9ccf4b521e229ea332ba676ff56ec
Opcode Fuzzy Hash: 54dc49c2ffa6c83d8a3e0d3b069e2b47af363ddc21ef994a3c4085e78781f642
Instruction Fuzzy Hash: B512C371A096498FE799DF58C8A57A9B7F5FF5A304F1402BEE14DD3282CE386D818B01

Function 00007FFD3489FBED Relevance: 3.0, Strings: 2, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 00007FFD3489FF39
KN_I, xrefs: 00007FFD3489FC04

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID: KN_I$_
API String ID: 0-3582441820
Opcode ID: 5f75394f6ed75ba0b89a0f918f769c5059ecf7ec7b1af52d9e5613d2c7d2b848
Instruction ID: 1a915d948c8656e5eee2d99c1eb94196d0180fa7a6dd52ab73e283de953df078
Opcode Fuzzy Hash: 5f75394f6ed75ba0b89a0f918f769c5059ecf7ec7b1af52d9e5613d2c7d2b848
Instruction Fuzzy Hash: 38C1D417B0C9A22BD221B7FDB9751EE6F64DF82375B0C51B7D388CE0939968604A83D1

Function 00007FFD348930E5 Relevance: 1.8, Strings: 1, Instructions: 597
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,, xrefs: 00007FFD3489321A

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 4375bf40cb37aa039478a99af1f469e2c6696b046f5576d697bef8e1a0da9f67
Instruction ID: df3129606738e580d880c66ac32c2899af0d372cc104e1d258cf60b45c8e239b
Opcode Fuzzy Hash: 4375bf40cb37aa039478a99af1f469e2c6696b046f5576d697bef8e1a0da9f67
Instruction Fuzzy Hash: 1612A431B189094FEBA9EBA890B97B977E2FF99310F544579D10EC32D6CE38B8419740

Function 00007FFD3489DBCD Relevance: 1.6, Strings: 1, Instructions: 373COMMON

Download Yara Rule

Strings

cx4, xrefs: 00007FFD3489DC9C

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID: cx4
API String ID: 0-2812048196
Opcode ID: ecaff48f2ec9c81111901a0c81ffbe66c3d7d16c70da93a7c533fb8a044ad5ff
Instruction ID: aa5eefe6f012125ee5793ea4dbe367e45644666dc1f06c89338d116e23206c35
Opcode Fuzzy Hash: ecaff48f2ec9c81111901a0c81ffbe66c3d7d16c70da93a7c533fb8a044ad5ff
Instruction Fuzzy Hash: 7CB102B1B1CE454FE758AB2CA4AAA7577D1FB99314F1441BFE00DC3293CE78A8428785

Function 00007FFD34898386 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415c8d1ad4df0350d99da2dfb5fd843befa171689eacd69d140cacad05d3cd3d
Instruction ID: 944ecf15f967819251a7ec09717e4d8d473285bae6fcf6517405f59245f71daa
Opcode Fuzzy Hash: 415c8d1ad4df0350d99da2dfb5fd843befa171689eacd69d140cacad05d3cd3d
Instruction Fuzzy Hash: 71F1B630618A4E4FEBA8DF28C8557E93BD1FF55310F04466EE84DC7291DF38A9458B81

Function 00007FFD34899132 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b443697e48e48b0c720ab3dc62d2c9be5bf8d881cdaae71b1ea6ef610d1637
Instruction ID: 0f71daec099cf8dae05a145e2b7880c9b885aaf3faa0026d63de5a47fc9cd4da
Opcode Fuzzy Hash: 47b443697e48e48b0c720ab3dc62d2c9be5bf8d881cdaae71b1ea6ef610d1637
Instruction Fuzzy Hash: 39E1B330A08A4D8FEBA8DF68C8A57E97BD1FF55310F14426ED84DC7291DF78A8458B81

Function 00007FFD348929E1 Relevance: 1.7, APIs: 1, Instructions: 152
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FFD34892ABF

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1a196631940a4bae2531828ede2e41cde21a680fe4b99d3795823b529cd5bd2b
Instruction ID: a1f56cc46507e6496a58427b5530098288f8a740dd67ae2db608ae20cfbb83ce
Opcode Fuzzy Hash: 1a196631940a4bae2531828ede2e41cde21a680fe4b99d3795823b529cd5bd2b
Instruction Fuzzy Hash: AD417030A08A1C8FDB98DF98D855BEDBBF1FF59310F04416AD00DE7252CA74A841CB81

Function 00007FFD34892D3D Relevance: 1.6, APIs: 1, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FFD34892E1A

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 06ad9c73f0f076ba985471d766b351fa6ef99261366bd6d9685496225cceba80
Instruction ID: 254687449dca2a130905e6683fa57efa087d8dda243d4ff3913895c6bce2893c
Opcode Fuzzy Hash: 06ad9c73f0f076ba985471d766b351fa6ef99261366bd6d9685496225cceba80
Instruction Fuzzy Hash: 5041E83190DB884FDB199BA898566AD7FE0EF57321F0442AFD089D3192CA746406C792

Non-executed Functions

Function 00007FFD3489FCFA Relevance: 1.6, Strings: 1, Instructions: 342COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD3489FF39

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 69ecba1798962e10200a74d9f20b8500630558ef44cd9d30978880b09c8c97bb
Instruction ID: afd6d6102e11d4644f2e71296de6de1722f93fc87db5a31dbd3ad5a50d411846
Opcode Fuzzy Hash: 69ecba1798962e10200a74d9f20b8500630558ef44cd9d30978880b09c8c97bb
Instruction Fuzzy Hash: 7D91D027B0C57266D221B7FDB9711EE6B68DF82375B085177D38CCE0839968708A83E5

Function 00007FFD34897E89 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b435cf96d3127be79d0c478933bc510baae663e5944baf3690aff5284bfc3a2f
Instruction ID: 43072e6de3266eba63ec97ab23947dde8db927d799bd2e7f237174cdd08c75a7
Opcode Fuzzy Hash: b435cf96d3127be79d0c478933bc510baae663e5944baf3690aff5284bfc3a2f
Instruction Fuzzy Hash: 71D19630A18A8E8FEB68DF28D8557E97BD1FF55310F04426EE84DC7291CF78A9458782

Function 00007FFD3489773D Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2550971191.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dff45d1a2dd3e4ad45db28c440501f08e3244019755081036cc3a3bb526e538
Instruction ID: d4ca095652411d0777b0deb3348278c580a7f1f9286450f54af8cb8d54d0370c
Opcode Fuzzy Hash: 9dff45d1a2dd3e4ad45db28c440501f08e3244019755081036cc3a3bb526e538
Instruction Fuzzy Hash: ECD1B130A0CB4C8FDB59EBA8D855BEDBBB1FF56310F1442AAD04DD7292DA346845CB81

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe.log

C:\Users\user\AppData\Local\Temp\tmp9468.tmp.bat

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe

Function 00007FFD3489C07F Relevance: 13.0, Strings: 9, Instructions: 1711
COMMON

Function 00007FFD348ADD50 Relevance: 3.3, Strings: 2, Instructions: 776
COMMON

Function 00007FFD3489F7E8 Relevance: 3.1, Strings: 2, Instructions: 568
COMMON

Function 00007FFD3489FBED Relevance: 3.0, Strings: 2, Instructions: 468
COMMON

Function 00007FFD348930E5 Relevance: 1.8, Strings: 1, Instructions: 597
COMMON

Function 00007FFD348929E1 Relevance: 1.7, APIs: 1, Instructions: 152
libraryCOMMON