Edit tour

Windows Analysis Report
Client-base.exe

Overview

General Information

Sample name:	Client-base.exe
Analysis ID:	1589885
MD5:	21ce4cd2ce246c86222b57b93cdc92bd
SHA1:	9dc24ad846b2d9db64e5bbea1977e23bb185d224
SHA256:	273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678
Tags:	exeQuasarRATuser-lontze7
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Quasar

Yara detected Quasar RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to detect virtual machines (STR)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Client-base.exe (PID: 7656 cmdline: "C:\Users\user\Desktop\Client-base.exe" MD5: 21CE4CD2CE246C86222B57B93CDC92BD)

schtasks.exe (PID: 7692 cmdline: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "0.tcp.in.ngrok.io:14296;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "cc827307-beb6-456e-b5dd-e28a204ebd45", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "UttNOaKsKDg70omGHo4AsuQEXKeY3dl8vAUSpKFRZYMXV8mJMcjm3tK0+AUvP8CLA8fMsyrca0pr45n8jpe7mMyZtt8aKdOsPgGoyiMGPdBtjfNJlmMpnuceLr9e7q7ZMOLh/eIc5q3V2H62ck15qbR/m8Kn14gpz1Pju38Aha92WfC/QPzC4RYw7l7ejIBbo4TmrExWkFP3zyO3hbQSzRMj7CcOD2wui8eo911eXgc6R/KawJSzhP6OT4Jgx7N4JP1pjp7P1gSL/0wBDll4v1IxF2aMCR/oUmJbHs7VJEd5TGjBMX+PR4PzQ5AbpY7qsI6Je5Yceqn632ILvCKRh41P3Nkzhwx64ysMZN7tjbJzdQCTrhkEf8n+mv8AXYvZJKOOg/DTxmFvA2l1KZQerD3IRgL6fb9+asWQx5fnh19bjLYVPpEKm513YNivbM7A/SW1RuBH5d4CDyOF6lzsTrJBzXAWeExSoK5+tlbFfkFzKYlMgJ2PaTbDn8H1FB4C4l15qczu6d13SH2AOEwaR8GJ+vgKsP3pcr/pmmFKKTzpRzGd6I7jLYb62pkilMY1nmaJozSEHB2TPl5PHJ/m/myrQnHyFqjSYNmu1hfKcghjawJYYysjEdryCelP6QNshVOseOxNjS37XJbGupZrqI5Rz7WzRBdTKly4qm5nsoI=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAMxfBX+smdsAfQ2MTkA3AzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI1MDEwODA2MzgyM1oYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgkbNY1LVv9u7h7z9z5GVPBj3RPZFSFM508n7rYtnCetb+P14nmuMvcnJvXuMIOjOx1kgmpuPTUewHGVn7pJw1o1pG79brIvmQH4oGiOCSoD9mMVV3a950AGssOR9+WUGouFAxwx33XlnPSinfsfmu36Cs9VG56i/u4SNVT9UOQ4H+rMEm5wM103CPkI0mvBAcWGTa8k8hKogtv47fGEorxONA1aAEqCH0KLuRrjyE39S6hwkkaOIoxsx+CkijZqO1jYPb8eHt0j/igFmcUsWQg2tsobvO3A8LQecam9rnv59T+XwqiHVGjo+bIj+f1nHGvFFlK+siFgZMr5dKmfC4RJENoUpDq8wG207Z3IubS0YoeFFrvHiTISMI2drIgHIUgv/ag7QM/D1ZrsPEIIPrFXpsFj6AdEd4ASGlcqq4EdG++x4Wk0dn3dccLldgMyBupA5xxaR5UW0+Ui2IJxsHzwZ+jN/lBVSo7YtTqzO0zKNEYGUDFwjGTQW+/UUgnoKR3Ay/e9bmZjJi1HDYhhs4cdSdfZYSzHxege7pQ77ETqtjntM2zxO8cK++eNhF5IVWAuEZW/vJJT+GGLsp33G7GdlI/CDsG5jjYpmpx9Qmm2LrotxUjdYTsFqGIHFj7aavYx2dDxoqtmpvtIc6OK8H4BJ5ram5DOxv/Us2YV52B0CAwEAAaMyMDAwHQYDVR0OBBYEFI8d/ymL2iqzZUnX3BkP+yKmp+HAMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBACIHuZBrj9xrtlDOq1bBzlybW3n0OM0RJrie7i/CYMZjGIowAk544fqWIJaQbMh/+CdGjZtjRpT0X6mn3C+exp0hJtO3koUW8oLhVy9VILhD7FWuxv2SFICMJG5s2NJKN/LmJXJRh7Ch9oeNLiBYvAFY9Ul1X//HIipbH/2iQbTP0dVQ7XpKP4fhdePEjhm1aetci6g8cNNI8Uhw3UdYltMSrRnAJ774rI9lVDYoPb/dHm4j6oL7bmf7SSvMQ4bOQopEk7C18e3cTZUpBghrDWNiAuJBYOitVEM4NOiS2fIHx9qAuatq5Z/ZCL+0qU1ocPT6dEGRPzmrD7LjFokR5CaESZi0I88thqj6+U3fnlhhhquZqBIL3WvGCZz5l+vPosUr0WXhi78wcknMP0/CV1UOxuVBTrgjGwXCq5IPpAyvffNxVzYgaf4w86QcTHpsQayCslWgV/olIWa4M5RKIa8PR3x4k4Fhky/KK4zuqleSqpnYumeMUNmJq/MIbsMDQ1LNlRYUypl2P+R03lpEdArdQ0SQpbyUd7VYf0sMRVky7jihP3ctGast/aVM0v87q61eE5VpJavQtQ8wkB3v7mKkEZ5E9dbD6uDFY2qz00NaN3CyiQ0rt/O/nn/U27DWvXJNvz+W0/AHzOV36+3x3/khg7regzagkapHeKS+dlYM"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Client-base.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Client-base.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Client-base.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed7:$x1: Quasar.Common.Messages 0x29f200:$x1: Quasar.Common.Messages 0x2ab812:$x4: Uninstalling... good bye :-( 0x2ad007:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
Client-base.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadc4:$f1: FileZilla\recentservers.xml 0x2aae04:$f2: FileZilla\sitemanager.xml 0x2aae46:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab092:$b1: Chrome\User Data\ 0x2ab0e8:$b1: Chrome\User Data\ 0x2ab3c0:$b2: Mozilla\Firefox\Profiles 0x2ab4bc:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd440:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab614:$b4: Opera Software\Opera Stable\Login Data 0x2ab6ce:$b5: YandexBrowser\User Data\ 0x2ab73c:$b5: YandexBrowser\User Data\ 0x2ab410:$s4: logins.json 0x2ab146:$a1: username_value 0x2ab164:$a2: password_value 0x2ab450:$a3: encryptedUsername 0x2fd384:$a3: encryptedUsername 0x2ab474:$a4: encryptedPassword 0x2fd3a2:$a4: encryptedPassword 0x2fd320:$a5: httpRealm
Client-base.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8fc:$s3: Process already elevated. 0x28ebd6:$s4: get_PotentiallyVulnerablePasswords 0x278c92:$s5: GetKeyloggerLogsDirectory 0x29e95f:$s5: GetKeyloggerLogsDirectory 0x28ebf9:$s6: set_PotentiallyVulnerablePasswords 0x2fea6e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1775574902.000002140D1E0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000000.1758259602.0000000000820000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.1775347331.000000207E7F9000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.1775529562.000002140CEF0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.1775529562.000002140CEF8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.1775574902.000002140D1E5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.4214131861.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000000.1757918698.0000000000502000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Client-base.exe PID: 7656	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: schtasks.exe PID: 7692	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Client-base.exe.500000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.0.Client-base.exe.500000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.Client-base.exe.500000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed7:$x1: Quasar.Common.Messages 0x29f200:$x1: Quasar.Common.Messages 0x2ab812:$x4: Uninstalling... good bye :-( 0x2ad007:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.0.Client-base.exe.500000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadc4:$f1: FileZilla\recentservers.xml 0x2aae04:$f2: FileZilla\sitemanager.xml 0x2aae46:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab092:$b1: Chrome\User Data\ 0x2ab0e8:$b1: Chrome\User Data\ 0x2ab3c0:$b2: Mozilla\Firefox\Profiles 0x2ab4bc:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd440:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab614:$b4: Opera Software\Opera Stable\Login Data 0x2ab6ce:$b5: YandexBrowser\User Data\ 0x2ab73c:$b5: YandexBrowser\User Data\ 0x2ab410:$s4: logins.json 0x2ab146:$a1: username_value 0x2ab164:$a2: password_value 0x2ab450:$a3: encryptedUsername 0x2fd384:$a3: encryptedUsername 0x2ab474:$a4: encryptedPassword 0x2fd3a2:$a4: encryptedPassword 0x2fd320:$a5: httpRealm
0.0.Client-base.exe.500000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8fc:$s3: Process already elevated. 0x28ebd6:$s4: get_PotentiallyVulnerablePasswords 0x278c92:$s5: GetKeyloggerLogsDirectory 0x29e95f:$s5: GetKeyloggerLogsDirectory 0x28ebf9:$s6: set_PotentiallyVulnerablePasswords 0x2fea6e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Sigma Signatures

AV Detection

Sigma detected: Quasar

Source: Process started

Author: Joe Security: Data: Command: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Client-base.exe", ParentImage: C:\Users\user\Desktop\Client-base.exe, ParentProcessId: 7656, ParentProcessName: Client-base.exe, ProcessCommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, ProcessId: 7692, ProcessName: schtasks.exe

E-Banking Fraud

Sigma detected: Quasar

Source: Process started

System Summary

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Client-base.exe", ParentImage: C:\Users\user\Desktop\Client-base.exe, ParentProcessId: 7656, ParentProcessName: Client-base.exe, ProcessCommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, ProcessId: 7692, ProcessName: schtasks.exe

Stealing of Sensitive Information

Sigma detected: Quasar

Source: Process started

Remote Access Functionality

Sigma detected: Quasar

Source: Process started

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Client-base.exe

Avira: detected

Antivirus detection for URL or domain

Source: 0.tcp.in.ngrok.io

Avira URL Cloud: Label: malware

Found malware configuration

Source: Client-base.exe

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "0.tcp.in.ngrok.io:14296;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "cc827307-beb6-456e-b5dd-e28a204ebd45", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "UttNOaKsKDg70omGHo4AsuQEXKeY3dl8vAUSpKFRZYMXV8mJMcjm3tK0+AUvP8CLA8fMsyrca0pr45n8jpe7mMyZtt8aKdOsPgGoyiMGPdBtjfNJlmMpnuceLr9e7q7ZMOLh/eIc5q3V2H62ck15qbR/m8Kn14gpz1Pju38Aha92WfC/QPzC4RYw7l7ejIBbo4TmrExWkFP3zyO3hbQSzRMj7CcOD2wui8eo911eXgc6R/KawJSzhP6OT4Jgx7N4JP1pjp7P1gSL/0wBDll4v1IxF2aMCR/oUmJbHs7VJEd5TGjBMX+PR4PzQ5AbpY7qsI6Je5Yceqn632ILvCKRh41P3Nkzhwx64ysMZN7tjbJzdQCTrhkEf8n+mv8AXYvZJKOOg/DTxmFvA2l1KZQerD3IRgL6fb9+asWQx5fnh19bjLYVPpEKm513YNivbM7A/SW1RuBH5d4CDyOF6lzsTrJBzXAWeExSoK5+tlbFfkFzKYlMgJ2PaTbDn8H1FB4C4l15qczu6d13SH2AOEwaR8GJ+vgKsP3pcr/pmmFKKTzpRzGd6I7jLYb62pkilMY1nmaJozSEHB2TPl5PHJ/m/myrQnHyFqjSYNmu1hfKcghjawJYYysjEdryCelP6QNshVOseOxNjS37XJbGupZrqI5Rz7WzRBdTKly4qm5nsoI=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAMxfBX+smdsAfQ2MTkA3AzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI1MDEwODA2MzgyM1oYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgkbNY1LVv9u7h7z9z5GVPBj3RPZFSFM508n7rYtnCetb+P14nmuMvcnJvXuMIOjOx1kgmpuPTUewHGVn7pJw1o1pG79brIvmQH4oGiOCSoD9mMVV3a950AGssOR9+WUGouFAxwx33XlnPSinfsfmu36Cs9VG56i/u4SNVT9UOQ4H+rMEm5wM103CPkI0mvBAcWGTa8k8hKogtv47fGEorxONA1aAEqCH0KLuRrjyE39S6hwkkaOIoxsx+CkijZqO1jYPb8eHt0j/igFmcUsWQg2tsobvO3A8LQecam9rnv59T+XwqiHVGjo+bIj+f1nHGvFFlK+siFgZMr5dKmfC4RJENoUpDq8wG207Z3IubS0YoeFFrvHiTISMI2drIgHIUgv/ag7QM/D1ZrsPEIIPrFXpsFj6AdEd4ASGlcqq4EdG++x4Wk0dn3dccLldgMyBupA5xxaR5UW0+Ui2IJxsHzwZ+jN/lBVSo7YtTqzO0zKNEYGUDFwjGTQW+/UUgnoKR3Ay/e9bmZjJi1HDYhhs4cdSdfZYSzHxege7pQ77ETqtjntM2zxO8cK++eNhF5IVWAuEZW/vJJT+GGLsp33G7GdlI/CDsG5jjYpmpx9Qmm2LrotxUjdYTsFqGIHFj7aavYx2dDxoqtmpvtIc6OK8H4BJ5ram5DOxv/Us2YV52B0CAwEAAaMyMDAwHQYDVR0OBBYEFI8d/ymL2iqzZUnX3BkP+yKmp+HAMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBACIHuZBrj9xrtlDOq1bBzlybW3n0OM0RJrie7i/CYMZjGIowAk544fqWIJaQbMh/+CdGjZtjRpT0X6mn3C+exp0hJtO3koUW8oLhVy9VILhD7FWuxv2SFICMJG5s2NJKN/LmJXJRh7Ch9oeNLiBYvAFY9Ul1X//HIipbH/2iQbTP0dVQ7XpKP4fhdePEjhm1aetci6g8cNNI8Uhw3UdYltMSrRnAJ774rI9lVDYoPb/dHm4j6oL7bmf7SSvMQ4bOQopEk7C18e3cTZUpBghrDWNiAuJBYOitVEM4NOiS2fIHx9qAuatq5Z/ZCL+0qU1ocPT6dEGRPzmrD7LjFokR5CaESZi0I88thqj6+U3fnlhhhquZqBIL3WvGCZz5l+vPosUr0WXhi78wcknMP0/CV1UOxuVBTrgjGwXCq5IPpAyvffNxVzYgaf4w86QcTHpsQayCslWgV/olIWa4M5RKIa8PR3x4k4Fhky/KK4zuqleSqpnYumeMUNmJq/MIbsMDQ1LNlRYUypl2P+R03lpEdArdQ0SQpbyUd7VYf0sMRVky7jihP3ctGast/aVM0v87q61eE5VpJavQtQ8wkB3v7mKkEZ5E9dbD6uDFY2qz00NaN3CyiQ0rt/O/nn/U27DWvXJNvz+W0/AHzOV36+3x3/khg7regzagkapHeKS+dlYM"}

Multi AV Scanner detection for submitted file

Source: Client-base.exe	Virustotal: Detection: 75%			Perma Link
Source: Client-base.exe	ReversingLabs: Detection: 76%

Yara detected Quasar RAT

Source: Yara match	File source: Client-base.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Client-base.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1775574902.000002140D1E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1758259602.0000000000820000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775347331.000000207E7F9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775529562.000002140CEF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775529562.000002140CEF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775574902.000002140D1E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4214131861.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1757918698.0000000000502000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-base.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 7692, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Client-base.exe

Joe Sandbox ML: detected

Source: Client-base.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Client-base.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 0.tcp.in.ngrok.io

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 3.6.231.193 ports 14296,1,2,4,6,9
Source: global traffic	TCP traffic: 13.202.226.61 ports 14296,1,2,4,6,9

Yara detected Generic Downloader

Source: Yara match	File source: Client-base.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Client-base.exe.500000.0.unpack, type: UNPACKEDPE

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 3.6.231.193:14296
Source: global traffic	TCP traffic: 192.168.2.4:49834 -> 13.202.226.61:14296

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: ATT-INTERNET4US ATT-INTERNET4US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 0.tcp.in.ngrok.io

Source: Client-base.exe, 00000000.00000002.4214131861.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Client-base.exe	String found in binary or memory: https://api.ipify.org/
Source: Client-base.exe	String found in binary or memory: https://ipwho.is/
Source: Client-base.exe	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Client-base.exe	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Client-base.exe	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Client-base.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Client-base.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: Client-base.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Client-base.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1775574902.000002140D1E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1758259602.0000000000820000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775347331.000000207E7F9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775529562.000002140CEF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775529562.000002140CEF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775574902.000002140D1E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4214131861.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1757918698.0000000000502000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-base.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 7692, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: Client-base.exe, type: SAMPLE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: Client-base.exe, type: SAMPLE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: Client-base.exe, type: SAMPLE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.0.Client-base.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.Client-base.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.Client-base.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen

Source: C:\Users\user\Desktop\Client-base.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Client-base.exe	Code function: 0_2_00007FFD9B701867	0_2_00007FFD9B701867
Source: C:\Users\user\Desktop\Client-base.exe	Code function: 0_2_00007FFD9B96AFDD	0_2_00007FFD9B96AFDD
Source: C:\Users\user\Desktop\Client-base.exe	Code function: 0_2_00007FFD9B969BD1	0_2_00007FFD9B969BD1
Source: C:\Users\user\Desktop\Client-base.exe	Code function: 0_2_00007FFD9B9655D6	0_2_00007FFD9B9655D6
Source: C:\Users\user\Desktop\Client-base.exe	Code function: 0_2_00007FFD9B969271	0_2_00007FFD9B969271
Source: C:\Users\user\Desktop\Client-base.exe	Code function: 0_2_00007FFD9B96621F	0_2_00007FFD9B96621F

Source: Client-base.exe, 00000000.00000000.1758259602.0000000000820000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs Client-base.exe
Source: Client-base.exe	Binary or memory string: OriginalFilenameClient.exe. vs Client-base.exe

Source: Client-base.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Client-base.exe, type: SAMPLE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: Client-base.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: Client-base.exe, type: SAMPLE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.0.Client-base.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.Client-base.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.Client-base.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@5/2

Source: C:\Users\user\Desktop\Client-base.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\cc827307-beb6-456e-b5dd-e28a204ebd45
Source: C:\Users\user\Desktop\Client-base.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7700:120:WilError_03

Source: Client-base.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Client-base.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Client-base.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Client-base.exe	Virustotal: Detection: 75%
Source: Client-base.exe	ReversingLabs: Detection: 76%

Source: Client-base.exe

String found in binary or memory: HasSubValue3Conflicting item/add type

Source: unknown	Process created: C:\Users\user\Desktop\Client-base.exe "C:\Users\user\Desktop\Client-base.exe"
Source: C:\Users\user\Desktop\Client-base.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Client-base.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: Client-base.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Client-base.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Client-base.exe

Static file information: File size 3266048 > 1048576

Source: Client-base.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31c600

Source: Client-base.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Client-base.exe	Code function: 0_2_00007FFD9B6F2B85 pushad ; iretd	0_2_00007FFD9B6F2C3D
Source: C:\Users\user\Desktop\Client-base.exe	Code function: 0_2_00007FFD9B6F2BE5 pushad ; iretd	0_2_00007FFD9B6F2C3D
Source: C:\Users\user\Desktop\Client-base.exe	Code function: 0_2_00007FFD9B6F00AD pushad ; iretd	0_2_00007FFD9B6F00C1
Source: C:\Users\user\Desktop\Client-base.exe	Code function: 0_2_00007FFD9B96336E push eax; ret	0_2_00007FFD9B96340C

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Client-base.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Client-base.exe

File opened: C:\Users\user\Desktop\Client-base.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Client-base.exe	Memory allocated: E60000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Memory allocated: 1AB30000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\Client-base.exe

Code function: 0_2_00007FFD9B6FF1F2 str ax

0_2_00007FFD9B6FF1F2

Source: C:\Users\user\Desktop\Client-base.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Client-base.exe	Window / User API: threadDelayed 7956			Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Window / User API: threadDelayed 1912			Jump to behavior

Source: C:\Users\user\Desktop\Client-base.exe TID: 7796

Thread sleep time: -23980767295822402s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Client-base.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Client-base.exe, 00000000.00000002.4216323046.000000001B791000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll7

Source: C:\Users\user\Desktop\Client-base.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Client-base.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Client-base.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

Jump to behavior

Source: C:\Users\user\Desktop\Client-base.exe	Queries volume information: C:\Users\user\Desktop\Client-base.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Client-base.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Client-base.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: Client-base.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Client-base.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1775574902.000002140D1E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1758259602.0000000000820000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775347331.000000207E7F9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775529562.000002140CEF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775529562.000002140CEF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775574902.000002140D1E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4214131861.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1757918698.0000000000502000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-base.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 7692, type: MEMORYSTR

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: Client-base.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Client-base.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1775574902.000002140D1E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1758259602.0000000000820000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775347331.000000207E7F9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775529562.000002140CEF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775529562.000002140CEF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1775574902.000002140D1E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4214131861.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1757918698.0000000000502000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-base.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 7692, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	1 Disable or Modify Tools	11 Input Capture	1 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	41 Virtualization/Sandbox Evasion	LSASS Memory	41 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Client-base.exe	75%	Virustotal		Browse
Client-base.exe	76%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
Client-base.exe	100%	Avira	HEUR/AGEN.1307453
Client-base.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
0.tcp.in.ngrok.io	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
0.tcp.in.ngrok.io	3.6.231.193	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
0.tcp.in.ngrok.io	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org/	Client-base.exe	false	high
https://stackoverflow.com/q/14436606/23354	Client-base.exe	false	high
https://stackoverflow.com/q/2152978/23354sCannot	Client-base.exe	false	high
https://ipwho.is/	Client-base.exe	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Client-base.exe, 00000000.00000002.4214131861.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	Client-base.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
3.6.231.193	0.tcp.in.ngrok.io	United States		16509	AMAZON-02US	true
13.202.226.61	unknown	United States		7018	ATT-INTERNET4US	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589885
Start date and time:	2025-01-13 09:43:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Client-base.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@5/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 9 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:44:16	API Interceptor	13902038x Sleep call for process: Client-base.exe modified
08:44:15	Task Scheduler	Run new task: Quasar Client Startup path: C:\Users\user\AppData\Roaming\SubDir\Client.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.202.226.61	Client.exe	Get hash	malicious	AsyncRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
0.tcp.in.ngrok.io	Client.exe	Get hash	malicious	AsyncRAT	Browse	35.154.189.194
	CV.vbs	Get hash	malicious	Xmrig	Browse	3.6.115.64
	RobloxCheats.exe	Get hash	malicious	Unknown	Browse	3.6.98.232
	kuEfaZxkiY.exe	Get hash	malicious	RedLine	Browse	3.6.115.182
	ae6T8jJueq.exe	Get hash	malicious	Njrat	Browse	3.6.115.64
	nOZ2Oqnzbz.exe	Get hash	malicious	Njrat	Browse	3.6.115.64
	iR2UtZj5vP.exe	Get hash	malicious	Njrat	Browse	3.6.122.107
	ZB7Ot9MOic.exe	Get hash	malicious	Njrat	Browse	3.6.30.85
	etJZk4UQhS.exe	Get hash	malicious	Njrat	Browse	3.6.122.107
	jango.exe	Get hash	malicious	XWorm	Browse	3.6.30.85

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-INTERNET4US	4.elf	Get hash	malicious	Unknown	Browse	12.213.172.7
	6.elf	Get hash	malicious	Unknown	Browse	107.207.67.247
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	216.9.225.175
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	216.9.225.175
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	216.9.225.175
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	216.9.225.175
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	216.9.225.175
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	216.9.225.175
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	216.9.225.175
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	216.9.225.175
AMAZON-02US	CSZ inquiry for MH raw material.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	arm5.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	trow.exe	Get hash	malicious	Unknown	Browse	3.65.101.129
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	18.245.46.55
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	3.163.248.4
	https://app-nadexlxogi.webflow.io/	Get hash	malicious	Unknown	Browse	18.244.20.221
	https://upholl-xlognusa.godaddysites.com/	Get hash	malicious	Unknown	Browse	13.248.243.5
	https://informed.deliveryerz.top/us/	Get hash	malicious	Unknown	Browse	99.86.8.175
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	https://informed.deliveryerw.top/us/	Get hash	malicious	Unknown	Browse	99.86.8.175

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.0835542937018205
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Client-base.exe
File size:	3'266'048 bytes
MD5:	21ce4cd2ce246c86222b57b93cdc92bd
SHA1:	9dc24ad846b2d9db64e5bbea1977e23bb185d224
SHA256:	273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678
SHA512:	ff43fe890e30d6766f51922cfd1e9c36d312fd305620954fae8c61829f58d7361ae442bf9145339904eb6a88c2629c1e83f5b8a1d78ab0d13554cf6053d194f6
SSDEEP:	49152:DvTI22SsaNYfdPBldt698dBcjHZqS71J/ioGdRTTHHB72eh2NT:Dvs22SsaNYfdPBldt6+dBcjHZqSOB
TLSH:	95E54A1437F85E23E1BBE273D5B0041267F1EC2AB3A3FB5B6181677A1C53B505841AAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1...........1.. ........@.. .......................@2...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x71e3fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x640DFAE7 [Sun Mar 12 16:16:39 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31e3a8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x320000	0xa93	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x322000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x31c404	0x31c600	756a71c4d52d2cbb7cc09522cafcfda7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x320000	0xa93	0xc00	cdeae95ac72e9e58017d2bcc89d2fbea	False	0.36328125	data	4.653972105845318	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x322000	0xc	0x200	e7d4f7d5c6a56813a995215f35c1a9ce	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3200a0	0x31c	data			0.4484924623115578
RT_MANIFEST	0x3203bc	0x6d7	XML 1.0 document, Unicode text, UTF-8 (with BOM) text			0.40319817247287265

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:44:17.411304951 CET	49730	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:17.416174889 CET	14296	49730	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:17.416245937 CET	49730	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:17.427926064 CET	49730	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:17.432707071 CET	14296	49730	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:19.387123108 CET	14296	49730	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:19.387351990 CET	49730	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:19.403001070 CET	49730	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:19.408365965 CET	14296	49730	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:22.714289904 CET	49731	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:22.719505072 CET	14296	49731	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:22.719640970 CET	49731	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:22.719950914 CET	49731	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:22.727619886 CET	14296	49731	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:24.700129986 CET	14296	49731	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:24.700261116 CET	49731	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:24.701061010 CET	49731	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:24.705965996 CET	14296	49731	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:28.120378017 CET	49732	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:28.125366926 CET	14296	49732	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:28.125446081 CET	49732	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:28.125722885 CET	49732	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:28.130692959 CET	14296	49732	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:30.105432034 CET	14296	49732	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:30.105483055 CET	49732	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:30.105932951 CET	49732	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:30.111339092 CET	14296	49732	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:33.863775015 CET	49738	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:33.868680954 CET	14296	49738	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:33.870426893 CET	49738	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:33.876322031 CET	49738	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:33.881165981 CET	14296	49738	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:35.837191105 CET	14296	49738	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:35.837258101 CET	49738	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:35.837879896 CET	49738	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:35.842617989 CET	14296	49738	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:39.464438915 CET	49740	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:39.469439983 CET	14296	49740	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:39.469568968 CET	49740	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:39.469890118 CET	49740	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:39.474678993 CET	14296	49740	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:41.429713011 CET	14296	49740	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:41.429893017 CET	49740	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:41.430315971 CET	49740	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:41.435215950 CET	14296	49740	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:44.994959116 CET	49741	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:44.999809980 CET	14296	49741	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:45.000027895 CET	49741	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:45.000236988 CET	49741	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:45.004973888 CET	14296	49741	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:46.962838888 CET	14296	49741	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:46.962908030 CET	49741	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:46.963540077 CET	49741	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:46.968287945 CET	14296	49741	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:50.714276075 CET	49742	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:50.719149113 CET	14296	49742	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:50.719299078 CET	49742	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:50.719747066 CET	49742	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:50.724559069 CET	14296	49742	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:52.679907084 CET	14296	49742	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:52.679992914 CET	49742	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:52.680416107 CET	49742	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:52.685271978 CET	14296	49742	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:56.120233059 CET	49743	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:56.125138998 CET	14296	49743	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:56.125225067 CET	49743	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:56.125607014 CET	49743	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:56.130386114 CET	14296	49743	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:58.105225086 CET	14296	49743	3.6.231.193	192.168.2.4
Jan 13, 2025 09:44:58.105329037 CET	49743	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:58.105747938 CET	49743	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:44:58.110570908 CET	14296	49743	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:01.604569912 CET	49744	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:01.609456062 CET	14296	49744	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:01.609601974 CET	49744	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:01.610018969 CET	49744	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:01.614814043 CET	14296	49744	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:03.571378946 CET	14296	49744	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:03.571441889 CET	49744	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:03.571753979 CET	49744	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:03.576565981 CET	14296	49744	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:07.041971922 CET	49766	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:07.053670883 CET	14296	49766	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:07.053805113 CET	49766	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:07.054110050 CET	49766	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:07.061526060 CET	14296	49766	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:09.024365902 CET	14296	49766	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:09.028529882 CET	49766	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:09.028837919 CET	49766	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:09.033694029 CET	14296	49766	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:12.635801077 CET	49803	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:12.802450895 CET	14296	49803	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:12.802598953 CET	49803	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:12.803018093 CET	49803	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:12.807781935 CET	14296	49803	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:14.777056932 CET	14296	49803	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:14.777134895 CET	49803	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:14.777565002 CET	49803	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:45:14.782478094 CET	14296	49803	3.6.231.193	192.168.2.4
Jan 13, 2025 09:45:17.924717903 CET	49834	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:17.929616928 CET	14296	49834	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:17.929752111 CET	49834	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:17.930083036 CET	49834	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:17.934959888 CET	14296	49834	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:19.904155016 CET	14296	49834	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:19.904227018 CET	49834	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:19.904813051 CET	49834	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:19.909553051 CET	14296	49834	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:22.651352882 CET	49870	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:22.656342030 CET	14296	49870	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:22.658801079 CET	49870	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:22.659120083 CET	49870	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:22.663871050 CET	14296	49870	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:24.619626045 CET	14296	49870	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:24.623455048 CET	49870	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:24.623857975 CET	49870	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:24.628631115 CET	14296	49870	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:27.262165070 CET	49896	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:27.266994953 CET	14296	49896	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:27.267061949 CET	49896	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:27.267405033 CET	49896	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:27.272162914 CET	14296	49896	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:29.242650032 CET	14296	49896	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:29.242744923 CET	49896	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:29.243056059 CET	49896	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:29.247857094 CET	14296	49896	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:31.513829947 CET	49922	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:31.519206047 CET	14296	49922	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:31.519305944 CET	49922	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:31.527815104 CET	49922	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:31.532586098 CET	14296	49922	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:33.495729923 CET	14296	49922	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:33.495815992 CET	49922	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:33.496371984 CET	49922	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:33.501137972 CET	14296	49922	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:35.495346069 CET	49952	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:35.500189066 CET	14296	49952	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:35.500261068 CET	49952	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:35.500710011 CET	49952	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:35.505475044 CET	14296	49952	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:37.481569052 CET	14296	49952	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:37.481637001 CET	49952	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:37.482093096 CET	49952	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:37.486838102 CET	14296	49952	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:39.151274920 CET	49974	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:39.156270027 CET	14296	49974	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:39.156471014 CET	49974	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:39.156858921 CET	49974	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:39.161689043 CET	14296	49974	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:41.120682001 CET	14296	49974	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:41.124552011 CET	49974	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:41.128297091 CET	49974	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:41.133183956 CET	14296	49974	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:42.791968107 CET	49997	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:42.797593117 CET	14296	49997	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:42.797780037 CET	49997	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:42.798104048 CET	49997	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:42.803373098 CET	14296	49997	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:44.760834932 CET	14296	49997	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:44.760982990 CET	49997	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:44.761269093 CET	49997	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:44.766089916 CET	14296	49997	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:46.343951941 CET	50018	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:46.529267073 CET	14296	50018	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:46.529433012 CET	50018	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:46.532365084 CET	50018	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:46.537267923 CET	14296	50018	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:48.493828058 CET	14296	50018	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:48.496541023 CET	50018	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:48.500288963 CET	50018	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:48.505202055 CET	14296	50018	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:49.746184111 CET	50021	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:49.751247883 CET	14296	50021	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:49.751348972 CET	50021	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:49.756905079 CET	50021	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:49.761842012 CET	14296	50021	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:51.734577894 CET	14296	50021	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:51.734644890 CET	50021	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:51.735162020 CET	50021	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:51.739975929 CET	14296	50021	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:53.018695116 CET	50022	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:53.023711920 CET	14296	50022	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:53.026510000 CET	50022	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:53.031235933 CET	50022	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:53.036293983 CET	14296	50022	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:54.994107008 CET	14296	50022	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:54.994201899 CET	50022	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:54.998389006 CET	50022	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:55.004045963 CET	14296	50022	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:55.995322943 CET	50023	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:56.000648022 CET	14296	50023	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:56.000732899 CET	50023	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:56.001025915 CET	50023	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:56.005852938 CET	14296	50023	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:57.997643948 CET	14296	50023	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:57.997706890 CET	50023	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:57.998238087 CET	50023	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:58.003074884 CET	14296	50023	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:58.887284040 CET	50024	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:58.892420053 CET	14296	50024	13.202.226.61	192.168.2.4
Jan 13, 2025 09:45:58.896465063 CET	50024	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:58.896967888 CET	50024	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:45:58.901782036 CET	14296	50024	13.202.226.61	192.168.2.4
Jan 13, 2025 09:46:00.855247974 CET	14296	50024	13.202.226.61	192.168.2.4
Jan 13, 2025 09:46:00.858064890 CET	50024	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:46:00.860071898 CET	50024	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:46:00.865755081 CET	14296	50024	13.202.226.61	192.168.2.4
Jan 13, 2025 09:46:01.589132071 CET	50025	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:46:01.594512939 CET	14296	50025	13.202.226.61	192.168.2.4
Jan 13, 2025 09:46:01.594603062 CET	50025	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:46:01.595033884 CET	50025	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:46:01.599880934 CET	14296	50025	13.202.226.61	192.168.2.4
Jan 13, 2025 09:46:03.576878071 CET	14296	50025	13.202.226.61	192.168.2.4
Jan 13, 2025 09:46:03.576936960 CET	50025	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:46:03.577438116 CET	50025	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:46:03.582221031 CET	14296	50025	13.202.226.61	192.168.2.4
Jan 13, 2025 09:46:04.278155088 CET	50026	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:04.283008099 CET	14296	50026	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:04.283130884 CET	50026	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:04.283463001 CET	50026	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:04.288309097 CET	14296	50026	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:06.264954090 CET	14296	50026	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:06.265043974 CET	50026	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:06.265412092 CET	50026	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:06.270224094 CET	14296	50026	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:06.823018074 CET	50027	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:06.828021049 CET	14296	50027	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:06.828136921 CET	50027	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:06.832268953 CET	50027	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:06.837022066 CET	14296	50027	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:08.790282011 CET	14296	50027	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:08.790416002 CET	50027	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:08.794961929 CET	50027	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:08.799807072 CET	14296	50027	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:09.465754032 CET	50028	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:09.470957994 CET	14296	50028	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:09.471045017 CET	50028	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:09.471468925 CET	50028	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:09.476298094 CET	14296	50028	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:11.432840109 CET	14296	50028	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:11.432935953 CET	50028	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:11.433542967 CET	50028	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:11.438404083 CET	14296	50028	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:11.932143927 CET	50029	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:11.937285900 CET	14296	50029	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:11.937376976 CET	50029	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:11.940789938 CET	50029	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:11.945687056 CET	14296	50029	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:13.951294899 CET	14296	50029	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:13.951373100 CET	50029	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:13.951843977 CET	50029	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:13.956676960 CET	14296	50029	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:14.370165110 CET	50030	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:14.375247955 CET	14296	50030	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:14.376398087 CET	50030	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:14.380265951 CET	50030	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:14.385201931 CET	14296	50030	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:16.337091923 CET	14296	50030	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:16.337153912 CET	50030	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:16.339174032 CET	50030	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:16.343988895 CET	14296	50030	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:16.746524096 CET	50031	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:16.751450062 CET	14296	50031	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:16.751898050 CET	50031	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:16.760164022 CET	50031	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:16.764991999 CET	14296	50031	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:18.733644962 CET	14296	50031	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:18.733794928 CET	50031	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:18.734230995 CET	50031	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:18.739088058 CET	14296	50031	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:19.042654991 CET	50032	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:19.047704935 CET	14296	50032	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:19.047847986 CET	50032	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:19.048440933 CET	50032	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:19.053261995 CET	14296	50032	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:21.030752897 CET	14296	50032	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:21.030846119 CET	50032	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:21.031347990 CET	50032	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:21.036221027 CET	14296	50032	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:21.323059082 CET	50033	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:21.327930927 CET	14296	50033	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:21.328042030 CET	50033	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:21.328457117 CET	50033	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:21.333308935 CET	14296	50033	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:23.309794903 CET	14296	50033	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:23.309990883 CET	50033	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:23.311167002 CET	50033	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:23.315946102 CET	14296	50033	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:23.557770967 CET	50034	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:23.562664032 CET	14296	50034	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:23.562753916 CET	50034	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:23.563249111 CET	50034	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:23.568031073 CET	14296	50034	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:25.526263952 CET	14296	50034	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:25.526352882 CET	50034	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:25.527266979 CET	50034	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:25.532170057 CET	14296	50034	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:25.761537075 CET	50035	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:25.779735088 CET	14296	50035	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:25.779834032 CET	50035	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:25.780529976 CET	50035	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:25.785329103 CET	14296	50035	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:27.785871029 CET	14296	50035	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:27.785938025 CET	50035	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:27.786449909 CET	50035	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:27.791191101 CET	14296	50035	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:27.979943991 CET	50036	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:27.984810114 CET	14296	50036	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:27.984884977 CET	50036	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:27.985378981 CET	50036	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:27.990266085 CET	14296	50036	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:29.966152906 CET	14296	50036	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:29.966249943 CET	50036	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:29.966722012 CET	50036	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:29.971514940 CET	14296	50036	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:30.135667086 CET	50037	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:30.140573978 CET	14296	50037	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:30.140651941 CET	50037	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:30.140964031 CET	50037	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:30.145735025 CET	14296	50037	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:32.103723049 CET	14296	50037	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:32.103791952 CET	50037	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:32.104176044 CET	50037	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:32.109011889 CET	14296	50037	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:32.261888981 CET	50038	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:32.266920090 CET	14296	50038	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:32.267002106 CET	50038	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:32.267827988 CET	50038	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:32.272656918 CET	14296	50038	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:34.265548944 CET	14296	50038	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:34.265636921 CET	50038	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:34.266175985 CET	50038	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:34.270976067 CET	14296	50038	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:34.401427984 CET	50039	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:34.406326056 CET	14296	50039	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:34.406435966 CET	50039	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:34.406825066 CET	50039	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:34.411581993 CET	14296	50039	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:36.385584116 CET	14296	50039	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:36.385653973 CET	50039	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:36.385968924 CET	50039	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:36.390748024 CET	14296	50039	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:36.495301008 CET	50040	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:36.500138044 CET	14296	50040	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:36.500267982 CET	50040	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:36.500607967 CET	50040	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:36.505373955 CET	14296	50040	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:38.462877989 CET	14296	50040	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:38.462946892 CET	50040	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:38.463426113 CET	50040	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:38.468259096 CET	14296	50040	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:38.573767900 CET	50041	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:38.580637932 CET	14296	50041	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:38.580724955 CET	50041	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:38.581163883 CET	50041	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:38.587886095 CET	14296	50041	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:40.561573982 CET	14296	50041	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:40.561645985 CET	50041	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:40.562520027 CET	50041	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:40.567388058 CET	14296	50041	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:40.667527914 CET	50042	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:40.672363043 CET	14296	50042	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:40.672473907 CET	50042	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:40.672894001 CET	50042	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:40.677661896 CET	14296	50042	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:42.634170055 CET	14296	50042	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:42.634242058 CET	50042	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:42.634999037 CET	50042	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:42.639919996 CET	14296	50042	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:42.729924917 CET	50043	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:42.734875917 CET	14296	50043	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:42.734966040 CET	50043	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:42.735644102 CET	50043	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:42.740453005 CET	14296	50043	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:44.697194099 CET	14296	50043	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:44.697264910 CET	50043	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:44.698082924 CET	50043	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:44.702931881 CET	14296	50043	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:44.776896954 CET	50044	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:44.781941891 CET	14296	50044	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:44.782063007 CET	50044	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:44.782650948 CET	50044	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:44.787465096 CET	14296	50044	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:46.746304035 CET	14296	50044	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:46.746364117 CET	50044	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:46.748681068 CET	50044	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:46.753568888 CET	14296	50044	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:46.823550940 CET	50045	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:46.828438044 CET	14296	50045	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:46.828516960 CET	50045	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:46.829125881 CET	50045	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:46.833895922 CET	14296	50045	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:48.793862104 CET	14296	50045	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:48.793922901 CET	50045	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:48.794430017 CET	50045	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:48.799259901 CET	14296	50045	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:48.854531050 CET	50046	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:48.859427929 CET	14296	50046	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:48.859494925 CET	50046	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:48.859920979 CET	50046	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:48.864712000 CET	14296	50046	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:50.822947025 CET	14296	50046	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:50.823065996 CET	50046	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:50.823609114 CET	50046	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:50.828413963 CET	14296	50046	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:50.887166977 CET	50047	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:50.892143965 CET	14296	50047	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:50.892241955 CET	50047	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:50.896126032 CET	50047	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:50.900985956 CET	14296	50047	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:52.888931990 CET	14296	50047	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:52.889019012 CET	50047	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:52.889595985 CET	50047	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:52.894445896 CET	14296	50047	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:52.932784081 CET	50048	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:52.937645912 CET	14296	50048	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:52.937732935 CET	50048	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:52.938193083 CET	50048	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:52.942996979 CET	14296	50048	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:54.901396990 CET	14296	50048	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:54.901457071 CET	50048	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:54.902020931 CET	50048	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:54.906800985 CET	14296	50048	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:54.948193073 CET	50049	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:54.953033924 CET	14296	50049	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:54.953103065 CET	50049	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:54.953448057 CET	50049	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:54.958198071 CET	14296	50049	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:56.933523893 CET	14296	50049	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:56.933574915 CET	50049	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:56.934099913 CET	50049	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:56.938822985 CET	14296	50049	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:56.981055975 CET	50050	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:56.985778093 CET	14296	50050	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:56.985852003 CET	50050	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:56.986231089 CET	50050	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:56.990995884 CET	14296	50050	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:58.947293997 CET	14296	50050	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:58.947355032 CET	50050	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:58.947844982 CET	50050	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:58.952608109 CET	14296	50050	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:58.979614019 CET	50051	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:58.984435081 CET	14296	50051	3.6.231.193	192.168.2.4
Jan 13, 2025 09:46:58.984508991 CET	50051	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:58.984849930 CET	50051	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:46:58.989697933 CET	14296	50051	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:00.968730927 CET	14296	50051	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:00.968792915 CET	50051	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:00.969333887 CET	50051	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:00.974165916 CET	14296	50051	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:01.010818958 CET	50052	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:01.015635014 CET	14296	50052	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:01.015701056 CET	50052	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:01.016027927 CET	50052	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:01.020781994 CET	14296	50052	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:02.979264975 CET	14296	50052	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:02.979456902 CET	50052	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:02.996769905 CET	50052	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:03.001671076 CET	14296	50052	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:03.079947948 CET	50053	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:03.084888935 CET	14296	50053	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:03.084990978 CET	50053	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:03.124545097 CET	50053	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:03.129406929 CET	14296	50053	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:05.095190048 CET	14296	50053	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:05.095254898 CET	50053	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:05.095745087 CET	50053	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:05.100474119 CET	14296	50053	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:05.130630016 CET	50054	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:05.135531902 CET	14296	50054	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:05.135596037 CET	50054	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:05.135893106 CET	50054	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:05.140666008 CET	14296	50054	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:07.088138103 CET	14296	50054	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:07.088216066 CET	50054	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:07.088951111 CET	50054	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:07.093684912 CET	14296	50054	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:07.120311022 CET	50055	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:07.125230074 CET	14296	50055	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:07.125355005 CET	50055	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:07.125593901 CET	50055	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:07.130404949 CET	14296	50055	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:09.110033989 CET	14296	50055	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:09.110100031 CET	50055	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:09.110557079 CET	50055	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:09.118546963 CET	14296	50055	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:09.136077881 CET	50056	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:09.144423962 CET	14296	50056	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:09.144509077 CET	50056	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:09.145239115 CET	50056	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:09.153837919 CET	14296	50056	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:11.104969025 CET	14296	50056	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:11.105035067 CET	50056	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:11.105545044 CET	50056	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:11.110276937 CET	14296	50056	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:11.135617971 CET	50057	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:11.341094017 CET	14296	50057	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:11.341269016 CET	50057	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:11.341675043 CET	50057	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:11.346391916 CET	14296	50057	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:13.326677084 CET	14296	50057	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:13.326756954 CET	50057	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:13.327224016 CET	50057	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:13.332052946 CET	14296	50057	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:13.354338884 CET	50058	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:13.359215021 CET	14296	50058	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:13.359309912 CET	50058	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:13.359620094 CET	50058	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:13.364411116 CET	14296	50058	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:15.322555065 CET	14296	50058	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:15.322635889 CET	50058	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:15.325345039 CET	50058	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:15.330173969 CET	14296	50058	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:15.339778900 CET	50059	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:15.344728947 CET	14296	50059	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:15.344816923 CET	50059	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:15.345118046 CET	50059	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:15.349890947 CET	14296	50059	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:17.345628023 CET	14296	50059	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:17.345716953 CET	50059	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:17.346159935 CET	50059	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:17.351007938 CET	14296	50059	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:17.369951010 CET	50060	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:17.374816895 CET	14296	50060	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:17.374907017 CET	50060	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:17.375196934 CET	50060	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:17.379888058 CET	14296	50060	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:19.343578100 CET	14296	50060	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:19.343698025 CET	50060	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:19.344100952 CET	50060	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:19.349029064 CET	14296	50060	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:19.370054960 CET	50061	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:19.374866962 CET	14296	50061	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:19.374958992 CET	50061	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:19.375251055 CET	50061	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:19.380079985 CET	14296	50061	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:21.338977098 CET	14296	50061	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:21.339281082 CET	50061	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:21.339415073 CET	50061	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:21.344227076 CET	14296	50061	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:21.354551077 CET	50062	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:21.359394073 CET	14296	50062	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:21.359473944 CET	50062	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:21.359836102 CET	50062	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:21.364603043 CET	14296	50062	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:23.324059963 CET	14296	50062	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:23.324125051 CET	50062	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:23.324704885 CET	50062	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:23.329433918 CET	14296	50062	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:23.339219093 CET	50063	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:23.344172955 CET	14296	50063	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:23.344250917 CET	50063	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:23.344681978 CET	50063	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:23.349394083 CET	14296	50063	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:25.309458971 CET	14296	50063	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:25.309524059 CET	50063	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:25.310247898 CET	50063	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:25.315062046 CET	14296	50063	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:25.323801994 CET	50064	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:25.328632116 CET	14296	50064	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:25.328716993 CET	50064	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:25.329281092 CET	50064	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:25.334003925 CET	14296	50064	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:27.293787003 CET	14296	50064	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:27.293874979 CET	50064	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:27.294392109 CET	50064	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:27.299217939 CET	14296	50064	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:27.307620049 CET	50065	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:27.312565088 CET	14296	50065	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:27.312658072 CET	50065	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:27.313095093 CET	50065	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:27.317914963 CET	14296	50065	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:29.297755957 CET	14296	50065	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:29.297821999 CET	50065	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:29.298305035 CET	50065	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:29.303078890 CET	14296	50065	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:29.307590961 CET	50066	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:29.312388897 CET	14296	50066	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:29.312484026 CET	50066	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:29.313071966 CET	50066	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:29.317871094 CET	14296	50066	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:31.296478033 CET	14296	50066	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:31.296561956 CET	50066	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:31.297099113 CET	50066	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:31.301897049 CET	14296	50066	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:31.307765007 CET	50067	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:31.312597036 CET	14296	50067	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:31.312674999 CET	50067	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:31.313241959 CET	50067	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:31.318025112 CET	14296	50067	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:33.297060966 CET	14296	50067	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:33.297135115 CET	50067	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:33.297585964 CET	50067	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:33.302386045 CET	14296	50067	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:33.307847977 CET	50068	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:33.312724113 CET	14296	50068	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:33.312796116 CET	50068	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:33.313247919 CET	50068	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:33.318053007 CET	14296	50068	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:35.280188084 CET	14296	50068	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:35.280455112 CET	50068	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:35.297760963 CET	50068	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:35.302619934 CET	14296	50068	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:35.341274977 CET	50069	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:35.346231937 CET	14296	50069	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:35.346298933 CET	50069	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:35.346947908 CET	50069	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:35.351742983 CET	14296	50069	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:37.346713066 CET	14296	50069	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:37.346787930 CET	50069	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:37.347162962 CET	50069	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:37.351907969 CET	14296	50069	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:37.354896069 CET	50070	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:37.359718084 CET	14296	50070	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:37.359874964 CET	50070	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:37.360163927 CET	50070	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:37.364933014 CET	14296	50070	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:39.323038101 CET	14296	50070	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:39.323160887 CET	50070	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:39.323600054 CET	50070	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:39.328340054 CET	14296	50070	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:39.338807106 CET	50071	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:39.343708038 CET	14296	50071	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:39.343786001 CET	50071	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:39.344075918 CET	50071	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:39.348891020 CET	14296	50071	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:41.307579041 CET	14296	50071	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:41.307646036 CET	50071	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:41.308059931 CET	50071	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:41.312777996 CET	14296	50071	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:41.323113918 CET	50072	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:41.328025103 CET	14296	50072	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:41.328088999 CET	50072	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:41.328404903 CET	50072	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:41.333170891 CET	14296	50072	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:43.314723015 CET	14296	50072	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:43.314795017 CET	50072	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:43.315325022 CET	50072	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:43.320099115 CET	14296	50072	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:43.323280096 CET	50073	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:43.328116894 CET	14296	50073	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:43.328188896 CET	50073	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:43.328552961 CET	50073	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:43.333374977 CET	14296	50073	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:45.291482925 CET	14296	50073	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:45.291604042 CET	50073	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:45.291970015 CET	50073	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:45.296916962 CET	14296	50073	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:45.307301998 CET	50074	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:45.312199116 CET	14296	50074	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:45.312298059 CET	50074	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:45.312509060 CET	50074	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:45.317251921 CET	14296	50074	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:47.282727003 CET	14296	50074	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:47.282818079 CET	50074	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:47.284363031 CET	50074	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:47.289271116 CET	14296	50074	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:47.297235012 CET	50075	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:47.302087069 CET	14296	50075	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:47.302155018 CET	50075	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:47.302614927 CET	50075	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:47.307384968 CET	14296	50075	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:49.263223886 CET	14296	50075	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:49.263300896 CET	50075	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:49.263803959 CET	50075	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:49.268724918 CET	14296	50075	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:49.276307106 CET	50076	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:49.281362057 CET	14296	50076	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:49.281441927 CET	50076	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:49.281811953 CET	50076	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:49.286716938 CET	14296	50076	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:51.245496988 CET	14296	50076	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:51.245569944 CET	50076	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:51.246265888 CET	50076	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:51.251123905 CET	14296	50076	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:51.261568069 CET	50077	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:51.266422033 CET	14296	50077	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:51.266491890 CET	50077	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:51.267246008 CET	50077	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:51.272001028 CET	14296	50077	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:53.249952078 CET	14296	50077	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:53.250017881 CET	50077	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:53.250519037 CET	50077	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:53.255306005 CET	14296	50077	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:53.260703087 CET	50078	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:53.265527964 CET	14296	50078	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:53.265603065 CET	50078	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:53.265974998 CET	50078	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:53.270767927 CET	14296	50078	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:55.229995966 CET	14296	50078	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:55.230062962 CET	50078	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:55.231349945 CET	50078	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:55.236196995 CET	14296	50078	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:55.246161938 CET	50079	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:55.251060009 CET	14296	50079	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:55.251131058 CET	50079	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:55.251466036 CET	50079	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:55.256257057 CET	14296	50079	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:57.214597940 CET	14296	50079	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:57.214653015 CET	50079	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:57.215390921 CET	50079	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:57.220212936 CET	14296	50079	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:57.229779005 CET	50080	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:57.234704971 CET	14296	50080	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:57.234778881 CET	50080	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:57.235174894 CET	50080	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:57.239979029 CET	14296	50080	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:59.235627890 CET	14296	50080	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:59.235691071 CET	50080	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:59.236145973 CET	50080	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:59.241056919 CET	14296	50080	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:59.245049953 CET	50081	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:59.250140905 CET	14296	50081	3.6.231.193	192.168.2.4
Jan 13, 2025 09:47:59.250216961 CET	50081	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:59.250571966 CET	50081	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:47:59.255474091 CET	14296	50081	3.6.231.193	192.168.2.4
Jan 13, 2025 09:48:01.216120005 CET	14296	50081	3.6.231.193	192.168.2.4
Jan 13, 2025 09:48:01.216197014 CET	50081	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:01.216805935 CET	50081	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:01.221767902 CET	14296	50081	3.6.231.193	192.168.2.4
Jan 13, 2025 09:48:01.229619980 CET	50082	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:01.234572887 CET	14296	50082	3.6.231.193	192.168.2.4
Jan 13, 2025 09:48:01.234638929 CET	50082	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:01.235157967 CET	50082	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:01.240020990 CET	14296	50082	3.6.231.193	192.168.2.4
Jan 13, 2025 09:48:03.200381041 CET	14296	50082	3.6.231.193	192.168.2.4
Jan 13, 2025 09:48:03.200450897 CET	50082	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:03.203919888 CET	50082	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:03.208751917 CET	14296	50082	3.6.231.193	192.168.2.4
Jan 13, 2025 09:48:03.214121103 CET	50083	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:03.219070911 CET	14296	50083	3.6.231.193	192.168.2.4
Jan 13, 2025 09:48:03.219161987 CET	50083	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:03.219619036 CET	50083	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:03.224463940 CET	14296	50083	3.6.231.193	192.168.2.4
Jan 13, 2025 09:48:05.203879118 CET	14296	50083	3.6.231.193	192.168.2.4
Jan 13, 2025 09:48:05.203984022 CET	50083	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:05.204449892 CET	50083	14296	192.168.2.4	3.6.231.193
Jan 13, 2025 09:48:05.209357977 CET	14296	50083	3.6.231.193	192.168.2.4
Jan 13, 2025 09:48:05.230204105 CET	50084	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:05.235187054 CET	14296	50084	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:05.235294104 CET	50084	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:05.235701084 CET	50084	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:05.240525961 CET	14296	50084	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:07.219774961 CET	14296	50084	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:07.219916105 CET	50084	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:07.220293045 CET	50084	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:07.221183062 CET	50085	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:07.225054979 CET	14296	50084	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:07.226006985 CET	14296	50085	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:07.226125002 CET	50085	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:07.226377964 CET	50085	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:07.231235981 CET	14296	50085	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:09.220601082 CET	14296	50085	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:09.224435091 CET	50085	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:09.226172924 CET	50085	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:09.226175070 CET	50086	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:09.231302977 CET	14296	50085	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:09.231360912 CET	14296	50086	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:09.231489897 CET	50086	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:09.232717037 CET	50086	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:09.237539053 CET	14296	50086	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:11.201199055 CET	14296	50086	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:11.204302073 CET	50086	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:11.204653025 CET	50086	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:11.208281040 CET	50087	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:11.209574938 CET	14296	50086	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:11.213224888 CET	14296	50087	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:11.216636896 CET	50087	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:11.216636896 CET	50087	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:11.221582890 CET	14296	50087	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:13.187412024 CET	14296	50087	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:13.190404892 CET	50087	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:13.191267014 CET	50087	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:13.194256067 CET	50088	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:13.196173906 CET	14296	50087	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:13.199146032 CET	14296	50088	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:13.199516058 CET	50088	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:13.199711084 CET	50088	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:13.204499006 CET	14296	50088	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:15.152138948 CET	14296	50088	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:15.156455994 CET	50088	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:15.156749964 CET	50088	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:15.159234047 CET	50089	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:15.161679029 CET	14296	50088	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:15.164097071 CET	14296	50089	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:15.166599989 CET	50089	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:15.167028904 CET	50089	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:15.171860933 CET	14296	50089	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:17.140729904 CET	14296	50089	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:17.140887022 CET	50089	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:17.141228914 CET	50089	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:17.143260956 CET	50090	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:17.145936966 CET	14296	50089	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:17.148133039 CET	14296	50090	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:17.148497105 CET	50090	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:17.149068117 CET	50090	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:17.153808117 CET	14296	50090	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:19.107763052 CET	14296	50090	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:19.108216047 CET	50090	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:19.109589100 CET	50091	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:19.110269070 CET	50090	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:19.116343975 CET	14296	50091	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:19.116503000 CET	14296	50090	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:19.116894960 CET	50091	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:19.116894960 CET	50091	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:19.123631001 CET	14296	50091	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:21.092592955 CET	14296	50091	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:21.092730045 CET	50091	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:21.114295006 CET	50091	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:21.119163990 CET	14296	50091	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:24.417969942 CET	50092	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:24.422914028 CET	14296	50092	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:24.423064947 CET	50092	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:24.423381090 CET	50092	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:24.428183079 CET	14296	50092	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:26.402666092 CET	14296	50092	13.202.226.61	192.168.2.4
Jan 13, 2025 09:48:26.404684067 CET	50092	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:26.404684067 CET	50092	14296	192.168.2.4	13.202.226.61
Jan 13, 2025 09:48:26.410273075 CET	14296	50092	13.202.226.61	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:44:17.382467031 CET	56065	53	192.168.2.4	1.1.1.1
Jan 13, 2025 09:44:17.399288893 CET	53	56065	1.1.1.1	192.168.2.4
Jan 13, 2025 09:45:17.916654110 CET	51616	53	192.168.2.4	1.1.1.1
Jan 13, 2025 09:45:17.923825979 CET	53	51616	1.1.1.1	192.168.2.4
Jan 13, 2025 09:46:04.260328054 CET	52234	53	192.168.2.4	1.1.1.1
Jan 13, 2025 09:46:04.277295113 CET	53	52234	1.1.1.1	192.168.2.4
Jan 13, 2025 09:47:05.119776964 CET	58732	53	192.168.2.4	1.1.1.1
Jan 13, 2025 09:47:05.129661083 CET	53	58732	1.1.1.1	192.168.2.4
Jan 13, 2025 09:48:05.213515043 CET	54218	53	192.168.2.4	1.1.1.1
Jan 13, 2025 09:48:05.229237080 CET	53	54218	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 09:44:17.382467031 CET	192.168.2.4	1.1.1.1	0xe60c	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:45:17.916654110 CET	192.168.2.4	1.1.1.1	0x3fb4	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:46:04.260328054 CET	192.168.2.4	1.1.1.1	0xbcb1	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:47:05.119776964 CET	192.168.2.4	1.1.1.1	0x2b9f	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:48:05.213515043 CET	192.168.2.4	1.1.1.1	0x1a2b	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 09:44:17.399288893 CET	1.1.1.1	192.168.2.4	0xe60c	No error (0)	0.tcp.in.ngrok.io	3.6.231.193	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:45:17.923825979 CET	1.1.1.1	192.168.2.4	0x3fb4	No error (0)	0.tcp.in.ngrok.io	13.202.226.61	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:46:04.277295113 CET	1.1.1.1	192.168.2.4	0xbcb1	No error (0)	0.tcp.in.ngrok.io	3.6.231.193	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:47:05.129661083 CET	1.1.1.1	192.168.2.4	0x2b9f	No error (0)	0.tcp.in.ngrok.io	3.6.231.193	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:48:05.229237080 CET	1.1.1.1	192.168.2.4	0x1a2b	No error (0)	0.tcp.in.ngrok.io	13.202.226.61	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:44:13
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\Client-base.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Client-base.exe"
Imagebase:	0x500000
File size:	3'266'048 bytes
MD5 hash:	21CE4CD2CE246C86222B57B93CDC92BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.1758259602.0000000000820000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.4214131861.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.1757918698.0000000000502000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	03:44:15
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.1775574902.000002140D1E0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.1775347331.000000207E7F9000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.1775529562.000002140CEF0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.1775529562.000002140CEF8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.1775574902.000002140D1E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:44:15
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B9655D6 Relevance: 2.1, Instructions: 2117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4221058239.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_Client-base.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f6a2a3050315c2a41ea7c0607e12f988c97c3a643be40a56bd3ab918a094d4
Instruction ID: e22d8e836af8d31ced04c4641e225bd9d9c55c873ca4a3030ecef2b8def879c3
Opcode Fuzzy Hash: 49f6a2a3050315c2a41ea7c0607e12f988c97c3a643be40a56bd3ab918a094d4
Instruction Fuzzy Hash: FFF2A170A29A0D8FDFA8DF68C4A4BA977E1FF58300F1141A9D44ED72A6DE35E941CB40

Function 00007FFD9B969BD1 Relevance: 1.5, Instructions: 1479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4221058239.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_Client-base.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a324fa52688d6b0dff4f7ca7149c24b973deca26552b1f504899cae0a50b266e
Instruction ID: d47ba7d908467eb433292091b2df9a88d430676336dafe00bcdc967eebf92166
Opcode Fuzzy Hash: a324fa52688d6b0dff4f7ca7149c24b973deca26552b1f504899cae0a50b266e
Instruction Fuzzy Hash: 21921A31B1D94D8FEBA8EB6C9465A7937D1EF99310F0500BAE44EC72E6DE24EC428741

Function 00007FFD9B96AFDD Relevance: .9, Instructions: 860
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4221058239.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_Client-base.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65af8ffc74d2db9b140c57d5f4ec36c9faacd75a1bd6b4df78a931521c1f9f9
Instruction ID: 6946cec38ebdc2eccec085c1768c56de935b16edf9be79614801ff2b1504815f
Opcode Fuzzy Hash: b65af8ffc74d2db9b140c57d5f4ec36c9faacd75a1bd6b4df78a931521c1f9f9
Instruction Fuzzy Hash: D3528330B18A098FDB98EB2CC4A5B6977E1FF99300F5545B9E44EC72A6DE34E841CB41

Function 00007FFD9B969271 Relevance: .7, Instructions: 680
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4221058239.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_Client-base.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bf72161808d3740b3135d5656ec1537297a26539570472ffba87852f2160150
Instruction ID: a834d04f310f7693f79d00569b7441a41dd32a5ef3dc31c954625fc9ac6eb3d5
Opcode Fuzzy Hash: 8bf72161808d3740b3135d5656ec1537297a26539570472ffba87852f2160150
Instruction Fuzzy Hash: 6E226E30B19A0D8FEBA8DB5C84A97B977E2FF99300F15417DD44EC72E6CE24A9428741

Function 00007FFD9B96621F Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4221058239.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_Client-base.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7655b1b1181c7515ee3e87c73a1bb9ae8fa4920023244b73f9fa54726c28932
Instruction ID: 452af31ec9f9218b50cd2fa5b3ced6c10414e109f6c2ad9be5bfe8aa22beefef
Opcode Fuzzy Hash: b7655b1b1181c7515ee3e87c73a1bb9ae8fa4920023244b73f9fa54726c28932
Instruction Fuzzy Hash: D5025C30E28A1D8FEBA8DF58C4957A977E1FF98301F1541B9D44ED32A6DE34B9818B40

Function 00007FFD9B96E709 Relevance: 1.8, APIs: 1, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD9B96E8F6

Memory Dump Source

Source File: 00000000.00000002.4221058239.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b960000_Client-base.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 99ae63ee70a1eadb7d1d94ae2b987fdf401795f4216e64265aca81256060e402
Instruction ID: 61350dae44721f3c9731c2ee0851ca4fc1f2465a520bf0165fa1e6878e3f30c3
Opcode Fuzzy Hash: 99ae63ee70a1eadb7d1d94ae2b987fdf401795f4216e64265aca81256060e402
Instruction Fuzzy Hash: 24711631B1DE4D5FDB58AB6C98A65F97BE1EF59310B0401BED04AC31A3DE24AC4687C1

Function 00007FFD9B6F3525 Relevance: 1.7, APIs: 1, Instructions: 169
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B6F3607

Memory Dump Source

Source File: 00000000.00000002.4218982860.00007FFD9B6F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6f0000_Client-base.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c93a2fdc3b849aad5451cd9398253a702176410a537a0d09f18157913813a0dc
Instruction ID: 6b35aaf149cfac7965dc5dfea57002472ace1e2fdf9211a16454cd7692017de1
Opcode Fuzzy Hash: c93a2fdc3b849aad5451cd9398253a702176410a537a0d09f18157913813a0dc
Instruction Fuzzy Hash: E3511631A0DB4C4FDB59DB6C8895AF9BFE1EF65310F0442BFD049C72A2CA24A9458781

Function 00007FFD9B6F3650 Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4218982860.00007FFD9B6F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6f0000_Client-base.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10b566bd4692e0bfaa13e4b17104d40eecc134af6ace87b01dbaceae420d18b
Instruction ID: c9dded09cf63d031ce6c10a2740a823d8f4282a6212a0cba7c7a5feaafef1b2d
Opcode Fuzzy Hash: d10b566bd4692e0bfaa13e4b17104d40eecc134af6ace87b01dbaceae420d18b
Instruction Fuzzy Hash: 3B313571F0D64A4EEB24ABA894262F9BBE1EF41310F00027ED069C72D6CF69B9458781

Function 00007FFD9B6F3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B6F3607

Memory Dump Source

Source File: 00000000.00000002.4218982860.00007FFD9B6F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6f0000_Client-base.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 870106628b2b55c3a43b3c29b321dbfc901a85682413f788b718bed1f9432b96
Instruction ID: 16383bbfc94b01492328a291435ae14587b806f391e62c27bee741f419bb00de
Opcode Fuzzy Hash: 870106628b2b55c3a43b3c29b321dbfc901a85682413f788b718bed1f9432b96
Instruction Fuzzy Hash: 0D31C13190DB5C8FDB19DB588859AE9BBF0FF65310F04426FD049D7292DB74A805CB91

Non-executed Functions

Function 00007FFD9B701867 Relevance: 2.0, Strings: 1, Instructions: 763COMMON

Download Yara Rule

Strings

&N_^, xrefs: 00007FFD9B701E01

Memory Dump Source

Source File: 00000000.00000002.4218982860.00007FFD9B6F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6f0000_Client-base.jbxd

Similarity

API ID:
String ID: &N_^
API String ID: 0-1877586524
Opcode ID: 23a0b35c5221b0a2191e0c7560c4ddd6eb14daf95e19646a51ef908dff3500b9
Instruction ID: e98e336fadf568b84694c690b7a41ab6f0a6d32eb3e5abc1aae1d557a9ec9d84
Opcode Fuzzy Hash: 23a0b35c5221b0a2191e0c7560c4ddd6eb14daf95e19646a51ef908dff3500b9
Instruction Fuzzy Hash: 6B227F16B0D1A30AE30677BC78B29EA7FA0CF4227974C41F7D1ED8D0D79C0D244A82A6

Function 00007FFD9B6FF1F2 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4218982860.00007FFD9B6F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b6f0000_Client-base.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f649c12657db36e1625a39495238a8e5e75b9b252a87d7026386d37b8ec167bf
Instruction ID: 0bd2ca51c7429e4a8ca198cb475bee7c09eb08c427a759ecb03e4fdfbd23c700
Opcode Fuzzy Hash: f649c12657db36e1625a39495238a8e5e75b9b252a87d7026386d37b8ec167bf
Instruction Fuzzy Hash: 17310517B0E1A316F717B3BC74F29E63BA09F5223974841F7D19D4D0E79C0D688A4296

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Client-base.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

AV Detection

E-Banking Fraud

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
Client-base.exe

Function 00007FFD9B969BD1 Relevance: 1.5, Instructions: 1479
COMMON

Function 00007FFD9B96AFDD Relevance: .9, Instructions: 860
COMMON

Function 00007FFD9B969271 Relevance: .7, Instructions: 680
COMMON

Function 00007FFD9B96E709 Relevance: 1.8, APIs: 1, Instructions: 275
COMMON

Function 00007FFD9B6F3525 Relevance: 1.7, APIs: 1, Instructions: 169
fileCOMMON

Function 00007FFD9B6F3650 Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Function 00007FFD9B6F3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON