Windows Analysis Report
S91AYfMUT0.exe

AI detected suspicious sample

Source: Yara match	File source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3742139950.0000000003412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1496792749.0000000000800000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3742035824.0000000003400000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6116, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\directory\icon.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: S91AYfMUT0.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		9_2_004338C8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		13_2_004338C8

Source: icon.exe, 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_2c01edba-d

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6116, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00407538 _wcslen,CoGetObject,		9_2_00407538
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00407538 _wcslen,CoGetObject,		13_2_00407538

Source: S91AYfMUT0.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: icon.exe, 00000008.00000003.1337200630.0000000003880000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 00000008.00000003.1335604041.0000000003650000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 0000000C.00000003.1492846740.0000000003690000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 0000000C.00000003.1493315506.00000000034F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: icon.exe, 00000008.00000003.1337200630.0000000003880000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 00000008.00000003.1335604041.0000000003650000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 0000000C.00000003.1492846740.0000000003690000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 0000000C.00000003.1493315506.00000000034F0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00684696 GetFileAttributesW,FindFirstFileW,FindClose,	6_2_00684696
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068C93C FindFirstFileW,FindClose,	6_2_0068C93C
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	6_2_0068C9C7
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_0068F200
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_0068F35D
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	6_2_0068F65E
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00683A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00683A2B
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00683D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00683D4E
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	6_2_0068BF27
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00074696 GetFileAttributesW,FindFirstFileW,FindClose,	8_2_00074696
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007C93C FindFirstFileW,FindClose,	8_2_0007C93C
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	8_2_0007C9C7
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0007F200
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0007F35D
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_0007F65E
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00073A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_00073A2B
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00073D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_00073D4E
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_0007BF27
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	9_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	9_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	9_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	9_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	9_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00407877 FindFirstFileW,FindNextFileW,	9_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0044E8F9 FindFirstFileExA,	9_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	9_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	9_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	9_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	13_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	13_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	13_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	13_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	13_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00407877 FindFirstFileW,FindNextFileW,	13_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0044E8F9 FindFirstFileExA,	13_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	13_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	13_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	13_2_0040BD72

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 9_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

9_2_00407CD2

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49701 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49719 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49721 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49722 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49716 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49731 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49703 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49743 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49758 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49728 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49739 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49752 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49770 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49714 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49776 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49778 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49786 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49735 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49742 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49756 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49732 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49705 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49710 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49806 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49760 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49745 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49749 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49729 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49759 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49751 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49782 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49747 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49794 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49717 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49746 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49797 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49753 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49769 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49712 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49702 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49798 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49741 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49761 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49748 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49700 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49793 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49787 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49799 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49733 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49779 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49711 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49724 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49744 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49784 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49718 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49709 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49765 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49800 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49725 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49755 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49768 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49737 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49788 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49772 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49780 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49795 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49766 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49764 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49713 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49785 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49730 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49767 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49715 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49789 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49771 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49803 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49775 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49790 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49783 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49726 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49727 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49720 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49802 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49807 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49774 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49754 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49738 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49801 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49734 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49791 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49736 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49804 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49740 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49781 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49773 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49757 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49762 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49777 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49750 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49796 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49763 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49805 -> 45.95.169.137:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49792 -> 45.95.169.137:2404

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 45.95.169.137 2404

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.95.169.137

Source: global traffic

TCP traffic: 192.168.2.10:49700 -> 45.95.169.137:2404

Source: Joe Sandbox View

ASN Name: GIGANET-HUGigaNetInternetServiceProviderCoHU GIGANET-HUGigaNetInternetServiceProviderCoHU

Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.137

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_006925E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

6_2_006925E2

Source: svchost.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: icon.exe, 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, icon.exe, 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 9_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

9_2_0040A2F3

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_0069425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

6_2_0069425A

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00694458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	6_2_00694458
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00084458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	8_2_00084458
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	9_2_004168FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	13_2_004168FC

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

6_2_0069425A

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00680219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

6_2_00680219

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_006ACDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		6_2_006ACDAC
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0009CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		8_2_0009CDAC

Source: Yara match	File source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6116, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3742139950.0000000003412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1496792749.0000000000800000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3742035824.0000000003400000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6116, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0041CA73 SystemParametersInfoW,		9_2_0041CA73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041CA73 SystemParametersInfoW,		13_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: icon.exe PID: 7212, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: svchost.exe PID: 7284, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: icon.exe PID: 7676, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: svchost.exe PID: 6116, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: This is a third-party compiled AutoIt script.	6_2_00623B4C
Source: S91AYfMUT0.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: S91AYfMUT0.exe, 00000006.00000002.1309579705.00000000006D5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_92c2fa67-8
Source: S91AYfMUT0.exe, 00000006.00000002.1309579705.00000000006D5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_ca072f58-7
Source: S91AYfMUT0.exe, 00000006.00000003.1307801735.0000000003A45000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_3e58b70f-9
Source: S91AYfMUT0.exe, 00000006.00000003.1307801735.0000000003A45000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_3d1fecb7-2
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: This is a third-party compiled AutoIt script.	8_2_00013B4C
Source: icon.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: icon.exe, 00000008.00000000.1308705452.00000000000C5000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4b3d5142-5
Source: icon.exe, 00000008.00000000.1308705452.00000000000C5000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_2eef661d-d
Source: icon.exe, 0000000C.00000000.1463361438.00000000000C5000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e32b8ba0-f
Source: icon.exe, 0000000C.00000000.1463361438.00000000000C5000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_dacc41c0-5
Source: S91AYfMUT0.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_91693d92-4
Source: S91AYfMUT0.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_953966b2-1
Source: icon.exe.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_cb6066bb-4
Source: icon.exe.6.dr	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1939fa0e-d

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00684021: CreateFileW,DeviceIoControl,CloseHandle,

6_2_00684021

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00678AF9 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,

6_2_00678AF9

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	6_2_0068545F
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	8_2_0007545F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	9_2_004167EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	13_2_004167EF

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0062E800	6_2_0062E800
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0064DBB5	6_2_0064DBB5
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0062FE40	6_2_0062FE40
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0062E060	6_2_0062E060
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_006A804A	6_2_006A804A
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00634140	6_2_00634140
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00642405	6_2_00642405
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00656522	6_2_00656522
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_006A0665	6_2_006A0665
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0065267E	6_2_0065267E
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00636843	6_2_00636843
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0064283A	6_2_0064283A
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_006589DF	6_2_006589DF
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00638A0E	6_2_00638A0E
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_006A0AE2	6_2_006A0AE2
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00656A94	6_2_00656A94
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0067EB07	6_2_0067EB07
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00688B13	6_2_00688B13
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0064CD61	6_2_0064CD61
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00657006	6_2_00657006
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0063710E	6_2_0063710E
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00633190	6_2_00633190
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00621287	6_2_00621287
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_006433C7	6_2_006433C7
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0064F419	6_2_0064F419
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_006416C4	6_2_006416C4
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00635680	6_2_00635680
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_006358C0	6_2_006358C0
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_006478D3	6_2_006478D3
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00641BB8	6_2_00641BB8
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00659D05	6_2_00659D05
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0064BFE6	6_2_0064BFE6
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00641FD0	6_2_00641FD0
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00F335F0	6_2_00F335F0
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0001E060	8_2_0001E060
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0001E800	8_2_0001E800
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0003DBB5	8_2_0003DBB5
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0001FE40	8_2_0001FE40
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0009804A	8_2_0009804A
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00024140	8_2_00024140
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00032405	8_2_00032405
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00046522	8_2_00046522
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00090665	8_2_00090665
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0004267E	8_2_0004267E
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0003283A	8_2_0003283A
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00026843	8_2_00026843
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_000489DF	8_2_000489DF
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00028A0E	8_2_00028A0E
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00046A94	8_2_00046A94
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00090AE2	8_2_00090AE2
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0006EB07	8_2_0006EB07
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00078B13	8_2_00078B13
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0003CD61	8_2_0003CD61
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00047006	8_2_00047006
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0002710E	8_2_0002710E
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00023190	8_2_00023190
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00011287	8_2_00011287
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_000333C7	8_2_000333C7
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0003F419	8_2_0003F419
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00025680	8_2_00025680
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_000316C4	8_2_000316C4
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_000258C0	8_2_000258C0
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_000378D3	8_2_000378D3
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00031BB8	8_2_00031BB8
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00049D05	8_2_00049D05
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00031FD0	8_2_00031FD0
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0003BFE6	8_2_0003BFE6
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_031235F0	8_2_031235F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0043706A	9_2_0043706A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00414005	9_2_00414005
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0043E11C	9_2_0043E11C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004541D9	9_2_004541D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004381E8	9_2_004381E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0041F18B	9_2_0041F18B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00446270	9_2_00446270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0043E34B	9_2_0043E34B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004533AB	9_2_004533AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0042742E	9_2_0042742E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00437566	9_2_00437566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0043E5A8	9_2_0043E5A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004387F0	9_2_004387F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0043797E	9_2_0043797E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004339D7	9_2_004339D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0044DA49	9_2_0044DA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00427AD7	9_2_00427AD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0041DBF3	9_2_0041DBF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00427C40	9_2_00427C40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00437DB3	9_2_00437DB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00435EEB	9_2_00435EEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0043DEED	9_2_0043DEED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00426E9F	9_2_00426E9F
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 12_2_02EB35F0	12_2_02EB35F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0043706A	13_2_0043706A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00414005	13_2_00414005
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0043E11C	13_2_0043E11C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004541D9	13_2_004541D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004381E8	13_2_004381E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041F18B	13_2_0041F18B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00446270	13_2_00446270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0043E34B	13_2_0043E34B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004533AB	13_2_004533AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0042742E	13_2_0042742E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00437566	13_2_00437566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0043E5A8	13_2_0043E5A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004387F0	13_2_004387F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0043797E	13_2_0043797E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004339D7	13_2_004339D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0044DA49	13_2_0044DA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00427AD7	13_2_00427AD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041DBF3	13_2_0041DBF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00427C40	13_2_00427C40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00437DB3	13_2_00437DB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00435EEB	13_2_00435EEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0043DEED	13_2_0043DEED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00426E9F	13_2_00426E9F

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00402213 appears 38 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 004052FD appears 32 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0040417E appears 46 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00402093 appears 100 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00401E65 appears 68 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00434E70 appears 108 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00401FAB appears 38 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 004020DF appears 40 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00434801 appears 82 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00457AA8 appears 34 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00445951 appears 56 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0044854A appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00411FA2 appears 32 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 004046F7 appears 34 times
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: String function: 00017F41 appears 35 times
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: String function: 00038B40 appears 42 times
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: String function: 00030D27 appears 70 times
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: String function: 00627F41 appears 35 times
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: String function: 00648B40 appears 42 times
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: String function: 00640D27 appears 70 times

Source: S91AYfMUT0.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: icon.exe PID: 7212, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: svchost.exe PID: 7284, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: icon.exe PID: 7676, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: svchost.exe PID: 6116, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@10/10@0/1

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_0068A2D5 GetLastError,FormatMessageW,

6_2_0068A2D5

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00678713 AdjustTokenPrivileges,CloseHandle,	6_2_00678713
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00678CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	6_2_00678CC3
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00068713 AdjustTokenPrivileges,CloseHandle,	8_2_00068713
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00068CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	8_2_00068CC3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	9_2_0041798D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	13_2_0041798D

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_0068B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

6_2_0068B59E

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_0069F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

6_2_0069F121

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_0067DA5D CoCreateInstance,SetErrorMode,GetProcAddress,SetErrorMode,

6_2_0067DA5D

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00624FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

6_2_00624FE9

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 9_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

9_2_0041AADB

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

File created: C:\Users\user\AppData\Local\directory

Source: C:\Windows\SysWOW64\svchost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-203ZZ1

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

File created: C:\Users\user\AppData\Local\Temp\autAF64.tmp

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\icon.vbs"

Source: S91AYfMUT0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: S91AYfMUT0.exe

ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

File read: C:\Users\user\Desktop\S91AYfMUT0.exe

Source: unknown	Process created: C:\Users\user\Desktop\S91AYfMUT0.exe "C:\Users\user\Desktop\S91AYfMUT0.exe"
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Process created: C:\Users\user\AppData\Local\directory\icon.exe "C:\Users\user\Desktop\S91AYfMUT0.exe"
Source: C:\Users\user\AppData\Local\directory\icon.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\S91AYfMUT0.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\icon.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\icon.exe "C:\Users\user\AppData\Local\directory\icon.exe"
Source: C:\Users\user\AppData\Local\directory\icon.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\directory\icon.exe"
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Process created: C:\Users\user\AppData\Local\directory\icon.exe "C:\Users\user\Desktop\S91AYfMUT0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\S91AYfMUT0.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\icon.exe "C:\Users\user\AppData\Local\directory\icon.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\directory\icon.exe"	Jump to behavior

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Drops VBS files to the startup folder

Source: S91AYfMUT0.exe

Static file information: File size 1279488 > 1048576

Source: S91AYfMUT0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: S91AYfMUT0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: S91AYfMUT0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: S91AYfMUT0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: S91AYfMUT0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: S91AYfMUT0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: S91AYfMUT0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: icon.exe, 00000008.00000003.1337200630.0000000003880000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 00000008.00000003.1335604041.0000000003650000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 0000000C.00000003.1492846740.0000000003690000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 0000000C.00000003.1493315506.00000000034F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: icon.exe, 00000008.00000003.1337200630.0000000003880000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 00000008.00000003.1335604041.0000000003650000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 0000000C.00000003.1492846740.0000000003690000.00000004.00001000.00020000.00000000.sdmp, icon.exe, 0000000C.00000003.1493315506.00000000034F0000.00000004.00001000.00020000.00000000.sdmp

Source: S91AYfMUT0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: S91AYfMUT0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: S91AYfMUT0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: S91AYfMUT0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: S91AYfMUT0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_0069C304 LoadLibraryA,GetProcAddress,

6_2_0069C304

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0062C590 push eax; retn 0062h	6_2_0062C599
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00648B85 push ecx; ret	6_2_00648B98
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0001C590 push eax; retn 0001h	8_2_0001C599
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00038B85 push ecx; ret	8_2_00038B98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00457186 push ecx; ret	9_2_00457199
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0045E55D push esi; ret	9_2_0045E566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00457AA8 push eax; ret	9_2_00457AC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00434EB6 push ecx; ret	9_2_00434EC9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00457186 push ecx; ret	13_2_00457199
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0045E55D push esi; ret	13_2_0045E566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00457AA8 push eax; ret	13_2_00457AC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00434EB6 push ecx; ret	13_2_00434EC9

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 9_2_00406EEB ShellExecuteW,URLDownloadToFileW,

9_2_00406EEB

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

File created: C:\Users\user\AppData\Local\directory\icon.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\AppData\Local\directory\icon.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\icon.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\directory\icon.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\icon.vbs

Source: C:\Users\user\AppData\Local\directory\icon.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\icon.vbs

Delayed program exit found

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 9_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

9_2_0041AADB

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00624A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	6_2_00624A35
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_006A55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	6_2_006A55FD
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00014A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	8_2_00014A35
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_000955FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	8_2_000955FD

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_006433C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_006433C7

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040F7E2 Sleep,ExitProcess,		9_2_0040F7E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040F7E2 Sleep,ExitProcess,		13_2_0040F7E2

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\directory\icon.exe	API/Special instruction interceptor: Address: 3123214
Source: C:\Users\user\AppData\Local\directory\icon.exe	API/Special instruction interceptor: Address: 2EB3214

Source: C:\Windows\SysWOW64\svchost.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		9_2_0041A7D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		13_2_0041A7D9

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\svchost.exe

Window / User API: threadDelayed 9749

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_6-100485
Source: C:\Users\user\AppData\Local\directory\icon.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	API coverage: 5.0 %
Source: C:\Users\user\AppData\Local\directory\icon.exe	API coverage: 5.2 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 9.3 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 6.2 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 7328	Thread sleep count: 196 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7328	Thread sleep time: -588000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7328	Thread sleep count: 9749 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7328	Thread sleep time: -29247000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00684696 GetFileAttributesW,FindFirstFileW,FindClose,	6_2_00684696
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068C93C FindFirstFileW,FindClose,	6_2_0068C93C
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	6_2_0068C9C7
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_0068F200
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_0068F35D
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	6_2_0068F65E
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00683A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00683A2B
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00683D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00683D4E
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0068BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	6_2_0068BF27
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00074696 GetFileAttributesW,FindFirstFileW,FindClose,	8_2_00074696
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007C93C FindFirstFileW,FindClose,	8_2_0007C93C
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	8_2_0007C9C7
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0007F200
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0007F35D
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_0007F65E
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00073A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_00073A2B
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00073D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_00073D4E
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0007BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_0007BF27
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	9_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	9_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	9_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	9_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	9_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00407877 FindFirstFileW,FindNextFileW,	9_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0044E8F9 FindFirstFileExA,	9_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	9_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	9_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	9_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	13_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	13_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	13_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	13_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	13_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00407877 FindFirstFileW,FindNextFileW,	13_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0044E8F9 FindFirstFileExA,	13_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	13_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	13_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	13_2_0040BD72

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 9_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

9_2_00407CD2

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00624AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00624AFE

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior

Source: svchost.exe, 00000009.00000002.3742139950.0000000003412000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	API call chain: ExitProcess graph end node	graph_6-97882
Source: C:\Users\user\AppData\Local\directory\icon.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_006941FD BlockInput,

6_2_006941FD

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00623B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

6_2_00623B4C

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00655CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

6_2_00655CCC

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_0069C304 LoadLibraryA,GetProcAddress,

6_2_0069C304

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00F334E0 mov eax, dword ptr fs:[00000030h]	6_2_00F334E0
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00F33480 mov eax, dword ptr fs:[00000030h]	6_2_00F33480
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00F31E70 mov eax, dword ptr fs:[00000030h]	6_2_00F31E70
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_03123480 mov eax, dword ptr fs:[00000030h]	8_2_03123480
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_031234E0 mov eax, dword ptr fs:[00000030h]	8_2_031234E0
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_03121E70 mov eax, dword ptr fs:[00000030h]	8_2_03121E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00443355 mov eax, dword ptr fs:[00000030h]	9_2_00443355
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 12_2_02EB34E0 mov eax, dword ptr fs:[00000030h]	12_2_02EB34E0
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 12_2_02EB1E70 mov eax, dword ptr fs:[00000030h]	12_2_02EB1E70
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 12_2_02EB3480 mov eax, dword ptr fs:[00000030h]	12_2_02EB3480
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00443355 mov eax, dword ptr fs:[00000030h]	13_2_00443355

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_006781F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

6_2_006781F7

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0064A364 SetUnhandledExceptionFilter,	6_2_0064A364
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_0064A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0064A395
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0003A364 SetUnhandledExceptionFilter,	8_2_0003A364
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_0003A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0003A395
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0043503C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00434A8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0043BB71
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00434BD8 SetUnhandledExceptionFilter,	9_2_00434BD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_0043503C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00434A8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_0043BB71
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00434BD8 SetUnhandledExceptionFilter,	13_2_00434BD8

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 45.95.169.137 2404

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\directory\icon.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2FC0008			Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2FC008			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		9_2_00412132
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		13_2_00412132

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00678C93 LogonUserW,

6_2_00678C93

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00623B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

6_2_00623B4C

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00624A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

6_2_00624A35

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00684EF5 mouse_event,

6_2_00684EF5

Source: C:\Users\user\AppData\Local\directory\icon.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\S91AYfMUT0.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\icon.exe "C:\Users\user\AppData\Local\directory\icon.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\icon.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\directory\icon.exe"	Jump to behavior

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

6_2_006781F7

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00684C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

6_2_00684C03

Source: S91AYfMUT0.exe, icon.exe.6.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: S91AYfMUT0.exe, icon.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_0064886B cpuid

6_2_0064886B

Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	9_2_0045201B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	9_2_004520B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_00452143
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	9_2_00452393
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	9_2_00448484
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_004524BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	9_2_004525C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00452690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	9_2_0044896D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoA,	9_2_0040F90C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	9_2_00451D58
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	9_2_00451FD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	13_2_0045201B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	13_2_004520B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	13_2_00452143
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	13_2_00452393
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	13_2_00448484
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	13_2_004524BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	13_2_004525C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	13_2_00452690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	13_2_0044896D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoA,	13_2_0040F90C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	13_2_00451D58
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	13_2_00451FD0

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_006550D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_006550D7

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00662230 GetUserNameW,

6_2_00662230

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_0065418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

6_2_0065418A

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Code function: 6_2_00624AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00624AFE

Source: C:\Users\user\Desktop\S91AYfMUT0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3742139950.0000000003412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1496792749.0000000000800000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3742035824.0000000003400000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6116, type: MEMORYSTR

Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		9_2_0040BA4D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		13_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	9_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \key3.db	9_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	13_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \key3.db	13_2_0040BB6B

Source: icon.exe	Binary or memory string: WIN_81
Source: icon.exe	Binary or memory string: WIN_XP
Source: icon.exe	Binary or memory string: WIN_XPe
Source: icon.exe	Binary or memory string: WIN_VISTA
Source: icon.exe	Binary or memory string: WIN_7
Source: icon.exe	Binary or memory string: WIN_8
Source: icon.exe.6.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\SysWOW64\svchost.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-203ZZ1			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-203ZZ1			Jump to behavior

Source: Yara match	File source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.icon.exe.3470000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.icon.exe.3130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3742139950.0000000003412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1496792749.0000000000800000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3742035824.0000000003400000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: icon.exe PID: 7676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6116, type: MEMORYSTR

Source: C:\Windows\SysWOW64\svchost.exe	Code function: cmd.exe		9_2_0040569A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: cmd.exe		13_2_0040569A

Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00696596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	6_2_00696596
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00696A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	6_2_00696A5A
Source: C:\Users\user\Desktop\S91AYfMUT0.exe	Code function: 6_2_00657CF1 RpcBindingSetOption,_LocaleUpdate::_LocaleUpdate,_memset,WideCharToMultiByte,GetLastError,_memset,	6_2_00657CF1
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00086596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	8_2_00086596
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00086A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	8_2_00086A5A
Source: C:\Users\user\AppData\Local\directory\icon.exe	Code function: 8_2_00047CF1 RpcBindingSetOption,_LocaleUpdate::_LocaleUpdate,_memset,WideCharToMultiByte,GetLastError,_memset,	8_2_00047CF1

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	2 Native API	111 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	2 Valid Accounts	1 Bypass User Account Control	2 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Windows Service	2 Valid Accounts	1 DLL Side-Loading	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Bypass User Account Control	LSA Secrets	126 System Information Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Windows Service	1 Masquerading	Cached Domain Credentials	231 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	322 Process Injection	2 Valid Accounts	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	322 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
S91AYfMUT0.exe	61%	ReversingLabs	Win32.Trojan.Formbooks
S91AYfMUT0.exe	100%	Avira	TR/AD.ShellcodeCrypter.itcqh
S91AYfMUT0.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\directory\icon.exe	100%	Avira	TR/AD.ShellcodeCrypter.itcqh
C:\Users\user\AppData\Local\directory\icon.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\directory\icon.exe	61%	ReversingLabs	Win32.Trojan.Formbooks

Source	Detection	Scanner	Label
5.95.169.137	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp/C	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
5.95.169.137	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	svchost.exe	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	icon.exe, 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, icon.exe, 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.95.169.137	unknown	Croatia (LOCAL Name: Hrvatska)		42864	GIGANET-HUGigaNetInternetServiceProviderCoHU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1510361
Start date and time:	2024-09-12 21:26:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	S91AYfMUT0.exe renamed because original name is a hash value
Original Sample Name:	b54974cd7b04beb5d6c5377ff6170f7b.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@10/10@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 63 Number of non-executed functions: 269
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: S91AYfMUT0.exe

Simulations

Behavior and APIs

Time	Type	Description
15:27:48	API Interceptor	3775048x Sleep call for process: svchost.exe modified
21:27:15	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\icon.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.95.169.137	#Inv_PI_{number_12}_pdf.exe	Get hash	malicious	Remcos	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GIGANET-HUGigaNetInternetServiceProviderCoHU	bot_library.exe	Get hash	malicious	Unknown	Browse	45.95.169.164
	jv4ri.exe	Get hash	malicious	Remcos	Browse	45.95.169.104
	P.O_Qouts_t87E90Y-E4R7G-PDF.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.95.169.18
	7GfciIf7ys.exe	Get hash	malicious	Unknown	Browse	45.95.169.223
	Qoute_EXW_prices_43GJI_pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.95.169.110
	Qoute_EXW_prices_43GJI_pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.95.169.110
	RFQ-7H87-F8R-pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.95.169.139
	Q-5687-348t.exe	Get hash	malicious	Remcos	Browse	45.95.169.135
	BdrPfb3rZS.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.95.169.149
	otpD06ykDv.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.95.169.149

Process:	C:\Users\user\Desktop\S91AYfMUT0.exe
File Type:	data
Category:	dropped
Size (bytes):	494592
Entropy (8bit):	7.521832179522871
Encrypted:	false
SSDEEP:	12288:Jwb5chAnrozu9fYyPSaWw2hoAwEto79Y/x0Vg:Jwb5chAnOSgy6aTb0Q9Y/x06
MD5:	356308ED0417041367FAD3A54E94411C
SHA1:	6B3C8E524C57820E5733E2D2F35848E56FE644BC
SHA-256:	C5BB3BEAD0D3DE9796BA0BBDE3C2910AA3A6B9CA442888FA5C4B7C1CBAFE1C49
SHA-512:	0F7CA1127B31EBE636208B499A2F4B0555F46F57CC279AEDE12784358F3B0124BBFCCC0F901DC97A9AE02A4469C73FCC74E72E5BC87BD5A43A997B559775717A
Malicious:	false
Reputation:	low
Preview:	...IAKIU7IZ6..GG.IBKIU3I.6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIZJIU=V.8O.N.v.C..tg!3Eo;5(0;#&i6R'4Y;k%"w;7%i<]i.y.k(3,lFD_.IZ6OKGG[2.f.O.7.,.5.].7..n+hS.H..b9.S.5...7.,.5.%.7.Q.+..KH.Q.9...4.O.7.r.45].7...YS.H.).9.S.5.O.7,-.5...6nQ.+..sH.Q.9...4.O.7._,#.].7BKIU3IZ6OKGGWIBKIU3IZ6OK..WI.JNU..POKGGWIBK.U1HQ7AKG5RIB]KU3IZ6..DGWYBKI.6IZ6.KGWWIBIIU6I[6OKGGRICKIU3IZ.GKGCWIBKIU1IZ.OKWGWYBKIU#IZ&OKGGWIRKIU3IZ6OKGG.DKMT3IZ.HK/.WIBKIU3IZ6OKGGWIBKI.4I..OK..QIzKIU3IZ6OKGGWIBKIU3I..IK_GWI.OUsIZ6OKGGWIBKI.6IZ3OKGGWIBKIU3IZ6OKGGWIBKIU3ItB33GWI.:LU3YZ6O9BGWMBKIU3IZ6OKGGWIbKI5.;>W;GG.0CKI.6IZLNKG1RIBKIU3IZ6OKGG.IB.g1R=;6OK..WIB[NU3GZ6O.AGWIBKIU3IZ6OK.GW.l?%&3IZ6FKGGW9EKIW3IZ.IKGGWIBKIU3IZ6.KG.y.$"-&3Ij4OKG.PIBOIU3I]6OKGGWIBKIU3I.6O.i5$;!KIU[.Z6O.@GW.BKIQ4IZ6OKGGWIBKIUsIZva9"+8*BK.n3IZ.HKG{WIB.NU3IZ6OKGGWIBK.U3.Z6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBKIU3IZ6OKGGWIBK

C:\Users\user\AppData\Local\Temp\autAF64.tmp

Process:	C:\Users\user\Desktop\S91AYfMUT0.exe
File Type:	data
Category:	dropped
Size (bytes):	409308
Entropy (8bit):	7.973460599748958
Encrypted:	false
SSDEEP:	12288:ZKehTXj7IWSlMpy8dcP5TgjYH87iI/xzc9:ZdhTTSlAvdcPZgsc7v/E
MD5:	91CC8186CCC1BA31ECCCC940564607E9
SHA1:	65524748A4CEFF46A551B3249F13AF9FF291D3A0
SHA-256:	583D92477A454F67A7C0A3636CF6D3FAA17350384183E03B82D5B711F712AF9C
SHA-512:	565F06AA2C6A6A21B11C5C33E5CAB09EC50AA44C16BC466E6BE3B1D4484A8B6968015B03645CF321EAA802B7FC716B53368C334304AF2DB64A94E2E8F167AB74
Malicious:	false
Reputation:	low
Preview:	EA06.....Gx.....U..kSm..G..h@.....S.tz=\.;5...J..g.o....b......t..ft[\|.k(.N.rkL.'.Vgv.,..;..m3..=y.Z.R....F.W.....Vh.?.7.K33X}w.7.sm.EO.H..lS..O)5....x`.....f.~W.....Z.Fs.......r.M&.......V@..t..9.......o,..f..."mn.89.."..pj!.i.....W.0.........u.U.....jj..EFoA...M..K....%..Y.88.`...K.....M&.6.....&.......G..1bcI.m.......:MjL....g}.z%..T..4.\.....mf...4...Ti7..O.}......+1O....<.P..w>..U3....y.2.3........M..lT.L.;;.U.r.=..0..b.N...5 .O./I.B.....v..@.@.En.U...............d.K&..h..L.K.....E$....^0..t.E-.-S@.#.P.....t.....!v...w!..+p .#.@.....Fh......k..E+.J.T......R)t{.......\|.....Z........t.....i.j..O.@...}.U.b.t..2....P..=2.Z.f/.J<;...."S=............b.R`.Y,/_..R.Q/W....}c.;.&.I.{f.......R..I.'...8zp.....p.../......c5..C.%...sK.R...\|#..uk..........I....[.-...0.......2.......h..A..P.r...C`.........._@..0.3$.F....:...V.t..>a........!..vb..~.)H..)...cc......lb``....lf.`../....#.+..1..#....5...#...f.......u.$.lK@..<'..lso....G....L.....iU.~3G.....

C:\Users\user\AppData\Local\Temp\autB010.tmp

Process:	C:\Users\user\Desktop\S91AYfMUT0.exe
File Type:	data
Category:	dropped
Size (bytes):	15306
Entropy (8bit):	7.608975512491679
Encrypted:	false
SSDEEP:	384:axFB0xhY6C6usolt9Ev+8QnxlFGOdFLj5W82F3rHiM:a90xE7Fovpy7/dFnIZ9
MD5:	E410190162FBA71E462649A0E4226FA0
SHA1:	568EE172DDC949038005DC08064E6193A53B401A
SHA-256:	994F01B7063FA279E0F58CF82C568B93D04E656CE932465843EB8A60992B6E8B
SHA-512:	3C34E5A9D4C39A172AA0B9F669A7B2B51ED8333B92B634771F92374756E0724C7A9F0CBA7FB3044F07CB3FCA0127061E47B232572E6C0D62CF35668F46D52F65
Malicious:	false
Reputation:	low
Preview:	EA06..........`.............0.\|L.... .>&........ .\|N...y..?.2.#.,@.....l.._.................7...,...........}. ...`.'.^.3P......q.M@+..0.?.a.....7...p\|..............D..K.......0........\|60-........ !_D....[\|.`.......\|.`.?.b......P...n.q....>....1...&........_...g.;.u..W....@N......8....l...&.......z.............6_p:7..d...,.._.%.......\|.P...........0V..h.9..w}..O....B..`_.........l.$..$...T.&.(.=.......0..d......}...D..#....'...t.........b?k .G.Aa.....`1..=..#.C..c..1.....C.J......@1..(.#.!...............T}............l...z..P.'....~p.........8?Y.B..1...,@..8B..3.`...)...&....$}.4..(...c..../>..o......I\|3`...p.y..E}.0.x%...Q.X@?.I.f..e...f...........~.=_.....'...........O8...&@/_.8W......X.9.{(...b.j..@._.$..3.@...N..l..h.....\|.._E........~..$.......puO.......~.Q;..........K....e.......p4.........60.........v.3q...[.....`.O.HJ+.....g z.p..m4....&@4.8.G...I...>?..ww..M...R..I..2..1.H..T>...G......(}.pF.`/..3..`@................b.F....~....jh........2

C:\Users\user\AppData\Local\Temp\autBC06.tmp

Process:	C:\Users\user\AppData\Local\directory\icon.exe
File Type:	data
Category:	dropped
Size (bytes):	409308
Entropy (8bit):	7.973460599748958
Encrypted:	false
SSDEEP:	12288:ZKehTXj7IWSlMpy8dcP5TgjYH87iI/xzc9:ZdhTTSlAvdcPZgsc7v/E
MD5:	91CC8186CCC1BA31ECCCC940564607E9
SHA1:	65524748A4CEFF46A551B3249F13AF9FF291D3A0
SHA-256:	583D92477A454F67A7C0A3636CF6D3FAA17350384183E03B82D5B711F712AF9C
SHA-512:	565F06AA2C6A6A21B11C5C33E5CAB09EC50AA44C16BC466E6BE3B1D4484A8B6968015B03645CF321EAA802B7FC716B53368C334304AF2DB64A94E2E8F167AB74
Malicious:	false
Reputation:	low
Preview:	EA06.....Gx.....U..kSm..G..h@.....S.tz=\.;5...J..g.o....b......t..ft[\|.k(.N.rkL.'.Vgv.,..;..m3..=y.Z.R....F.W.....Vh.?.7.K33X}w.7.sm.EO.H..lS..O)5....x`.....f.~W.....Z.Fs.......r.M&.......V@..t..9.......o,..f..."mn.89.."..pj!.i.....W.0.........u.U.....jj..EFoA...M..K....%..Y.88.`...K.....M&.6.....&.......G..1bcI.m.......:MjL....g}.z%..T..4.\.....mf...4...Ti7..O.}......+1O....<.P..w>..U3....y.2.3........M..lT.L.;;.U.r.=..0..b.N...5 .O./I.B.....v..@.@.En.U...............d.K&..h..L.K.....E$....^0..t.E-.-S@.#.P.....t.....!v...w!..+p .#.@.....Fh......k..E+.J.T......R)t{.......\|.....Z........t.....i.j..O.@...}.U.b.t..2....P..=2.Z.f/.J<;...."S=............b.R`.Y,/_..R.Q/W....}c.;.&.I.{f.......R..I.'...8zp.....p.../......c5..C.%...sK.R...\|#..uk..........I....[.-...0.......2.......h..A..P.r...C`.........._@..0.3$.F....:...V.t..>a........!..vb..~.)H..)...cc......lb``....lf.`../....#.+..1..#....5...#...f.......u.$.lK@..<'..lso....G....L.....iU.~3G.....

C:\Users\user\AppData\Local\Temp\autBCB3.tmp

Process:	C:\Users\user\AppData\Local\directory\icon.exe
File Type:	data
Category:	dropped
Size (bytes):	15306
Entropy (8bit):	7.608975512491679
Encrypted:	false
SSDEEP:	384:axFB0xhY6C6usolt9Ev+8QnxlFGOdFLj5W82F3rHiM:a90xE7Fovpy7/dFnIZ9
MD5:	E410190162FBA71E462649A0E4226FA0
SHA1:	568EE172DDC949038005DC08064E6193A53B401A
SHA-256:	994F01B7063FA279E0F58CF82C568B93D04E656CE932465843EB8A60992B6E8B
SHA-512:	3C34E5A9D4C39A172AA0B9F669A7B2B51ED8333B92B634771F92374756E0724C7A9F0CBA7FB3044F07CB3FCA0127061E47B232572E6C0D62CF35668F46D52F65
Malicious:	false
Reputation:	low
Preview:	EA06..........`.............0.\|L.... .>&........ .\|N...y..?.2.#.,@.....l.._.................7...,...........}. ...`.'.^.3P......q.M@+..0.?.a.....7...p\|..............D..K.......0........\|60-........ !_D....[\|.`.......\|.`.?.b......P...n.q....>....1...&........_...g.;.u..W....@N......8....l...&.......z.............6_p:7..d...,.._.%.......\|.P...........0V..h.9..w}..O....B..`_.........l.$..$...T.&.(.=.......0..d......}...D..#....'...t.........b?k .G.Aa.....`1..=..#.C..c..1.....C.J......@1..(.#.!...............T}............l...z..P.'....~p.........8?Y.B..1...,@..8B..3.`...)...&....$}.4..(...c..../>..o......I\|3`...p.y..E}.0.x%...Q.X@?.I.f..e...f...........~.=_.....'...........O8...&@/_.8W......X.9.{(...b.j..@._.$..3.@...N..l..h.....\|.._E........~..$.......puO.......~.Q;..........K....e.......p4.........60.........v.3q...[.....`.O.HJ+.....g z.p..m4....&@4.8.G...I...>?..ww..M...R..I..2..1.H..T>...G......(}.pF.`/..3..`@................b.F....~....jh........2

C:\Users\user\AppData\Local\Temp\autF853.tmp

Process:	C:\Users\user\AppData\Local\directory\icon.exe
File Type:	data
Category:	dropped
Size (bytes):	409308
Entropy (8bit):	7.973460599748958
Encrypted:	false
SSDEEP:	12288:ZKehTXj7IWSlMpy8dcP5TgjYH87iI/xzc9:ZdhTTSlAvdcPZgsc7v/E
MD5:	91CC8186CCC1BA31ECCCC940564607E9
SHA1:	65524748A4CEFF46A551B3249F13AF9FF291D3A0
SHA-256:	583D92477A454F67A7C0A3636CF6D3FAA17350384183E03B82D5B711F712AF9C
SHA-512:	565F06AA2C6A6A21B11C5C33E5CAB09EC50AA44C16BC466E6BE3B1D4484A8B6968015B03645CF321EAA802B7FC716B53368C334304AF2DB64A94E2E8F167AB74
Malicious:	false
Reputation:	low
Preview:	EA06.....Gx.....U..kSm..G..h@.....S.tz=\.;5...J..g.o....b......t..ft[\|.k(.N.rkL.'.Vgv.,..;..m3..=y.Z.R....F.W.....Vh.?.7.K33X}w.7.sm.EO.H..lS..O)5....x`.....f.~W.....Z.Fs.......r.M&.......V@..t..9.......o,..f..."mn.89.."..pj!.i.....W.0.........u.U.....jj..EFoA...M..K....%..Y.88.`...K.....M&.6.....&.......G..1bcI.m.......:MjL....g}.z%..T..4.\.....mf...4...Ti7..O.}......+1O....<.P..w>..U3....y.2.3........M..lT.L.;;.U.r.=..0..b.N...5 .O./I.B.....v..@.@.En.U...............d.K&..h..L.K.....E$....^0..t.E-.-S@.#.P.....t.....!v...w!..+p .#.@.....Fh......k..E+.J.T......R)t{.......\|.....Z........t.....i.j..O.@...}.U.b.t..2....P..=2.Z.f/.J<;...."S=............b.R`.Y,/_..R.Q/W....}c.;.&.I.{f.......R..I.'...8zp.....p.../......c5..C.%...sK.R...\|#..uk..........I....[.-...0.......2.......h..A..P.r...C`.........._@..0.3$.F....:...V.t..>a........!..vb..~.)H..)...cc......lb``....lf.`../....#.+..1..#....5...#...f.......u.$.lK@..<'..lso....G....L.....iU.~3G.....

C:\Users\user\AppData\Local\Temp\autF900.tmp

Process:	C:\Users\user\AppData\Local\directory\icon.exe
File Type:	data
Category:	dropped
Size (bytes):	15306
Entropy (8bit):	7.608975512491679
Encrypted:	false
SSDEEP:	384:axFB0xhY6C6usolt9Ev+8QnxlFGOdFLj5W82F3rHiM:a90xE7Fovpy7/dFnIZ9
MD5:	E410190162FBA71E462649A0E4226FA0
SHA1:	568EE172DDC949038005DC08064E6193A53B401A
SHA-256:	994F01B7063FA279E0F58CF82C568B93D04E656CE932465843EB8A60992B6E8B
SHA-512:	3C34E5A9D4C39A172AA0B9F669A7B2B51ED8333B92B634771F92374756E0724C7A9F0CBA7FB3044F07CB3FCA0127061E47B232572E6C0D62CF35668F46D52F65
Malicious:	false
Reputation:	low
Preview:	EA06..........`.............0.\|L.... .>&........ .\|N...y..?.2.#.,@.....l.._.................7...,...........}. ...`.'.^.3P......q.M@+..0.?.a.....7...p\|..............D..K.......0........\|60-........ !_D....[\|.`.......\|.`.?.b......P...n.q....>....1...&........_...g.;.u..W....@N......8....l...&.......z.............6_p:7..d...,.._.%.......\|.P...........0V..h.9..w}..O....B..`_.........l.$..$...T.&.(.=.......0..d......}...D..#....'...t.........b?k .G.Aa.....`1..=..#.C..c..1.....C.J......@1..(.#.!...............T}............l...z..P.'....~p.........8?Y.B..1...,@..8B..3.`...)...&....$}.4..(...c..../>..o......I\|3`...p.y..E}.0.x%...Q.X@?.I.f..e...f...........~.=_.....'...........O8...&@/_.8W......X.9.{(...b.j..@._.$..3.@...N..l..h.....\|.._E........~..$.......puO.......~.Q;..........K....e.......p4.........60.........v.3q...[.....`.O.HJ+.....g z.p..m4....&@4.8.G...I...>?..ww..M...R..I..2..1.H..T>...G......(}.pF.`/..3..`@................b.F....~....jh........2

C:\Users\user\AppData\Local\Temp\demonetising

Process:	C:\Users\user\Desktop\S91AYfMUT0.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	200730
Entropy (8bit):	2.757297243983128
Encrypted:	false
SSDEEP:	192:dQyw4U1Emh0cHgDQNMo4eutXGlERJGrbmqsaogDVA9+ls4BqlF9HIrwVmclVw6XL:J
MD5:	B034F1AAA54283EE47C256574A85FF9A
SHA1:	5DE291E89694D741E0AF1BD240D1BAB7A8988DCF
SHA-256:	10F5C3A669BE97B559AB6B46CEE58A290CCCC74CCAA411723F278080A708EA3A
SHA-512:	83CEDBD49FF14E9F4FEBDD5F06606886F07D79D812E17EB7C936AA5EA89982D99E398122331C0A69F7684495F56777A7E6C3D195B359376700C03C447572964A
Malicious:	false
Reputation:	low
Preview:	9200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016092001609200160920016

C:\Users\user\AppData\Local\directory\icon.exe

Process:	C:\Users\user\Desktop\S91AYfMUT0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1279488
Entropy (8bit):	7.274827926243343
Encrypted:	false
SSDEEP:	24576:2AHnh+eWsN3skA4RV1Hom2KXMmHa3fGd4WclYQnJ/J+MB8hCdC45:Rh+ZkldoPK8Ya3ed4WcyAJB+M+hM
MD5:	B54974CD7B04BEB5D6C5377FF6170F7B
SHA1:	229EAFFC4F15CBF5B2E21D9360E396AEE53FB1B7
SHA-256:	9BEF149490674703ED211BD591252D0C1557251E2E0844F4D5885D84EC0207FF
SHA-512:	AC5D5BC201933745399D16D2E65967129005D1A41AED4B3988ADA76CE9926B752322E075353728FCACBCD84DACD9C74CA62A215A3BEC3810B10C986E4302CF11
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r...........#.S..._@'.S...R.k.S....".S...RichR...................PE..L....T.f.........."...............................@.......................................@...@.......@.........................\|............................`..4q...+..............................PK..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc................4..............@..@.reloc..4q...`...r..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\icon.vbs

Process:	C:\Users\user\AppData\Local\directory\icon.exe
File Type:	data
Category:	dropped
Size (bytes):	266
Entropy (8bit):	3.433075250668502
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfclq7UEZ+lX1Al1A3AlAnriIM8lfQVn:DsO+vNlq7Q1A1XlGmA2n
MD5:	A0C4D1B2E091A01F2D72A02B317238B4
SHA1:	CC80C96421CEAB6723CEF42BF7DB6564037633A8
SHA-256:	5DF477E0B33A0109BC03717BDDDBA076F3975945A82E9A7D0345E6488472F068
SHA-512:	5BD4C45B27A33A6A9B08FF388D24EC7574321502B3D68BE929891AA0875FD0EFC0DF1B7F98B71F2BF20644A867E073D7CAE3EB947B33563E5A5D72C0CA1EB039
Malicious:	true
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.b.r.o.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.d.i.r.e.c.t.o.r.y.\.i.c.o.n...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.274827926243343
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	S91AYfMUT0.exe
File size:	1'279'488 bytes
MD5:	b54974cd7b04beb5d6c5377ff6170f7b
SHA1:	229eaffc4f15cbf5b2e21d9360e396aee53fb1b7
SHA256:	9bef149490674703ed211bd591252d0c1557251e2e0844f4d5885d84ec0207ff
SHA512:	ac5d5bc201933745399d16d2e65967129005d1a41aed4b3988ada76ce9926b752322e075353728fcacbcd84dacd9c74ca62a215a3bec3810b10c986e4302cf11
SSDEEP:	24576:2AHnh+eWsN3skA4RV1Hom2KXMmHa3fGd4WclYQnJ/J+MB8hCdC45:Rh+ZkldoPK8Ya3ed4WcyAJB+M+hM
TLSH:	1A45BE02B3D6D036FFAB92739B6AF20196BD79250133852F12981DB9BD701B1273D663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	0f0dcc9a8acc490f

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D8540A [Wed Sep 4 12:35:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F9BDCB18ECDh
jmp 00007F9BDCB0BC84h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F9BDCB0BE0Ah
cmp edi, eax
jc 00007F9BDCB0C16Eh
bt dword ptr [004C41FCh], 01h
jnc 00007F9BDCB0BE09h
rep movsb
jmp 00007F9BDCB0C11Ch
cmp ecx, 00000080h
jc 00007F9BDCB0BFD4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F9BDCB0BE10h
bt dword ptr [004BF324h], 01h
jc 00007F9BDCB0C2E0h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F9BDCB0BFADh
test edi, 00000003h
jne 00007F9BDCB0BFBEh
test esi, 00000003h
jne 00007F9BDCB0BF9Dh
bt edi, 02h
jnc 00007F9BDCB0BE0Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F9BDCB0BE13h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F9BDCB0BE65h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x6def8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x136000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x6def8	0x6e000	aa1c6559593d5e0d16515ec3972d8941	False	0.9792658025568182	data	7.9755916936262565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x136000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc8458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc8580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc86a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc87d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.26011560693641617
RT_MENU	0xc8d38	0x50	data	English	Great Britain	0.9
RT_STRING	0xc8d88	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xc931c	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xc99a8	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xc9e38	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xca434	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcaa90	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcaef8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcb050	0x6a98a	data			1.0003229367547835
RT_GROUP_ICON	0x1359dc	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1359f0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x135a04	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x135a18	0x14	data	English	Great Britain	1.25
RT_VERSION	0x135a2c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x135b08	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-12T21:27:15.218010+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49700	45.95.169.137	2404	TCP
2024-09-12T21:27:17.917524+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49701	45.95.169.137	2404	TCP
2024-09-12T21:27:20.602886+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49702	45.95.169.137	2404	TCP
2024-09-12T21:27:23.550003+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49703	45.95.169.137	2404	TCP
2024-09-12T21:27:26.358167+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49705	45.95.169.137	2404	TCP
2024-09-12T21:27:29.076160+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49709	45.95.169.137	2404	TCP
2024-09-12T21:27:31.775526+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49710	45.95.169.137	2404	TCP
2024-09-12T21:27:34.478620+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49711	45.95.169.137	2404	TCP
2024-09-12T21:27:37.203367+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49712	45.95.169.137	2404	TCP
2024-09-12T21:27:39.925071+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49713	45.95.169.137	2404	TCP
2024-09-12T21:27:42.637414+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49714	45.95.169.137	2404	TCP
2024-09-12T21:27:45.344746+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49715	45.95.169.137	2404	TCP
2024-09-12T21:27:48.135008+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49716	45.95.169.137	2404	TCP
2024-09-12T21:27:50.822146+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49717	45.95.169.137	2404	TCP
2024-09-12T21:27:53.529767+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49718	45.95.169.137	2404	TCP
2024-09-12T21:27:56.229180+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49719	45.95.169.137	2404	TCP
2024-09-12T21:27:58.931805+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49720	45.95.169.137	2404	TCP
2024-09-12T21:28:01.636832+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49721	45.95.169.137	2404	TCP
2024-09-12T21:28:04.409147+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49722	45.95.169.137	2404	TCP
2024-09-12T21:28:07.371022+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49724	45.95.169.137	2404	TCP
2024-09-12T21:28:10.074508+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49725	45.95.169.137	2404	TCP
2024-09-12T21:28:13.059767+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49726	45.95.169.137	2404	TCP
2024-09-12T21:28:15.793463+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49727	45.95.169.137	2404	TCP
2024-09-12T21:28:18.496322+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49728	45.95.169.137	2404	TCP
2024-09-12T21:28:21.201793+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49729	45.95.169.137	2404	TCP
2024-09-12T21:28:23.990055+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49730	45.95.169.137	2404	TCP
2024-09-12T21:28:26.700938+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49731	45.95.169.137	2404	TCP
2024-09-12T21:28:29.405886+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49732	45.95.169.137	2404	TCP
2024-09-12T21:28:32.089053+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49733	45.95.169.137	2404	TCP
2024-09-12T21:28:34.795844+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49734	45.95.169.137	2404	TCP
2024-09-12T21:28:37.495044+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49735	45.95.169.137	2404	TCP
2024-09-12T21:28:40.199306+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49736	45.95.169.137	2404	TCP
2024-09-12T21:28:43.130186+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49737	45.95.169.137	2404	TCP
2024-09-12T21:28:45.795277+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49738	45.95.169.137	2404	TCP
2024-09-12T21:28:48.590013+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49739	45.95.169.137	2404	TCP
2024-09-12T21:28:53.589312+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49740	45.95.169.137	2404	TCP
2024-09-12T21:28:56.169469+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49741	45.95.169.137	2404	TCP
2024-09-12T21:28:58.714462+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49742	45.95.169.137	2404	TCP
2024-09-12T21:29:01.266431+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49743	45.95.169.137	2404	TCP
2024-09-12T21:29:03.777955+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49744	45.95.169.137	2404	TCP
2024-09-12T21:29:06.253062+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49745	45.95.169.137	2404	TCP
2024-09-12T21:29:08.707352+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49746	45.95.169.137	2404	TCP
2024-09-12T21:29:11.121127+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49747	45.95.169.137	2404	TCP
2024-09-12T21:29:13.495506+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49748	45.95.169.137	2404	TCP
2024-09-12T21:29:15.959830+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49749	45.95.169.137	2404	TCP
2024-09-12T21:29:18.308869+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49750	45.95.169.137	2404	TCP
2024-09-12T21:29:20.672062+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49751	45.95.169.137	2404	TCP
2024-09-12T21:29:22.987406+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49752	45.95.169.137	2404	TCP
2024-09-12T21:29:25.340075+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49753	45.95.169.137	2404	TCP
2024-09-12T21:29:27.747997+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49754	45.95.169.137	2404	TCP
2024-09-12T21:29:30.202831+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49755	45.95.169.137	2404	TCP
2024-09-12T21:29:32.438465+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49756	45.95.169.137	2404	TCP
2024-09-12T21:29:34.639455+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49757	45.95.169.137	2404	TCP
2024-09-12T21:29:36.860018+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49758	45.95.169.137	2404	TCP
2024-09-12T21:29:39.060917+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49759	45.95.169.137	2404	TCP
2024-09-12T21:29:41.236637+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49760	45.95.169.137	2404	TCP
2024-09-12T21:29:43.388382+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49761	45.95.169.137	2404	TCP
2024-09-12T21:29:45.532232+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49762	45.95.169.137	2404	TCP
2024-09-12T21:29:47.654867+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49763	45.95.169.137	2404	TCP
2024-09-12T21:29:49.958130+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49764	45.95.169.137	2404	TCP
2024-09-12T21:29:52.068158+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49765	45.95.169.137	2404	TCP
2024-09-12T21:29:54.153761+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49766	45.95.169.137	2404	TCP
2024-09-12T21:29:56.219908+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49767	45.95.169.137	2404	TCP
2024-09-12T21:29:58.278588+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49768	45.95.169.137	2404	TCP
2024-09-12T21:30:00.346480+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49769	45.95.169.137	2404	TCP
2024-09-12T21:30:02.375452+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49770	45.95.169.137	2404	TCP
2024-09-12T21:30:04.406538+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49771	45.95.169.137	2404	TCP
2024-09-12T21:30:07.390061+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49772	45.95.169.137	2404	TCP
2024-09-12T21:30:09.529597+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49773	45.95.169.137	2404	TCP
2024-09-12T21:30:11.517891+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49774	45.95.169.137	2404	TCP
2024-09-12T21:30:13.762887+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49775	45.95.169.137	2404	TCP
2024-09-12T21:30:16.796315+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49776	45.95.169.137	2404	TCP
2024-09-12T21:30:18.762756+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49777	45.95.169.137	2404	TCP
2024-09-12T21:30:20.717713+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49778	45.95.169.137	2404	TCP
2024-09-12T21:30:22.672776+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49779	45.95.169.137	2404	TCP
2024-09-12T21:30:24.593750+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49780	45.95.169.137	2404	TCP
2024-09-12T21:30:26.535505+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49781	45.95.169.137	2404	TCP
2024-09-12T21:30:28.435898+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49782	45.95.169.137	2404	TCP
2024-09-12T21:30:30.357811+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49783	45.95.169.137	2404	TCP
2024-09-12T21:30:32.267567+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49784	45.95.169.137	2404	TCP
2024-09-12T21:30:34.796130+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49785	45.95.169.137	2404	TCP
2024-09-12T21:30:36.685651+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49786	45.95.169.137	2404	TCP
2024-09-12T21:30:38.575430+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49787	45.95.169.137	2404	TCP
2024-09-12T21:30:40.435581+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49788	45.95.169.137	2404	TCP
2024-09-12T21:30:42.465556+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49789	45.95.169.137	2404	TCP
2024-09-12T21:30:44.362724+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49790	45.95.169.137	2404	TCP
2024-09-12T21:30:46.239681+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49791	45.95.169.137	2404	TCP
2024-09-12T21:30:48.107581+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49792	45.95.169.137	2404	TCP
2024-09-12T21:30:49.950832+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49793	45.95.169.137	2404	TCP
2024-09-12T21:30:51.779596+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49794	45.95.169.137	2404	TCP
2024-09-12T21:30:53.607180+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49795	45.95.169.137	2404	TCP
2024-09-12T21:30:55.436498+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49796	45.95.169.137	2404	TCP
2024-09-12T21:30:57.285171+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49797	45.95.169.137	2404	TCP
2024-09-12T21:30:59.125555+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49798	45.95.169.137	2404	TCP
2024-09-12T21:31:00.970633+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49799	45.95.169.137	2404	TCP
2024-09-12T21:31:02.779631+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49800	45.95.169.137	2404	TCP
2024-09-12T21:31:04.597796+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49801	45.95.169.137	2404	TCP
2024-09-12T21:31:06.441468+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49802	45.95.169.137	2404	TCP
2024-09-12T21:31:08.254116+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49803	45.95.169.137	2404	TCP
2024-09-12T21:31:10.083380+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49804	45.95.169.137	2404	TCP
2024-09-12T21:31:11.888048+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49805	45.95.169.137	2404	TCP
2024-09-12T21:31:13.671542+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49806	45.95.169.137	2404	TCP
2024-09-12T21:31:15.702801+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49807	45.95.169.137	2404	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2024 21:27:13.500530005 CEST	49700	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:13.505531073 CEST	2404	49700	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:13.505623102 CEST	49700	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:13.514281988 CEST	49700	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:13.519292116 CEST	2404	49700	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:15.217756987 CEST	2404	49700	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:15.218009949 CEST	49700	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:15.218183994 CEST	49700	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:15.224011898 CEST	2404	49700	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:16.223349094 CEST	49701	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:16.228292942 CEST	2404	49701	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:16.228370905 CEST	49701	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:16.231977940 CEST	49701	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:16.236659050 CEST	2404	49701	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:17.917408943 CEST	2404	49701	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:17.917524099 CEST	49701	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:17.917649984 CEST	49701	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:17.923782110 CEST	2404	49701	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:18.926131010 CEST	49702	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:18.931207895 CEST	2404	49702	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:18.931324005 CEST	49702	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:18.935167074 CEST	49702	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:18.940040112 CEST	2404	49702	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:20.602830887 CEST	2404	49702	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:20.602885962 CEST	49702	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:20.602953911 CEST	49702	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:20.607697964 CEST	2404	49702	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:21.614291906 CEST	49703	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:21.619585991 CEST	2404	49703	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:21.619672060 CEST	49703	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:21.623290062 CEST	49703	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:21.630108118 CEST	2404	49703	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:23.549887896 CEST	2404	49703	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:23.550003052 CEST	49703	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:23.550107956 CEST	49703	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:23.557208061 CEST	2404	49703	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:23.557252884 CEST	49703	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:23.784797907 CEST	2404	49703	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:23.784853935 CEST	49703	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:23.788403988 CEST	2404	49703	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:24.551275015 CEST	49705	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:24.663430929 CEST	2404	49705	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:24.663548946 CEST	49705	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:24.669202089 CEST	49705	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:24.673897028 CEST	2404	49705	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:26.358078957 CEST	2404	49705	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:26.358166933 CEST	49705	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:26.358253002 CEST	49705	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:26.363289118 CEST	2404	49705	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:27.367094040 CEST	49709	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:27.372173071 CEST	2404	49709	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:27.372248888 CEST	49709	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:27.376288891 CEST	49709	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:27.381230116 CEST	2404	49709	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:29.075922966 CEST	2404	49709	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:29.076159954 CEST	49709	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:29.076313019 CEST	49709	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:29.081206083 CEST	2404	49709	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:30.084757090 CEST	49710	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:30.092772007 CEST	2404	49710	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:30.093283892 CEST	49710	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:30.096827030 CEST	49710	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:30.103946924 CEST	2404	49710	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:31.775402069 CEST	2404	49710	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:31.775526047 CEST	49710	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:31.775602102 CEST	49710	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:31.780534029 CEST	2404	49710	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:32.785789013 CEST	49711	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:32.790716887 CEST	2404	49711	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:32.790844917 CEST	49711	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:32.794519901 CEST	49711	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:32.799388885 CEST	2404	49711	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:34.478432894 CEST	2404	49711	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:34.478620052 CEST	49711	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:34.478671074 CEST	49711	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:34.483582020 CEST	2404	49711	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:35.488742113 CEST	49712	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:35.493726015 CEST	2404	49712	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:35.493818045 CEST	49712	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:35.497452021 CEST	49712	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:35.502381086 CEST	2404	49712	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:37.203288078 CEST	2404	49712	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:37.203366995 CEST	49712	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:37.203459978 CEST	49712	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:37.208628893 CEST	2404	49712	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:38.207375050 CEST	49713	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:38.212431908 CEST	2404	49713	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:38.212508917 CEST	49713	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:38.216063023 CEST	49713	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:38.221374989 CEST	2404	49713	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:39.924881935 CEST	2404	49713	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:39.925071001 CEST	49713	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:39.925184011 CEST	49713	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:39.932554960 CEST	2404	49713	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:40.941992998 CEST	49714	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:40.947180033 CEST	2404	49714	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:40.947294950 CEST	49714	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:40.950753927 CEST	49714	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:40.955640078 CEST	2404	49714	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:42.637320042 CEST	2404	49714	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:42.637413979 CEST	49714	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:42.640680075 CEST	49714	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:42.645556927 CEST	2404	49714	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:43.645112991 CEST	49715	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:43.653861046 CEST	2404	49715	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:43.653970957 CEST	49715	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:43.657593966 CEST	49715	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:43.662659883 CEST	2404	49715	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:45.344609022 CEST	2404	49715	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:45.344746113 CEST	49715	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:45.363683939 CEST	49715	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:45.368880987 CEST	2404	49715	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:46.442272902 CEST	49716	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:46.447280884 CEST	2404	49716	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:46.447364092 CEST	49716	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:46.450978041 CEST	49716	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:46.455837965 CEST	2404	49716	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:48.134938955 CEST	2404	49716	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:48.135008097 CEST	49716	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:48.135083914 CEST	49716	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:48.139889956 CEST	2404	49716	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:49.145339966 CEST	49717	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:49.150384903 CEST	2404	49717	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:49.150482893 CEST	49717	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:49.153928041 CEST	49717	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:49.158843994 CEST	2404	49717	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:50.822024107 CEST	2404	49717	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:50.822145939 CEST	49717	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:50.822369099 CEST	49717	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:50.827193975 CEST	2404	49717	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:51.832353115 CEST	49718	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:51.838011980 CEST	2404	49718	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:51.838130951 CEST	49718	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:51.841716051 CEST	49718	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:51.846831083 CEST	2404	49718	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:53.529685020 CEST	2404	49718	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:53.529767036 CEST	49718	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:53.529875994 CEST	49718	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:53.534631014 CEST	2404	49718	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:54.535727024 CEST	49719	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:54.540874958 CEST	2404	49719	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:54.540962934 CEST	49719	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:54.547529936 CEST	49719	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:54.552344084 CEST	2404	49719	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:56.229043007 CEST	2404	49719	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:56.229180098 CEST	49719	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:56.229435921 CEST	49719	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:56.235240936 CEST	2404	49719	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:57.238912106 CEST	49720	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:57.243948936 CEST	2404	49720	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:57.244083881 CEST	49720	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:57.249141932 CEST	49720	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:57.254293919 CEST	2404	49720	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:58.931725025 CEST	2404	49720	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:58.931804895 CEST	49720	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:58.931880951 CEST	49720	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:58.936887026 CEST	2404	49720	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:59.942017078 CEST	49721	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:59.946973085 CEST	2404	49721	45.95.169.137	192.168.2.10
Sep 12, 2024 21:27:59.947099924 CEST	49721	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:59.952238083 CEST	49721	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:27:59.959754944 CEST	2404	49721	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:01.636691093 CEST	2404	49721	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:01.636831999 CEST	49721	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:01.636941910 CEST	49721	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:01.641736031 CEST	2404	49721	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:02.645488024 CEST	49722	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:02.650717020 CEST	2404	49722	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:02.650924921 CEST	49722	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:02.654534101 CEST	49722	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:02.659621954 CEST	2404	49722	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:04.408946037 CEST	2404	49722	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:04.409147024 CEST	49722	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:04.409459114 CEST	49722	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:04.414722919 CEST	2404	49722	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:05.411052942 CEST	49724	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:05.677522898 CEST	2404	49724	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:05.679264069 CEST	49724	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:05.682909966 CEST	49724	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:05.687881947 CEST	2404	49724	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:07.370953083 CEST	2404	49724	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:07.371021986 CEST	49724	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:07.371150970 CEST	49724	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:07.376182079 CEST	2404	49724	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:08.380938053 CEST	49725	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:08.385924101 CEST	2404	49725	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:08.386050940 CEST	49725	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:08.391098976 CEST	49725	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:08.396145105 CEST	2404	49725	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:10.074337006 CEST	2404	49725	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:10.074507952 CEST	49725	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:10.074609995 CEST	49725	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:10.079425097 CEST	2404	49725	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:11.085757017 CEST	49726	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:11.384897947 CEST	2404	49726	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:11.385096073 CEST	49726	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:11.388989925 CEST	49726	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:11.395078897 CEST	2404	49726	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:13.059648037 CEST	2404	49726	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:13.059767008 CEST	49726	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:13.059890032 CEST	49726	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:13.064836979 CEST	2404	49726	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:14.066829920 CEST	49727	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:14.071824074 CEST	2404	49727	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:14.071907997 CEST	49727	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:14.076071978 CEST	49727	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:14.080919981 CEST	2404	49727	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:15.793282986 CEST	2404	49727	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:15.793462992 CEST	49727	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:15.793531895 CEST	49727	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:15.798440933 CEST	2404	49727	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:16.801059961 CEST	49728	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:16.806130886 CEST	2404	49728	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:16.806274891 CEST	49728	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:16.809976101 CEST	49728	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:16.814851999 CEST	2404	49728	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:18.496231079 CEST	2404	49728	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:18.496321917 CEST	49728	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:18.496370077 CEST	49728	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:18.501188993 CEST	2404	49728	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:19.504076958 CEST	49729	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:19.509043932 CEST	2404	49729	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:19.509287119 CEST	49729	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:19.512819052 CEST	49729	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:19.517895937 CEST	2404	49729	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:21.198338032 CEST	2404	49729	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:21.201792955 CEST	49729	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:21.203222990 CEST	49729	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:21.208058119 CEST	2404	49729	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:22.207298040 CEST	49730	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:22.212232113 CEST	2404	49730	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:22.212424040 CEST	49730	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:22.216063023 CEST	49730	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:22.220819950 CEST	2404	49730	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:23.986504078 CEST	2404	49730	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:23.990055084 CEST	49730	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:23.990097046 CEST	49730	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:23.994838953 CEST	2404	49730	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:25.004051924 CEST	49731	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:25.009550095 CEST	2404	49731	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:25.009625912 CEST	49731	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:25.013596058 CEST	49731	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:25.018909931 CEST	2404	49731	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:26.700824022 CEST	2404	49731	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:26.700937986 CEST	49731	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:26.701169014 CEST	49731	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:26.706324100 CEST	2404	49731	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:27.707331896 CEST	49732	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:27.712536097 CEST	2404	49732	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:27.712821960 CEST	49732	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:27.716964960 CEST	49732	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:27.721903086 CEST	2404	49732	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:29.405807972 CEST	2404	49732	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:29.405885935 CEST	49732	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:29.405978918 CEST	49732	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:29.410742998 CEST	2404	49732	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:30.410563946 CEST	49733	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:30.415412903 CEST	2404	49733	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:30.415548086 CEST	49733	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:30.427349091 CEST	49733	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:30.432246923 CEST	2404	49733	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:32.088890076 CEST	2404	49733	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:32.089052916 CEST	49733	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:32.089091063 CEST	49733	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:32.093903065 CEST	2404	49733	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:33.097965956 CEST	49734	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:33.103590012 CEST	2404	49734	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:33.104599953 CEST	49734	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:33.108556986 CEST	49734	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:33.114145994 CEST	2404	49734	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:34.795767069 CEST	2404	49734	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:34.795844078 CEST	49734	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:34.795970917 CEST	49734	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:34.800760984 CEST	2404	49734	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:35.801126957 CEST	49735	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:35.806046963 CEST	2404	49735	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:35.806301117 CEST	49735	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:35.809937954 CEST	49735	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:35.814829111 CEST	2404	49735	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:37.494962931 CEST	2404	49735	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:37.495043993 CEST	49735	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:37.495119095 CEST	49735	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:37.499959946 CEST	2404	49735	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:38.504432917 CEST	49736	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:38.509344101 CEST	2404	49736	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:38.509444952 CEST	49736	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:38.514580011 CEST	49736	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:38.519548893 CEST	2404	49736	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:40.199167013 CEST	2404	49736	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:40.199306011 CEST	49736	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:40.199404001 CEST	49736	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:40.204255104 CEST	2404	49736	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:41.223551035 CEST	49737	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:41.228652000 CEST	2404	49737	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:41.228733063 CEST	49737	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:41.324589014 CEST	49737	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:41.329973936 CEST	2404	49737	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:43.127962112 CEST	2404	49737	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:43.130186081 CEST	49737	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:43.130259037 CEST	49737	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:43.136065960 CEST	2404	49737	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:43.137592077 CEST	49737	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:43.143452883 CEST	2404	49737	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:44.098237038 CEST	49738	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:44.103454113 CEST	2404	49738	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:44.106355906 CEST	49738	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:44.109894037 CEST	49738	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:44.114731073 CEST	2404	49738	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:45.792088032 CEST	2404	49738	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:45.795277119 CEST	49738	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:45.795366049 CEST	49738	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:45.800297022 CEST	2404	49738	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:46.738517046 CEST	49739	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:46.910716057 CEST	2404	49739	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:46.910933971 CEST	49739	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:46.914509058 CEST	49739	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:46.919544935 CEST	2404	49739	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:48.589834929 CEST	2404	49739	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:48.590013027 CEST	49739	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:48.590059996 CEST	49739	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:48.594933987 CEST	2404	49739	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:49.505253077 CEST	49740	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:49.510186911 CEST	2404	49740	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:49.510265112 CEST	49740	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:49.514158964 CEST	49740	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:49.518985033 CEST	2404	49740	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:53.589229107 CEST	2404	49740	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:53.589312077 CEST	49740	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:53.589361906 CEST	49740	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:53.594331980 CEST	2404	49740	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:54.472902060 CEST	49741	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:54.478398085 CEST	2404	49741	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:54.479592085 CEST	49741	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:54.483246088 CEST	49741	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:54.488181114 CEST	2404	49741	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:56.167768002 CEST	2404	49741	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:56.169469118 CEST	49741	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:56.169469118 CEST	49741	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:56.174859047 CEST	2404	49741	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:57.019761086 CEST	49742	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:57.026331902 CEST	2404	49742	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:57.027404070 CEST	49742	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:57.030561924 CEST	49742	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:57.037231922 CEST	2404	49742	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:58.714365959 CEST	2404	49742	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:58.714462042 CEST	49742	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:58.714528084 CEST	49742	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:58.719391108 CEST	2404	49742	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:59.546437979 CEST	49743	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:59.556206942 CEST	2404	49743	45.95.169.137	192.168.2.10
Sep 12, 2024 21:28:59.556313992 CEST	49743	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:59.605257988 CEST	49743	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:28:59.611164093 CEST	2404	49743	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:01.264585972 CEST	2404	49743	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:01.266431093 CEST	49743	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:01.266506910 CEST	49743	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:01.271462917 CEST	2404	49743	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:02.090791941 CEST	49744	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:02.095673084 CEST	2404	49744	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:02.099343061 CEST	49744	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:02.161166906 CEST	49744	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:02.166044950 CEST	2404	49744	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:03.777864933 CEST	2404	49744	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:03.777955055 CEST	49744	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:03.778036118 CEST	49744	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:03.783893108 CEST	2404	49744	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:04.551107883 CEST	49745	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:04.556042910 CEST	2404	49745	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:04.556171894 CEST	49745	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:04.559631109 CEST	49745	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:04.564379930 CEST	2404	49745	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:06.252964020 CEST	2404	49745	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:06.253062010 CEST	49745	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:06.253132105 CEST	49745	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:06.259219885 CEST	2404	49745	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:07.004264116 CEST	49746	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:07.009200096 CEST	2404	49746	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:07.009299994 CEST	49746	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:07.012813091 CEST	49746	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:07.020473003 CEST	2404	49746	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:08.703350067 CEST	2404	49746	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:08.707351923 CEST	49746	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:08.707403898 CEST	49746	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:08.712347984 CEST	2404	49746	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:09.426001072 CEST	49747	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:09.433448076 CEST	2404	49747	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:09.438528061 CEST	49747	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:09.442138910 CEST	49747	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:09.446933031 CEST	2404	49747	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:11.121010065 CEST	2404	49747	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:11.121126890 CEST	49747	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:11.121162891 CEST	49747	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:11.128717899 CEST	2404	49747	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:11.816616058 CEST	49748	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:11.821446896 CEST	2404	49748	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:11.823388100 CEST	49748	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:11.826977015 CEST	49748	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:11.831779003 CEST	2404	49748	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:13.495363951 CEST	2404	49748	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:13.495506048 CEST	49748	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:13.495506048 CEST	49748	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:13.500375032 CEST	2404	49748	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:14.176042080 CEST	49749	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:14.180871964 CEST	2404	49749	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:14.180957079 CEST	49749	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:14.184492111 CEST	49749	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:14.189681053 CEST	2404	49749	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:15.959764004 CEST	2404	49749	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:15.959830046 CEST	49749	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:15.960074902 CEST	49749	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:15.978771925 CEST	2404	49749	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:16.613547087 CEST	49750	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:16.618508101 CEST	2404	49750	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:16.618592978 CEST	49750	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:16.622025013 CEST	49750	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:16.626876116 CEST	2404	49750	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:18.308794975 CEST	2404	49750	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:18.308868885 CEST	49750	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:18.347439051 CEST	49750	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:18.354163885 CEST	2404	49750	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:18.973032951 CEST	49751	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:18.977910995 CEST	2404	49751	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:18.978043079 CEST	49751	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:18.982943058 CEST	49751	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:18.987762928 CEST	2404	49751	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:20.671979904 CEST	2404	49751	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:20.672061920 CEST	49751	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:20.672106981 CEST	49751	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:20.676927090 CEST	2404	49751	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:21.288373947 CEST	49752	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:21.293524027 CEST	2404	49752	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:21.293632030 CEST	49752	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:21.315288067 CEST	49752	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:21.320260048 CEST	2404	49752	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:22.984859943 CEST	2404	49752	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:22.987406015 CEST	49752	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:22.987452030 CEST	49752	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:22.992355108 CEST	2404	49752	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:23.582401037 CEST	49753	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:23.587249994 CEST	2404	49753	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:23.587342024 CEST	49753	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:23.590774059 CEST	49753	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:23.595549107 CEST	2404	49753	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:25.340007067 CEST	2404	49753	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:25.340075016 CEST	49753	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:25.340132952 CEST	49753	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:25.344918013 CEST	2404	49753	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:25.910737038 CEST	49754	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:25.918427944 CEST	2404	49754	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:25.918576002 CEST	49754	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:25.929321051 CEST	49754	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:25.934326887 CEST	2404	49754	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:27.747895002 CEST	2404	49754	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:27.747997046 CEST	49754	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:27.748101950 CEST	49754	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:27.753271103 CEST	2404	49754	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:28.301215887 CEST	49755	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:28.307543993 CEST	2404	49755	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:28.307650089 CEST	49755	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:28.311429977 CEST	49755	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:28.317955017 CEST	2404	49755	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:30.202771902 CEST	2404	49755	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:30.202831030 CEST	49755	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:30.203082085 CEST	49755	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:30.212887049 CEST	2404	49755	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:30.738974094 CEST	49756	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:30.746819019 CEST	2404	49756	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:30.746915102 CEST	49756	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:30.755902052 CEST	49756	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:30.760663033 CEST	2404	49756	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:32.438381910 CEST	2404	49756	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:32.438465118 CEST	49756	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:32.438534021 CEST	49756	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:32.446079969 CEST	2404	49756	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:32.957446098 CEST	49757	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:32.962450981 CEST	2404	49757	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:32.963422060 CEST	49757	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:32.971940041 CEST	49757	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:32.976686001 CEST	2404	49757	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:34.638051987 CEST	2404	49757	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:34.639455080 CEST	49757	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:34.639455080 CEST	49757	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:34.644424915 CEST	2404	49757	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:35.145162106 CEST	49758	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:35.150238037 CEST	2404	49758	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:35.150326967 CEST	49758	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:35.155206919 CEST	49758	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:35.160200119 CEST	2404	49758	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:36.859874964 CEST	2404	49758	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:36.860018015 CEST	49758	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:36.860106945 CEST	49758	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:36.865025997 CEST	2404	49758	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:37.347925901 CEST	49759	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:37.352992058 CEST	2404	49759	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:37.355422020 CEST	49759	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:37.358963013 CEST	49759	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:37.363745928 CEST	2404	49759	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:39.060827017 CEST	2404	49759	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:39.060916901 CEST	49759	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:39.061016083 CEST	49759	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:39.065891981 CEST	2404	49759	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:39.519869089 CEST	49760	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:39.525002003 CEST	2404	49760	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:39.525799990 CEST	49760	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:39.530780077 CEST	49760	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:39.535996914 CEST	2404	49760	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:41.236565113 CEST	2404	49760	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:41.236637115 CEST	49760	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:41.236686945 CEST	49760	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:41.243837118 CEST	2404	49760	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:41.692030907 CEST	49761	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:41.699323893 CEST	2404	49761	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:41.699418068 CEST	49761	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:41.703855038 CEST	49761	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:41.710652113 CEST	2404	49761	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:43.388289928 CEST	2404	49761	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:43.388381958 CEST	49761	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:43.388462067 CEST	49761	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:43.393241882 CEST	2404	49761	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:43.832583904 CEST	49762	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:43.837647915 CEST	2404	49762	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:43.837896109 CEST	49762	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:43.842170954 CEST	49762	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:43.846973896 CEST	2404	49762	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:45.532152891 CEST	2404	49762	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:45.532232046 CEST	49762	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:45.532535076 CEST	49762	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:45.537846088 CEST	2404	49762	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:45.957717896 CEST	49763	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:45.963177919 CEST	2404	49763	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:45.963376045 CEST	49763	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:45.971672058 CEST	49763	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:45.976550102 CEST	2404	49763	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:47.654696941 CEST	2404	49763	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:47.654866934 CEST	49763	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:47.655014992 CEST	49763	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:47.659809113 CEST	2404	49763	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:48.067167044 CEST	49764	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:48.072179079 CEST	2404	49764	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:48.072261095 CEST	49764	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:48.076678038 CEST	49764	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:48.081489086 CEST	2404	49764	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:49.958014965 CEST	2404	49764	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:49.958129883 CEST	49764	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:49.958239079 CEST	49764	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:49.961364985 CEST	2404	49764	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:49.961447954 CEST	49764	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:49.963135958 CEST	2404	49764	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:50.348401070 CEST	49765	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:50.353781939 CEST	2404	49765	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:50.353853941 CEST	49765	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:50.357940912 CEST	49765	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:50.362783909 CEST	2404	49765	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:52.068072081 CEST	2404	49765	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:52.068157911 CEST	49765	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:52.068258047 CEST	49765	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:52.073004007 CEST	2404	49765	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:52.457837105 CEST	49766	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:52.462958097 CEST	2404	49766	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:52.463074923 CEST	49766	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:52.466720104 CEST	49766	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:52.471561909 CEST	2404	49766	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:54.153259993 CEST	2404	49766	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:54.153760910 CEST	49766	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:54.153760910 CEST	49766	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:54.158812046 CEST	2404	49766	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:54.520869017 CEST	49767	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:54.526211023 CEST	2404	49767	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:54.527507067 CEST	49767	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:54.531124115 CEST	49767	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:54.536029100 CEST	2404	49767	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:56.219844103 CEST	2404	49767	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:56.219907999 CEST	49767	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:56.219986916 CEST	49767	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:56.225038052 CEST	2404	49767	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:56.582386017 CEST	49768	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:56.587464094 CEST	2404	49768	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:56.591475010 CEST	49768	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:56.594975948 CEST	49768	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:56.608372927 CEST	2404	49768	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:58.278511047 CEST	2404	49768	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:58.278588057 CEST	49768	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:58.278662920 CEST	49768	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:58.291146994 CEST	2404	49768	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:58.629648924 CEST	49769	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:58.634762049 CEST	2404	49769	45.95.169.137	192.168.2.10
Sep 12, 2024 21:29:58.634850025 CEST	49769	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:58.639395952 CEST	49769	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:29:58.644226074 CEST	2404	49769	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:00.344841957 CEST	2404	49769	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:00.346479893 CEST	49769	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:00.346673965 CEST	49769	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:00.351612091 CEST	2404	49769	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:00.676265955 CEST	49770	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:00.681258917 CEST	2404	49770	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:00.681375027 CEST	49770	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:00.685436964 CEST	49770	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:00.691725969 CEST	2404	49770	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:02.375320911 CEST	2404	49770	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:02.375452042 CEST	49770	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:02.379342079 CEST	49770	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:02.384233952 CEST	2404	49770	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:02.707551956 CEST	49771	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:02.712764978 CEST	2404	49771	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:02.713746071 CEST	49771	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:02.717324972 CEST	49771	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:02.722292900 CEST	2404	49771	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:04.403892040 CEST	2404	49771	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:04.406538010 CEST	49771	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:04.406596899 CEST	49771	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:04.411571026 CEST	2404	49771	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:04.723913908 CEST	49772	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:04.729105949 CEST	2404	49772	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:04.731498003 CEST	49772	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:04.735083103 CEST	49772	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:04.739969015 CEST	2404	49772	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:07.389954090 CEST	2404	49772	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:07.390060902 CEST	49772	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:07.390099049 CEST	49772	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:07.390625000 CEST	2404	49772	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:07.390676975 CEST	49772	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:07.391304016 CEST	2404	49772	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:07.391345024 CEST	49772	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:07.392721891 CEST	2404	49772	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:07.392762899 CEST	49772	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:07.398237944 CEST	2404	49772	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:07.692132950 CEST	49773	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:07.849663019 CEST	2404	49773	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:07.849764109 CEST	49773	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:07.854001999 CEST	49773	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:07.860112906 CEST	2404	49773	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:09.528914928 CEST	2404	49773	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:09.529597044 CEST	49773	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:09.529663086 CEST	49773	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:09.534761906 CEST	2404	49773	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:09.817003012 CEST	49774	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:09.821835041 CEST	2404	49774	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:09.821934938 CEST	49774	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:09.825680971 CEST	49774	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:09.830462933 CEST	2404	49774	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:11.514941931 CEST	2404	49774	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:11.517890930 CEST	49774	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:11.517967939 CEST	49774	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:11.522893906 CEST	2404	49774	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:11.801460028 CEST	49775	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:12.083894968 CEST	2404	49775	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:12.084008932 CEST	49775	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:12.087837934 CEST	49775	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:12.092689991 CEST	2404	49775	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:13.762799978 CEST	2404	49775	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:13.762887001 CEST	49775	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:13.763046980 CEST	49775	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:13.768218040 CEST	2404	49775	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:14.035677910 CEST	49776	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:14.997358084 CEST	2404	49776	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:14.997509003 CEST	49776	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:15.001338005 CEST	49776	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:15.006167889 CEST	2404	49776	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:16.796125889 CEST	2404	49776	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:16.796314955 CEST	49776	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:16.796405077 CEST	49776	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:16.804291964 CEST	2404	49776	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:17.075722933 CEST	49777	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:17.080857038 CEST	2404	49777	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:17.082334995 CEST	49777	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:17.139359951 CEST	49777	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:17.144357920 CEST	2404	49777	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:18.762661934 CEST	2404	49777	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:18.762756109 CEST	49777	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:18.762816906 CEST	49777	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:18.767558098 CEST	2404	49777	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:19.020025015 CEST	49778	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:19.025018930 CEST	2404	49778	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:19.027681112 CEST	49778	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:19.034832001 CEST	49778	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:19.039891958 CEST	2404	49778	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:20.716192007 CEST	2404	49778	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:20.717713118 CEST	49778	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:20.717767954 CEST	49778	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:20.722651005 CEST	2404	49778	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:20.973373890 CEST	49779	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:20.978733063 CEST	2404	49779	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:20.978935957 CEST	49779	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:20.983302116 CEST	49779	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:20.988325119 CEST	2404	49779	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:22.672698021 CEST	2404	49779	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:22.672775984 CEST	49779	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:22.672840118 CEST	49779	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:22.677702904 CEST	2404	49779	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:22.910685062 CEST	49780	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:22.915561914 CEST	2404	49780	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:22.915792942 CEST	49780	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:22.919478893 CEST	49780	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:22.924374104 CEST	2404	49780	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:24.590884924 CEST	2404	49780	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:24.593750000 CEST	49780	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:24.597135067 CEST	49780	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:24.601979971 CEST	2404	49780	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:24.832741976 CEST	49781	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:24.837943077 CEST	2404	49781	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:24.839484930 CEST	49781	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:24.843127012 CEST	49781	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:24.848083973 CEST	2404	49781	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:26.535309076 CEST	2404	49781	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:26.535505056 CEST	49781	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:26.535607100 CEST	49781	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:26.541296959 CEST	2404	49781	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:26.755924940 CEST	49782	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:26.760970116 CEST	2404	49782	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:26.761105061 CEST	49782	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:26.764671087 CEST	49782	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:26.769594908 CEST	2404	49782	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:28.435812950 CEST	2404	49782	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:28.435898066 CEST	49782	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:28.436000109 CEST	49782	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:28.440871000 CEST	2404	49782	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:28.662244081 CEST	49783	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:28.667506933 CEST	2404	49783	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:28.667587996 CEST	49783	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:28.678879023 CEST	49783	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:28.684793949 CEST	2404	49783	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:30.357718945 CEST	2404	49783	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:30.357810974 CEST	49783	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:30.358105898 CEST	49783	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:30.362909079 CEST	2404	49783	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:30.567365885 CEST	49784	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:30.572465897 CEST	2404	49784	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:30.572602034 CEST	49784	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:30.583301067 CEST	49784	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:30.588196993 CEST	2404	49784	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:32.264349937 CEST	2404	49784	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:32.267566919 CEST	49784	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:32.267647028 CEST	49784	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:32.272571087 CEST	2404	49784	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:32.473433971 CEST	49785	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:32.478266001 CEST	2404	49785	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:32.478331089 CEST	49785	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:32.482398033 CEST	49785	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:32.487310886 CEST	2404	49785	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:34.795984983 CEST	2404	49785	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:34.796093941 CEST	2404	49785	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:34.796129942 CEST	49785	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:34.796130896 CEST	49785	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:34.796179056 CEST	49785	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:34.796377897 CEST	2404	49785	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:34.796608925 CEST	49785	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:34.801009893 CEST	2404	49785	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:34.988912106 CEST	49786	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:34.993892908 CEST	2404	49786	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:34.997561932 CEST	49786	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:35.001195908 CEST	49786	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:35.006084919 CEST	2404	49786	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:36.685209036 CEST	2404	49786	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:36.685651064 CEST	49786	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:36.685651064 CEST	49786	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:36.690545082 CEST	2404	49786	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:36.879508018 CEST	49787	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:36.884593010 CEST	2404	49787	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:36.884735107 CEST	49787	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:36.891479015 CEST	49787	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:36.896410942 CEST	2404	49787	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:38.575351954 CEST	2404	49787	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:38.575429916 CEST	49787	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:38.575501919 CEST	49787	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:38.580343008 CEST	2404	49787	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:38.755358934 CEST	49788	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:38.760320902 CEST	2404	49788	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:38.761398077 CEST	49788	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:38.765078068 CEST	49788	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:38.769934893 CEST	2404	49788	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:40.434840918 CEST	2404	49788	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:40.435580969 CEST	49788	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:40.435625076 CEST	49788	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:40.440478086 CEST	2404	49788	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:40.613753080 CEST	49789	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:40.618783951 CEST	2404	49789	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:40.618895054 CEST	49789	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:40.622454882 CEST	49789	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:40.627362013 CEST	2404	49789	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:42.461966991 CEST	2404	49789	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:42.465555906 CEST	49789	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:42.465645075 CEST	49789	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:42.470582962 CEST	2404	49789	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:42.646013021 CEST	49790	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:42.651045084 CEST	2404	49790	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:42.651169062 CEST	49790	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:42.657649040 CEST	49790	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:42.662619114 CEST	2404	49790	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:44.362605095 CEST	2404	49790	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:44.362724066 CEST	49790	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:44.362786055 CEST	49790	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:44.367587090 CEST	2404	49790	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:44.535695076 CEST	49791	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:44.540714025 CEST	2404	49791	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:44.540889025 CEST	49791	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:44.545070887 CEST	49791	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:44.549998999 CEST	2404	49791	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:46.237423897 CEST	2404	49791	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:46.239681005 CEST	49791	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:46.239720106 CEST	49791	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:46.244673014 CEST	2404	49791	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:46.411708117 CEST	49792	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:46.416966915 CEST	2404	49792	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:46.417186975 CEST	49792	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:46.428185940 CEST	49792	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:46.433068037 CEST	2404	49792	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:48.107486010 CEST	2404	49792	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:48.107580900 CEST	49792	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:48.107712030 CEST	49792	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:48.112540960 CEST	2404	49792	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:48.270360947 CEST	49793	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:48.275892019 CEST	2404	49793	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:48.275988102 CEST	49793	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:48.279901981 CEST	49793	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:48.284851074 CEST	2404	49793	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:49.950731993 CEST	2404	49793	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:49.950831890 CEST	49793	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:49.950908899 CEST	49793	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:49.955764055 CEST	2404	49793	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:50.098361015 CEST	49794	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:50.103458881 CEST	2404	49794	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:50.103544950 CEST	49794	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:50.107626915 CEST	49794	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:50.112498999 CEST	2404	49794	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:51.778744936 CEST	2404	49794	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:51.779596090 CEST	49794	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:51.779701948 CEST	49794	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:51.784666061 CEST	2404	49794	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:51.926492929 CEST	49795	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:51.931750059 CEST	2404	49795	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:51.931895018 CEST	49795	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:51.937583923 CEST	49795	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:51.942513943 CEST	2404	49795	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:53.607006073 CEST	2404	49795	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:53.607180119 CEST	49795	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:53.607258081 CEST	49795	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:53.612051010 CEST	2404	49795	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:53.754839897 CEST	49796	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:53.759790897 CEST	2404	49796	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:53.760200024 CEST	49796	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:53.767107964 CEST	49796	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:53.771888018 CEST	2404	49796	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:55.436367989 CEST	2404	49796	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:55.436497927 CEST	49796	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:55.436566114 CEST	49796	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:55.441416025 CEST	2404	49796	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:55.582798958 CEST	49797	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:55.588655949 CEST	2404	49797	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:55.588866949 CEST	49797	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:55.593966007 CEST	49797	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:55.599438906 CEST	2404	49797	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:57.285064936 CEST	2404	49797	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:57.285171032 CEST	49797	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:57.285315037 CEST	49797	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:57.290093899 CEST	2404	49797	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:57.426354885 CEST	49798	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:57.431293011 CEST	2404	49798	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:57.431427956 CEST	49798	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:57.437736988 CEST	49798	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:57.443484068 CEST	2404	49798	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:59.125104904 CEST	2404	49798	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:59.125555038 CEST	49798	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:59.125652075 CEST	49798	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:59.131150961 CEST	2404	49798	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:59.254719019 CEST	49799	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:59.259771109 CEST	2404	49799	45.95.169.137	192.168.2.10
Sep 12, 2024 21:30:59.261612892 CEST	49799	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:59.270515919 CEST	49799	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:30:59.275474072 CEST	2404	49799	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:00.970541000 CEST	2404	49799	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:00.970633030 CEST	49799	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:00.970712900 CEST	49799	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:00.975608110 CEST	2404	49799	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:01.098537922 CEST	49800	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:01.103517056 CEST	2404	49800	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:01.103615046 CEST	49800	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:01.107239008 CEST	49800	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:01.112173080 CEST	2404	49800	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:02.779550076 CEST	2404	49800	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:02.779630899 CEST	49800	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:02.779695034 CEST	49800	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:02.784600973 CEST	2404	49800	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:02.895217896 CEST	49801	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:02.900264025 CEST	2404	49801	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:02.900343895 CEST	49801	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:02.905720949 CEST	49801	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:02.910562992 CEST	2404	49801	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:04.597726107 CEST	2404	49801	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:04.597795963 CEST	49801	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:04.597889900 CEST	49801	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:04.603180885 CEST	2404	49801	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:04.723192930 CEST	49802	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:04.728921890 CEST	2404	49802	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:04.731547117 CEST	49802	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:04.739768982 CEST	49802	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:04.746635914 CEST	2404	49802	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:06.440036058 CEST	2404	49802	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:06.441468000 CEST	49802	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:06.441550970 CEST	49802	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:06.449249983 CEST	2404	49802	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:06.551429033 CEST	49803	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:06.556473017 CEST	2404	49803	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:06.556583881 CEST	49803	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:06.560172081 CEST	49803	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:06.564999104 CEST	2404	49803	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:08.249851942 CEST	2404	49803	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:08.254116058 CEST	49803	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:08.254170895 CEST	49803	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:08.258974075 CEST	2404	49803	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:08.363852024 CEST	49804	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:08.369360924 CEST	2404	49804	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:08.369445086 CEST	49804	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:08.373846054 CEST	49804	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:08.378747940 CEST	2404	49804	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:10.083228111 CEST	2404	49804	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:10.083379984 CEST	49804	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:10.083379984 CEST	49804	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:10.088606119 CEST	2404	49804	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:10.191901922 CEST	49805	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:10.196964979 CEST	2404	49805	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:10.197067022 CEST	49805	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:10.200539112 CEST	49805	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:10.209336042 CEST	2404	49805	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:11.887912989 CEST	2404	49805	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:11.888047934 CEST	49805	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:11.888133049 CEST	49805	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:11.893368959 CEST	2404	49805	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:11.988758087 CEST	49806	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:11.993892908 CEST	2404	49806	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:11.993999958 CEST	49806	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:11.998192072 CEST	49806	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:12.003849983 CEST	2404	49806	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:13.670146942 CEST	2404	49806	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:13.671541929 CEST	49806	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:13.671597004 CEST	49806	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:13.676460028 CEST	2404	49806	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:14.020236015 CEST	49807	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:14.025266886 CEST	2404	49807	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:14.025374889 CEST	49807	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:14.028784990 CEST	49807	2404	192.168.2.10	45.95.169.137
Sep 12, 2024 21:31:14.033658981 CEST	2404	49807	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:15.702729940 CEST	2404	49807	45.95.169.137	192.168.2.10
Sep 12, 2024 21:31:15.702800989 CEST	49807	2404	192.168.2.10	45.95.169.137

Target ID:	6
Start time:	15:27:06
Start date:	12/09/2024
Path:	C:\Users\user\Desktop\S91AYfMUT0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\S91AYfMUT0.exe"
Imagebase:	0x620000
File size:	1'279'488 bytes
MD5 hash:	B54974CD7B04BEB5D6C5377FF6170F7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	15:27:09
Start date:	12/09/2024
Path:	C:\Users\user\AppData\Local\directory\icon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\S91AYfMUT0.exe"
Imagebase:	0x10000
File size:	1'279'488 bytes
MD5 hash:	B54974CD7B04BEB5D6C5377FF6170F7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.1338735869.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	15:27:11
Start date:	12/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\S91AYfMUT0.exe"
Imagebase:	0xb80000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.3742139950.0000000003412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000009.00000002.3740400024.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.3742035824.0000000003400000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	15:27:24
Start date:	12/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\icon.vbs"
Imagebase:	0x7ff669b20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	15:27:24
Start date:	12/09/2024
Path:	C:\Users\user\AppData\Local\directory\icon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\directory\icon.exe"
Imagebase:	0x10000
File size:	1'279'488 bytes
MD5 hash:	B54974CD7B04BEB5D6C5377FF6170F7B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000C.00000002.1498234408.0000000003470000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	15:27:27
Start date:	12/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\directory\icon.exe"
Imagebase:	0xb80000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000D.00000002.1496539129.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.1496792749.0000000000800000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true