Windows Analysis Report
8kjlHXmbAY.exe

AI detected suspicious sample

Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4673994833.000000000125C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674197020.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674782285.0000000003FEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2406102574.000000000145C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674388122.000000000145C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674277679.000000000136C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 5048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 712, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 8kjlHXmbAY.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: 3_2_0043293A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

3_2_0043293A

Source: bankrupture.exe, 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_460de2ec-5

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 5048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 712, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: 3_2_00406764 _wcslen,CoGetObject,

3_2_00406764

Source: 8kjlHXmbAY.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0033445A
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033C6D1 FindFirstFileW,FindClose,	0_2_0033C6D1
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0033C75C
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0033EF95
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0033F0F2
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0033F3F3
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_003337EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_003337EF
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00333B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00333B12
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0033BCBC
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0083445A
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083C6D1 FindFirstFileW,FindClose,	2_2_0083C6D1
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0083C75C
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0083EF95
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0083F0F2
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0083F3F3
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_008337EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_008337EF
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00833B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00833B12
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0083BCBC
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	3_2_0040B335
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	3_2_0041B42F
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	3_2_0040B53A
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0044D5E9 FindFirstFileExA,	3_2_0044D5E9
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	3_2_004089A9
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00406AC2 FindFirstFileW,FindNextFileW,	3_2_00406AC2
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	3_2_00407A8C
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,	3_2_00418C69
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	3_2_00408DA7

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: 3_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

3_2_00406F06

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49782 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49801 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49838 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49820 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49856 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49885 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49903 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49936 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49872 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49921 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49953 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49969 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49985 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49999 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50003 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49996 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50019 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50007 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50004 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50005 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50010 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50009 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49998 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50022 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50028 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50001 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50037 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50029 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50015 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50044 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50013 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50027 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50034 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50025 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50024 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50033 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50035 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50057 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50011 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50053 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50043 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50052 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50058 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50060 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50042 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50032 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50038 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50020 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50045 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50036 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50072 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50002 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50030 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50075 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50082 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50040 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49997 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50006 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50074 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50055 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50088 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50026 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50046 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50063 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50047 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50065 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50100 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50083 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50069 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50099 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50103 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50066 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50031 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50048 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50090 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50104 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50106 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50049 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50101 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50061 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50092 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50077 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50068 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50109 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50080 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50091 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50071 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50070 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50098 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50054 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50086 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50105 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50023 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50111 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50096 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50089 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50093 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50108 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50016 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50102 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50076 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50062 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50110 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50079 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50087 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50050 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50081 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50017 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50112 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50085 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50056 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50059 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50073 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50067 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49995 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50084 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50078 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50014 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50041 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50107 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50018 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50051 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50064 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50097 -> 192.210.150.26:8787

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 192.210.150.26

Source: Joe Sandbox View

IP Address: 192.210.150.26 192.210.150.26

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_003422EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_003422EE

Source: bankrupture.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: bankrupture.exe, 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, bankrupture.exe, 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, bankrupture.exe, 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, bankrupture.exe, 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, bankrupture.exe, 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: 3_2_004099E4 SetWindowsHookExA 0000000D,004099D0,00000000

3_2_004099E4

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00344164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00344164

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00344164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_00344164
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00844164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	2_2_00844164
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	3_2_004159C6

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00343F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00343F66

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_0033001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_0033001C

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		0_2_0035CABC
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		2_2_0085CABC

Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 5048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 712, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4673994833.000000000125C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674197020.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674782285.0000000003FEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2406102574.000000000145C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674388122.000000000145C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674277679.000000000136C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 5048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 712, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: 3_2_0041BB77 SystemParametersInfoW,

3_2_0041BB77

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: bankrupture.exe PID: 5048, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: bankrupture.exe PID: 6392, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: bankrupture.exe PID: 712, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: This is a third-party compiled AutoIt script.	0_2_002D3B3A
Source: 8kjlHXmbAY.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 8kjlHXmbAY.exe, 00000000.00000002.2240081920.0000000000384000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f94071ac-0
Source: 8kjlHXmbAY.exe, 00000000.00000002.2240081920.0000000000384000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_54200b66-3
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: This is a third-party compiled AutoIt script.	2_2_007D3B3A
Source: bankrupture.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: bankrupture.exe, 00000002.00000002.2276041187.0000000000884000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_5630d580-a
Source: bankrupture.exe, 00000002.00000002.2276041187.0000000000884000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_64884a86-e
Source: bankrupture.exe, 00000003.00000002.4673374422.0000000000884000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b4048487-3
Source: bankrupture.exe, 00000003.00000002.4673374422.0000000000884000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_f1cdeb43-c
Source: bankrupture.exe, 00000008.00000002.2404955093.0000000000884000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_42eb8930-2
Source: bankrupture.exe, 00000008.00000002.2404955093.0000000000884000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_d1a01940-8

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002D3633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	0_2_002D3633
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035C1AC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	0_2_0035C1AC
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035C498 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	0_2_0035C498
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035C57D SendMessageW,NtdllDialogWndProc_W,	0_2_0035C57D
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035C5FE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	0_2_0035C5FE
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035C860 NtdllDialogWndProc_W,	0_2_0035C860
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035C8BE NtdllDialogWndProc_W,	0_2_0035C8BE
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035C88F NtdllDialogWndProc_W,	0_2_0035C88F
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035C93E ClientToScreen,NtdllDialogWndProc_W,	0_2_0035C93E
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035C909 NtdllDialogWndProc_W,	0_2_0035C909
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035CA7C GetWindowLongW,NtdllDialogWndProc_W,	0_2_0035CA7C
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	0_2_0035CABC
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002D1287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,74A3C8D0,NtdllDialogWndProc_W,	0_2_002D1287
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002D1290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	0_2_002D1290
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035D3B8 NtdllDialogWndProc_W,	0_2_0035D3B8
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035D43E GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	0_2_0035D43E
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002D167D NtdllDialogWndProc_W,	0_2_002D167D
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002D16B5 NtdllDialogWndProc_W,	0_2_002D16B5
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002D16DE GetParent,NtdllDialogWndProc_W,	0_2_002D16DE
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035D78C NtdllDialogWndProc_W,	0_2_0035D78C
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002D189B NtdllDialogWndProc_W,	0_2_002D189B
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035BC5D NtdllDialogWndProc_W,CallWindowProcW,	0_2_0035BC5D
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035BF30 NtdllDialogWndProc_W,	0_2_0035BF30
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0035BF8C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	0_2_0035BF8C
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007D3633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	2_2_007D3633
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085C1AC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	2_2_0085C1AC
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085C498 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	2_2_0085C498
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085C5FE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	2_2_0085C5FE
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085C57D SendMessageW,NtdllDialogWndProc_W,	2_2_0085C57D
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085C88F NtdllDialogWndProc_W,	2_2_0085C88F
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085C8BE NtdllDialogWndProc_W,	2_2_0085C8BE
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085C860 NtdllDialogWndProc_W,	2_2_0085C860
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085C909 NtdllDialogWndProc_W,	2_2_0085C909
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085C93E ClientToScreen,NtdllDialogWndProc_W,	2_2_0085C93E
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	2_2_0085CABC
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085CA7C GetWindowLongW,NtdllDialogWndProc_W,	2_2_0085CA7C
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007D1290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	2_2_007D1290
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007D1287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,74A3C8D0,NtdllDialogWndProc_W,	2_2_007D1287
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085D3B8 NtdllDialogWndProc_W,	2_2_0085D3B8
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085D43E GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	2_2_0085D43E
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007D167D NtdllDialogWndProc_W,	2_2_007D167D
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007D16DE GetParent,NtdllDialogWndProc_W,	2_2_007D16DE
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007D16B5 NtdllDialogWndProc_W,	2_2_007D16B5
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085D78C NtdllDialogWndProc_W,	2_2_0085D78C
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007D189B NtdllDialogWndProc_W,	2_2_007D189B
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085BC5D NtdllDialogWndProc_W,CallWindowProcW,	2_2_0085BC5D
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085BF8C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	2_2_0085BF8C
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0085BF30 NtdllDialogWndProc_W,	2_2_0085BF30
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0041CA9E NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	3_2_0041CA9E
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0041ACC1 OpenProcess,NtSuspendProcess,CloseHandle,	3_2_0041ACC1
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0041ACED OpenProcess,NtResumeProcess,CloseHandle,	3_2_0041ACED

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_0033A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_0033A1EF

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00328310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,74B55590,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,

0_2_00328310

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_003351BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	0_2_003351BD
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_008351BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	2_2_008351BD
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_004158B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,	3_2_004158B9

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002DE6A0	0_2_002DE6A0
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002FD975	0_2_002FD975
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002DFCE0	0_2_002DFCE0
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002F21C5	0_2_002F21C5
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_003062D2	0_2_003062D2
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_003503DA	0_2_003503DA
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0030242E	0_2_0030242E
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002F25FA	0_2_002F25FA
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0032E616	0_2_0032E616
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002E66E1	0_2_002E66E1
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0030878F	0_2_0030878F
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002E8808	0_2_002E8808
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00350857	0_2_00350857
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00306844	0_2_00306844
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00338889	0_2_00338889
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002FCB21	0_2_002FCB21
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00306DB6	0_2_00306DB6
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002E6F9E	0_2_002E6F9E
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002E3030	0_2_002E3030
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002F3187	0_2_002F3187
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002FF1D9	0_2_002FF1D9
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002E52A5	0_2_002E52A5
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002D1287	0_2_002D1287
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002F1484	0_2_002F1484
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002E5520	0_2_002E5520
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002F7696	0_2_002F7696
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002E5760	0_2_002E5760
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002F1978	0_2_002F1978
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00309AB5	0_2_00309AB5
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002FBDA6	0_2_002FBDA6
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002F1D90	0_2_002F1D90
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00357DDB	0_2_00357DDB
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002DDF00	0_2_002DDF00
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002E3FE0	0_2_002E3FE0
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_014FAF48	0_2_014FAF48
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007DE6A0	2_2_007DE6A0
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007FD975	2_2_007FD975
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007DFCE0	2_2_007DFCE0
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007F21C5	2_2_007F21C5
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_008062D2	2_2_008062D2
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_008503DA	2_2_008503DA
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0080242E	2_2_0080242E
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007F25FA	2_2_007F25FA
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0082E616	2_2_0082E616
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007E66E1	2_2_007E66E1
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0080878F	2_2_0080878F
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00838889	2_2_00838889
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007E8808	2_2_007E8808
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00806844	2_2_00806844
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00850857	2_2_00850857
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007FCB21	2_2_007FCB21
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00806DB6	2_2_00806DB6
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007E6F9E	2_2_007E6F9E
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007E3030	2_2_007E3030
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007FF1D9	2_2_007FF1D9
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007F3187	2_2_007F3187
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007D1287	2_2_007D1287
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007F1484	2_2_007F1484
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007E5520	2_2_007E5520
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007F7696	2_2_007F7696
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007E5760	2_2_007E5760
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007F1978	2_2_007F1978
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00809AB5	2_2_00809AB5
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00857DDB	2_2_00857DDB
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007FBDA6	2_2_007FBDA6
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007F1D90	2_2_007F1D90
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007DDF00	2_2_007DDF00
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007E3FE0	2_2_007E3FE0
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00FBB170	2_2_00FBB170
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0041D071	3_2_0041D071
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_004520D2	3_2_004520D2
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0043D098	3_2_0043D098
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00437150	3_2_00437150
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_004361AA	3_2_004361AA
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00426254	3_2_00426254
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00431377	3_2_00431377
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0041E5DF	3_2_0041E5DF
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0044C739	3_2_0044C739
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_004267CB	3_2_004267CB
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0043C9DD	3_2_0043C9DD
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00432A49	3_2_00432A49
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0043CC0C	3_2_0043CC0C
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00434D22	3_2_00434D22
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00426E73	3_2_00426E73
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00440E20	3_2_00440E20
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0043CE3B	3_2_0043CE3B
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00412F45	3_2_00412F45
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00452F00	3_2_00452F00
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00426FAD	3_2_00426FAD
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_012EA930	3_2_012EA930

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: String function: 002D7DE1 appears 35 times
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: String function: 002F0AE3 appears 70 times
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: String function: 002F8900 appears 42 times
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: String function: 007F0AE3 appears 70 times
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: String function: 007F8900 appears 42 times
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: String function: 004020E7 appears 40 times
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: String function: 007D7DE1 appears 35 times
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: String function: 00401F66 appears 50 times
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: String function: 004338A5 appears 41 times
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: String function: 00433FB0 appears 55 times

Source: 8kjlHXmbAY.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: bankrupture.exe PID: 5048, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: bankrupture.exe PID: 6392, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: bankrupture.exe PID: 712, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@8/8@0/1

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_0033A06A GetLastError,FormatMessageW,

0_2_0033A06A

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_003281CB AdjustTokenPrivileges,CloseHandle,	0_2_003281CB
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_003287E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_003287E1
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_008281CB AdjustTokenPrivileges,CloseHandle,	2_2_008281CB
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_008287E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	2_2_008287E1
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00416AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	3_2_00416AB7

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_0033B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0033B333

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_0034EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0034EE0D

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_003483BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_003483BB

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_002D4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_002D4E89

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: 3_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

3_2_00419BC4

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

File created: C:\Users\user\AppData\Local\ectosphere

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-R1T905

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

File created: C:\Users\user\AppData\Local\Temp\aut9ABF.tmp

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bankrupture.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: 8kjlHXmbAY.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

File read: C:\Users\user\Desktop\8kjlHXmbAY.exe

Source: unknown	Process created: C:\Users\user\Desktop\8kjlHXmbAY.exe "C:\Users\user\Desktop\8kjlHXmbAY.exe"
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Process created: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe "C:\Users\user\Desktop\8kjlHXmbAY.exe"
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Process created: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe "C:\Users\user\AppData\Local\ectosphere\bankrupture.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bankrupture.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe "C:\Users\user\AppData\Local\ectosphere\bankrupture.exe"
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Process created: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe "C:\Users\user\Desktop\8kjlHXmbAY.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Process created: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe "C:\Users\user\AppData\Local\ectosphere\bankrupture.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe "C:\Users\user\AppData\Local\ectosphere\bankrupture.exe"	Jump to behavior

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00429A50 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00429A50

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002F8945 push ecx; ret	0_2_002F8958
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007F8945 push ecx; ret	2_2_007F8958
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_004567E0 push eax; ret	3_2_004567FE
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0045B9DD push esi; ret	3_2_0045B9E6
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00455EAF push ecx; ret	3_2_00455EC2
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00433FF6 push ecx; ret	3_2_00434009

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: 3_2_00406128 ShellExecuteW,URLDownloadToFileW,

3_2_00406128

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

File created: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bankrupture.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bankrupture.vbs

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bankrupture.vbs

Delayed program exit found

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: 3_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

3_2_00419BC4

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002D48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_002D48D7
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00355376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_00355376
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007D48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	2_2_007D48D7
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00855376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	2_2_00855376

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_002F3187 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_002F3187

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: 3_2_0040E54F Sleep,ExitProcess,

3_2_0040E54F

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_002DC49A rdtsc

0_2_002DC49A

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

3_2_004198C2

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Window / User API: threadDelayed 510	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Window / User API: threadDelayed 8989	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Window / User API: foregroundWindowGot 1741	Jump to behavior

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-103138

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	API coverage: 4.6 %
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	API coverage: 4.5 %

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe TID: 6224	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe TID: 1036	Thread sleep time: -1530000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe TID: 1036	Thread sleep time: -26967000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0033445A
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033C6D1 FindFirstFileW,FindClose,	0_2_0033C6D1
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0033C75C
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0033EF95
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0033F0F2
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0033F3F3
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_003337EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_003337EF
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00333B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00333B12
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_0033BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0033BCBC
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0083445A
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083C6D1 FindFirstFileW,FindClose,	2_2_0083C6D1
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0083C75C
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0083EF95
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0083F0F2
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0083F3F3
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_008337EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_008337EF
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00833B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00833B12
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_0083BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0083BCBC
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	3_2_0040B335
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	3_2_0041B42F
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	3_2_0040B53A
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0044D5E9 FindFirstFileExA,	3_2_0044D5E9
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	3_2_004089A9
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00406AC2 FindFirstFileW,FindNextFileW,	3_2_00406AC2
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	3_2_00407A8C
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,	3_2_00418C69
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	3_2_00408DA7

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: 3_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

3_2_00406F06

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_002D49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_002D49A0

Source: teer.0.dr	Binary or memory string: VMCIYAH
Source: bankrupture.exe, 00000008.00000003.2380227439.000000000145C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareworkstation.exe
Source: bankrupture.exe, 00000003.00000002.4674197020.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_002DC49A rdtsc

0_2_002DC49A

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00343F09 BlockInput,

0_2_00343F09

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_002D3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_002D3B3A

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00305A7C RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

0_2_00305A7C

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00429A50 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00429A50

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_014F9786 mov eax, dword ptr fs:[00000030h]	0_2_014F9786
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_014F9798 mov eax, dword ptr fs:[00000030h]	0_2_014F9798
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_014FADD8 mov eax, dword ptr fs:[00000030h]	0_2_014FADD8
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_014FAE38 mov eax, dword ptr fs:[00000030h]	0_2_014FAE38
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00FBB060 mov eax, dword ptr fs:[00000030h]	2_2_00FBB060
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00FBB000 mov eax, dword ptr fs:[00000030h]	2_2_00FBB000
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00FB99C0 mov eax, dword ptr fs:[00000030h]	2_2_00FB99C0
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00FB99AE mov eax, dword ptr fs:[00000030h]	2_2_00FB99AE
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00442554 mov eax, dword ptr fs:[00000030h]	3_2_00442554
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_012E916E mov eax, dword ptr fs:[00000030h]	3_2_012E916E
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_012E9180 mov eax, dword ptr fs:[00000030h]	3_2_012E9180
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_012EA7C0 mov eax, dword ptr fs:[00000030h]	3_2_012EA7C0
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_012EA820 mov eax, dword ptr fs:[00000030h]	3_2_012EA820

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_003280A9 GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,

0_2_003280A9

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002FA124 SetUnhandledExceptionFilter,	0_2_002FA124
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_002FA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_002FA155
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007FA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_007FA155
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_007FA124 SetUnhandledExceptionFilter,	2_2_007FA124
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00434168 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00434168
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0043A65D
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00433B44 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00433B44
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 3_2_00433CD7 SetUnhandledExceptionFilter,	3_2_00433CD7

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

3_2_00410F36

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_003287B1 LogonUserW,

0_2_003287B1

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_002D3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_002D3B3A

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_002D48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_002D48D7

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00334C27 mouse_event,

0_2_00334C27

Source: C:\Windows\System32\wscript.exe

Process created: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe "C:\Users\user\AppData\Local\ectosphere\bankrupture.exe"

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00327CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00327CAF

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_0032874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0032874B

Source: 8kjlHXmbAY.exe, 00000000.00000002.2240081920.0000000000384000.00000040.00000001.01000000.00000003.sdmp, bankrupture.exe, 00000002.00000002.2276041187.0000000000884000.00000040.00000001.01000000.00000004.sdmp, bankrupture.exe, 00000003.00000002.4673374422.0000000000884000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: bankrupture.exe, 00000003.00000002.4674277679.000000000136C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager0.26:8787
Source: bankrupture.exe, 00000003.00000002.4674277679.000000000136C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerineer
Source: bankrupture.exe, 00000003.00000002.4674197020.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager05\rivers
Source: bankrupture.exe, 00000003.00000002.4674388122.000000000145C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 8kjlHXmbAY.exe, bankrupture.exe	Binary or memory string: Shell_TrayWnd
Source: bankrupture.exe, 00000003.00000002.4674277679.000000000136C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager05\7
Source: bankrupture.exe, 00000003.00000002.4674277679.000000000136C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager05\
Source: bankrupture.exe, 00000003.00000002.4674277679.000000000136C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager0.26
Source: bankrupture.exe, 00000003.00000002.4674388122.000000000145C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerztS
Source: bankrupture.exe, 00000003.00000002.4673994833.000000000125C000.00000004.00000020.00020000.00000000.sdmp, bankrupture.exe, 00000003.00000002.4674197020.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: bankrupture.exe, 00000003.00000002.4673994833.000000000127B000.00000004.00000020.00020000.00000000.sdmp, logs.dat.3.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_002F862B cpuid

0_2_002F862B

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: EnumSystemLocalesW,	3_2_004470AE
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: GetLocaleInfoW,	3_2_004510BA
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_004511E3
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: GetLocaleInfoW,	3_2_004512EA
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_004513B7
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: GetLocaleInfoW,	3_2_00447597
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: GetLocaleInfoA,	3_2_0040E679
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	3_2_00450A7F
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: EnumSystemLocalesW,	3_2_00450CF7
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: EnumSystemLocalesW,	3_2_00450D42
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: EnumSystemLocalesW,	3_2_00450DDD
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00450E6A

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00304E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00304E87

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00311E06 GetUserNameW,

0_2_00311E06

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_00303F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00303F3A

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Code function: 0_2_002D49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_002D49A0

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: bankrupture.exe, 00000002.00000003.2240754170.000000000103C000.00000004.00000020.00020000.00000000.sdmp, bankrupture.exe, 00000002.00000003.2240632258.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, bankrupture.exe, 00000002.00000002.2278410761.000000000103C000.00000004.00000020.00020000.00000000.sdmp, bankrupture.exe, 00000003.00000003.2276875654.000000000136C000.00000004.00000020.00020000.00000000.sdmp, bankrupture.exe, 00000003.00000003.2276581975.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, bankrupture.exe, 00000003.00000002.4674277679.000000000136C000.00000004.00000020.00020000.00000000.sdmp, bankrupture.exe, 00000008.00000003.2379612064.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, bankrupture.exe, 00000008.00000002.2406102574.000000000145C000.00000004.00000020.00020000.00000000.sdmp, bankrupture.exe, 00000008.00000003.2380227439.000000000145C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: msmpeng.exe

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4673994833.000000000125C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674197020.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674782285.0000000003FEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2406102574.000000000145C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674388122.000000000145C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674277679.000000000136C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 5048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 712, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

3_2_0040B21B

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		3_2_0040B335
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: \key3.db		3_2_0040B335

Source: bankrupture.exe	Binary or memory string: WIN_81
Source: bankrupture.exe	Binary or memory string: WIN_XP
Source: bankrupture.exe	Binary or memory string: WIN_XPe
Source: bankrupture.exe	Binary or memory string: WIN_VISTA
Source: bankrupture.exe	Binary or memory string: WIN_7
Source: bankrupture.exe	Binary or memory string: WIN_8
Source: bankrupture.exe, 00000008.00000002.2404955093.0000000000884000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-R1T905			Jump to behavior
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-R1T905			Jump to behavior

Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bankrupture.exe.33f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bankrupture.exe.3b70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bankrupture.exe.2020000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4673994833.000000000125C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674197020.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674782285.0000000003FEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2406102574.000000000145C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674388122.000000000145C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4674277679.000000000136C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 5048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bankrupture.exe PID: 712, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Code function: cmd.exe

3_2_00405042

Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00346283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	0_2_00346283
Source: C:\Users\user\Desktop\8kjlHXmbAY.exe	Code function: 0_2_00346747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00346747
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00846283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	2_2_00846283
Source: C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	Code function: 2_2_00846747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	2_2_00846747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	2 Native API	111 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	2 Valid Accounts	1 Bypass User Account Control	21 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Windows Service	2 Valid Accounts	1 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	26 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Windows Service	1 Bypass User Account Control	Cached Domain Credentials	151 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	22 Process Injection	1 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	22 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8kjlHXmbAY.exe	71%	ReversingLabs	Win32.Backdoor.Remcos
8kjlHXmbAY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\ectosphere\bankrupture.exe	71%	ReversingLabs	Win32.Backdoor.Remcos

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	bankrupture.exe	false		high
http://geoplugin.net/json.gp/C	bankrupture.exe, 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, bankrupture.exe, 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, bankrupture.exe, 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, bankrupture.exe, 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, bankrupture.exe, 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.210.150.26	unknown	United States		36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588569
Start date and time:	2025-01-11 02:29:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8kjlHXmbAY.exe renamed because original name is a hash value
Original Sample Name:	199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@8/8@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 282
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 8kjlHXmbAY.exe

Simulations

Behavior and APIs

Time	Type	Description
02:31:02	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bankrupture.vbs
20:31:37	API Interceptor	6467129x Sleep call for process: bankrupture.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
192.210.150.26	NssBkEQKsI.exe	Get hash	malicious	Remcos	Browse
	l1QC9H0SNR.exe	Get hash	malicious	Remcos	Browse
	bwYw3UUfy7.exe	Get hash	malicious	Remcos	Browse
	FACTURA.xlsx	Get hash	malicious	Remcos	Browse
	7056ZCiFdE.exe	Get hash	malicious	Remcos	Browse
	uIarPolvHR.exe	Get hash	malicious	Remcos	Browse
	IB9876789000.bat.exe	Get hash	malicious	Remcos	Browse
	z49FACTURA-0987678.exe	Get hash	malicious	Remcos	Browse
	FAT6789098700900.scr.exe	Get hash	malicious	Remcos	Browse
	Rgh99876k7e.exe	Get hash	malicious	Remcos	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	OKkUGRkZV7.exe	Get hash	malicious	Remcos	Browse	192.3.64.152
	NssBkEQKsI.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	l1QC9H0SNR.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	MLxloAVuCZ.exe	Get hash	malicious	Remcos	Browse	192.3.64.152
	bwYw3UUfy7.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	192.3.27.144
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	192.3.27.144
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	192.3.27.144
	sh4.elf	Get hash	malicious	Mirai	Browse	23.95.117.229
	sweetnessgoodforgreatnessthingswithgood.tIF.vbs	Get hash	malicious	SmokeLoader	Browse	192.3.27.144

Process:	C:\Users\user\AppData\Local\ectosphere\bankrupture.exe
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	3.372193214916272
Encrypted:	false
SSDEEP:	3:rglsOlfXlndlfTlFi5JWRal2Jl+7R0DAlBG4moojklovDl6v:Mls6no5YcIeeDAlS1gWAv
MD5:	86E233BCB693849E583F529B437F701C
SHA1:	CD1108BAA3030D416F90B161DB9379409988927B
SHA-256:	1C7881173FDD297CEA77DB31C732ACE7307FA6BD2A436C05F695D3CFECABAE6F
SHA-512:	EEC7A43BE7FE4916549ACA142E078909C1D624CEDA6CE5BADC60253825E5CF72C25198B605D33CA9B5320776583F10D893E2674A8E244E1C498BDFE9156EB1A4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.5./.0.1./.1.0. .2.0.:.3.1.:.0.4. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Temp\aut9ABF.tmp

Process:	C:\Users\user\Desktop\8kjlHXmbAY.exe
File Type:	data
Category:	dropped
Size (bytes):	429886
Entropy (8bit):	7.975798750489699
Encrypted:	false
SSDEEP:	12288:JH2xVZcyDiOCfp0pBFervkfysMmscsDgVv:cZNDicClsMWv
MD5:	A9A0E5250052A7C19D3272E47DBF1F2D
SHA1:	19D121B655A3802195D307C0431F84CEB9042D7B
SHA-256:	2CB6C8E181DD25247599136ADA37C8CFC64BDC5B073A236524A97182BA8FC720
SHA-512:	8427FF93F6F6F7849BE19E9DD93418067FE7E4DA271E7E694A37FEAB606803A3A031979838C55551B0C7D590E5959CBB53A8DDFEDEE36494769FAE7DBC1E2D4B
Malicious:	false
Reputation:	low
Preview:	EA06......x.z.2.J...T...I..j..]..W.R&.JE..G.......N..i .....f.M..2.E....a-....g...s...u(..dR...]Y.I.6....G.W.r...-...$.....A.P-`....<Y_.;)..@=.?.?..../..%.....;..............v..&3{i..7.x6k}...x....qh.. .....{@..........8vWA...xu.6.c..8+.k....pV...?....Hj......Q.]....T&2...`....2.K.M...l..I..j.....7.R.#...pD......7..i.j`..M..@M1..)...LRh..J.$.8.2.J...?1Y.P.OR...T.}^.H...[>Z..J..T....I...\|`....T.U@....1...x.....p>....C..' ..R.P.......c4.P.~>.L.Q..%3i4....U@?1...)..0...... ..D.}..8$10...1........3...x.=.MC........'...p`..T........k1..%.P....Ri0....J...!.z.(........?..V.v...."...@......J.}=s..&........C..h)..]....v-...~MG...i-..[..x^..t.N/.J.W..\X...Ws.Mj.....W.C#.zD{/-..}.xD.u...r.Mf!1...J.G.^bt}]..J....HE;W_....G.;i..;..=../.."..<..K....:N2{..Q...."i\.J.4}^..I..?.-..I..s.\..:..;.k}....I..:\|"+H..-..Mv.\.Q....im.....%3{....R....I..nS\....].sM.j.G...rxT.u.Shq.U~....aU}.z74.K.r.53{<.M*Q.w....Mw..-..?..n3M.....e...t....j.6`..!+.. .0...#.D.Z{.r.M.I.....

C:\Users\user\AppData\Local\Temp\autA85C.tmp

Process:	C:\Users\user\AppData\Local\ectosphere\bankrupture.exe
File Type:	data
Category:	dropped
Size (bytes):	429886
Entropy (8bit):	7.975798750489699
Encrypted:	false
SSDEEP:	12288:JH2xVZcyDiOCfp0pBFervkfysMmscsDgVv:cZNDicClsMWv
MD5:	A9A0E5250052A7C19D3272E47DBF1F2D
SHA1:	19D121B655A3802195D307C0431F84CEB9042D7B
SHA-256:	2CB6C8E181DD25247599136ADA37C8CFC64BDC5B073A236524A97182BA8FC720
SHA-512:	8427FF93F6F6F7849BE19E9DD93418067FE7E4DA271E7E694A37FEAB606803A3A031979838C55551B0C7D590E5959CBB53A8DDFEDEE36494769FAE7DBC1E2D4B
Malicious:	false
Reputation:	low
Preview:	EA06......x.z.2.J...T...I..j..]..W.R&.JE..G.......N..i .....f.M..2.E....a-....g...s...u(..dR...]Y.I.6....G.W.r...-...$.....A.P-`....<Y_.;)..@=.?.?..../..%.....;..............v..&3{i..7.x6k}...x....qh.. .....{@..........8vWA...xu.6.c..8+.k....pV...?....Hj......Q.]....T&2...`....2.K.M...l..I..j.....7.R.#...pD......7..i.j`..M..@M1..)...LRh..J.$.8.2.J...?1Y.P.OR...T.}^.H...[>Z..J..T....I...\|`....T.U@....1...x.....p>....C..' ..R.P.......c4.P.~>.L.Q..%3i4....U@?1...)..0...... ..D.}..8$10...1........3...x.=.MC........'...p`..T........k1..%.P....Ri0....J...!.z.(........?..V.v...."...@......J.}=s..&........C..h)..]....v-...~MG...i-..[..x^..t.N/.J.W..\X...Ws.Mj.....W.C#.zD{/-..}.xD.u...r.Mf!1...J.G.^bt}]..J....HE;W_....G.;i..;..=../.."..<..K....:N2{..Q...."i\.J.4}^..I..?.-..I..s.\..:..;.k}....I..:\|"+H..-..Mv.\.Q....im.....%3{....R....I..nS\....].sM.j.G...rxT.u.Shq.U~....aU}.z74.K.r.53{<.M*Q.w....Mw..-..?..n3M.....e...t....j.6`..!+.. .0...#.D.Z{.r.M.I.....

C:\Users\user\AppData\Local\Temp\autB77F.tmp

Process:	C:\Users\user\AppData\Local\ectosphere\bankrupture.exe
File Type:	data
Category:	dropped
Size (bytes):	429886
Entropy (8bit):	7.975798750489699
Encrypted:	false
SSDEEP:	12288:JH2xVZcyDiOCfp0pBFervkfysMmscsDgVv:cZNDicClsMWv
MD5:	A9A0E5250052A7C19D3272E47DBF1F2D
SHA1:	19D121B655A3802195D307C0431F84CEB9042D7B
SHA-256:	2CB6C8E181DD25247599136ADA37C8CFC64BDC5B073A236524A97182BA8FC720
SHA-512:	8427FF93F6F6F7849BE19E9DD93418067FE7E4DA271E7E694A37FEAB606803A3A031979838C55551B0C7D590E5959CBB53A8DDFEDEE36494769FAE7DBC1E2D4B
Malicious:	false
Reputation:	low
Preview:	EA06......x.z.2.J...T...I..j..]..W.R&.JE..G.......N..i .....f.M..2.E....a-....g...s...u(..dR...]Y.I.6....G.W.r...-...$.....A.P-`....<Y_.;)..@=.?.?..../..%.....;..............v..&3{i..7.x6k}...x....qh.. .....{@..........8vWA...xu.6.c..8+.k....pV...?....Hj......Q.]....T&2...`....2.K.M...l..I..j.....7.R.#...pD......7..i.j`..M..@M1..)...LRh..J.$.8.2.J...?1Y.P.OR...T.}^.H...[>Z..J..T....I...\|`....T.U@....1...x.....p>....C..' ..R.P.......c4.P.~>.L.Q..%3i4....U@?1...)..0...... ..D.}..8$10...1........3...x.=.MC........'...p`..T........k1..%.P....Ri0....J...!.z.(........?..V.v...."...@......J.}=s..&........C..h)..]....v-...~MG...i-..[..x^..t.N/.J.W..\X...Ws.Mj.....W.C#.zD{/-..}.xD.u...r.Mf!1...J.G.^bt}]..J....HE;W_....G.;i..;..=../.."..<..K....:N2{..Q...."i\.J.4}^..I..?.-..I..s.\..:..;.k}....I..:\|"+H..-..Mv.\.Q....im.....%3{....R....I..nS\....].sM.j.G...rxT.u.Shq.U~....aU}.z74.K.r.53{<.M*Q.w....Mw..-..?..n3M.....e...t....j.6`..!+.. .0...#.D.Z{.r.M.I.....

C:\Users\user\AppData\Local\Temp\autDF0C.tmp

Process:	C:\Users\user\AppData\Local\ectosphere\bankrupture.exe
File Type:	data
Category:	dropped
Size (bytes):	429886
Entropy (8bit):	7.975798750489699
Encrypted:	false
SSDEEP:	12288:JH2xVZcyDiOCfp0pBFervkfysMmscsDgVv:cZNDicClsMWv
MD5:	A9A0E5250052A7C19D3272E47DBF1F2D
SHA1:	19D121B655A3802195D307C0431F84CEB9042D7B
SHA-256:	2CB6C8E181DD25247599136ADA37C8CFC64BDC5B073A236524A97182BA8FC720
SHA-512:	8427FF93F6F6F7849BE19E9DD93418067FE7E4DA271E7E694A37FEAB606803A3A031979838C55551B0C7D590E5959CBB53A8DDFEDEE36494769FAE7DBC1E2D4B
Malicious:	false
Reputation:	low
Preview:	EA06......x.z.2.J...T...I..j..]..W.R&.JE..G.......N..i .....f.M..2.E....a-....g...s...u(..dR...]Y.I.6....G.W.r...-...$.....A.P-`....<Y_.;)..@=.?.?..../..%.....;..............v..&3{i..7.x6k}...x....qh.. .....{@..........8vWA...xu.6.c..8+.k....pV...?....Hj......Q.]....T&2...`....2.K.M...l..I..j.....7.R.#...pD......7..i.j`..M..@M1..)...LRh..J.$.8.2.J...?1Y.P.OR...T.}^.H...[>Z..J..T....I...\|`....T.U@....1...x.....p>....C..' ..R.P.......c4.P.~>.L.Q..%3i4....U@?1...)..0...... ..D.}..8$10...1........3...x.=.MC........'...p`..T........k1..%.P....Ri0....J...!.z.(........?..V.v...."...@......J.}=s..&........C..h)..]....v-...~MG...i-..[..x^..t.N/.J.W..\X...Ws.Mj.....W.C#.zD{/-..}.xD.u...r.Mf!1...J.G.^bt}]..J....HE;W_....G.;i..;..=../.."..<..K....:N2{..Q...."i\.J.4}^..I..?.-..I..s.\..:..;.k}....I..:\|"+H..-..Mv.\.Q....im.....%3{....R....I..nS\....].sM.j.G...rxT.u.Shq.U~....aU}.z74.K.r.53{<.M*Q.w....Mw..-..?..n3M.....e...t....j.6`..!+.. .0...#.D.Z{.r.M.I.....

C:\Users\user\AppData\Local\Temp\teer

Process:	C:\Users\user\Desktop\8kjlHXmbAY.exe
File Type:	data
Category:	dropped
Size (bytes):	492544
Entropy (8bit):	7.67718671619172
Encrypted:	false
SSDEEP:	12288:PvfRxY8MNdyNmAfFEzSawPhQH7m+IHECU8cZpuudTCM/:PBxY76mAfFZadbKW8cZMudb
MD5:	BD289FA20B842C995C4616D9CF521DF5
SHA1:	6D85A647C2995355869131522CA6C3F087DB187A
SHA-256:	686DEAE06FA39D9D353C1433D1C43A360877631186A36FF92BB29C3914D6238E
SHA-512:	2004F457EA076B9E7243388AE1132790BE023636BE70C9161B38954AEF6E27E2049EC87C5AF7205A60964CC08BF9E968D9DA71307A462C168F3BEA7ADE302BE7
Malicious:	false
Reputation:	low
Preview:	...G@LUJK7RH..CI.5U1KFMW.H44HGTGCLUJO7RHMNCII5U1KFMWRH44HGTGKMUJA(.FM.J.h.T}.g.?;;.D:(35"!u).Y<'9n!,iG _k/#w..g.%(0"mAX@k7RHMNCI...............O.}.....A.i.Z}..G.f......w......i.L..............h.......l.......~...}..........[f......\.t.....Z........!W\....CLUJO7RH..CI.4P1 .i0RH44HGTG.LWKD6\XM.FII.W1KFMWhs74HWTGC<PJO7.HM^CII7U1NFLWRH44MGUGCLUJO.UHMJCII5U1IFM.RH$4HWTGCLEJO'RHMNCIY5U1KFMWRH44h.RGGMUJOWUH..CII5U1KFMWRH44HGTGC.RJ..RH].EIq5U1KFMWRH44HGTGCLUJ..THUNCI..S1.FMWRH44HGTGC<PJ.3RHMNCII5U1KFMWRH44HGTGCLUJaC709NCITjP1KVMWR(14HCTGCLUJO7RHMNCIi5UQe4)6&)44H.UGC<PJO.SHM*FII5U1KFMWRH44.GT.m(4>.7RH!.CII5R1KHMWR.24HGTGCLUJO7RH.NC.gG&C(FMW..44H'SGC.UJO.THMNCII5U1KFMW.H4tf51+,/UJ..RHM.DII.U1K.JWRH44HGTGCLUJ.7R.MNCII5U1KFMWRH44HGTGCLUJO7RHMNCII5U1KFMWRH44HGTGCLUJO7RHMNCII5U1KFMWRH44HGTGCLUJO7RHMNCII5U1KFMWRH44HGTGCLUJO7RHMNCII5U1KFMWRH44HGTGCLUJO7RHMNCII5U1KFMWRH44HGTGCLUJO7RHMNCII5U1KFMWRH44HGTGCLUJO7RHMNCII5U1KFMWRH44HGTGCLUJO7RHMNCII5U1KFMWRH44HGTGCLUJO7RHMNCII5U1KFMWRH44HGTGCLUJO7RHMNCII5U1

C:\Users\user\AppData\Local\ectosphere\bankrupture.exe

Process:	C:\Users\user\Desktop\8kjlHXmbAY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	883712
Entropy (8bit):	7.965059355400651
Encrypted:	false
SSDEEP:	24576:Krl6kD68JmlotQfnkSjkpoftUXoBmZieeiftIZpr:4l328U2yfnrQaZoZiEFIZp
MD5:	57F7D9095490A4AADDA9E261FEC73A68
SHA1:	45E51F97ABC52DD29E65D7EC78E18EE8D1721867
SHA-256:	199AB84D301B4914A7EB23A40A575E2622928E58D3672DA79E43C77E453C4A3D
SHA-512:	80512A3188E69746425F828E394A0BF9EA6B50B4DDA5B5F0B819248610D58D6FBD7862F29D42266F473515E60EADB2B5038C3EE9F7F9B26BB0A22981552F1810
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L... .Pg.........."......`... ...0..P....@........@.......................................@...@.......@.....................p...$.......p...........................................................4...H...........................................UPX0.....0..............................UPX1.....`...@...^..................@....rsrc.... ...........b..............@..............................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bankrupture.vbs

Process:	C:\Users\user\AppData\Local\ectosphere\bankrupture.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.3788356634696783
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfclzXUEZ+lX1AlMZ+DA6dnriIM8lfQVn:DsO+vNlDQ1AlQ+MMmA2n
MD5:	81E716278BAE3DD53BD95DD2173CA48E
SHA1:	BE61CDBA80BBF73D9DE4C19C5BB7217EF5DE2D06
SHA-256:	A606B0EE745E34B034DE70BB8E20B576A0D26F2DB915BE2FE64FFE2C6C9B31E7
SHA-512:	88CF7A63C021DFEE8F3AA7C04EC10C21094677D4A43FEC661AE04F39DAD1166D6B0480023DB426F6F122E8C22D5C2B8EACC6F4ACC24213DB8B9308AC0FF83973
Malicious:	true
Reputation:	low
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.e.c.t.o.s.p.h.e.r.e.\.b.a.n.k.r.u.p.t.u.r.e...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.965059355400651
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	8kjlHXmbAY.exe
File size:	883'712 bytes
MD5:	57f7d9095490a4aadda9e261fec73a68
SHA1:	45e51f97abc52dd29e65d7ec78e18ee8d1721867
SHA256:	199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d
SHA512:	80512a3188e69746425f828e394a0bf9ea6b50b4dda5b5f0b819248610d58d6fbd7862f29d42266f473515e60eadb2b5038c3ee9f7f9b26bb0a22981552f1810
SSDEEP:	24576:Krl6kD68JmlotQfnkSjkpoftUXoBmZieeiftIZpr:4l328U2yfnrQaZoZiEFIZp
TLSH:	7115238A06D19963C254577080BDDD645E7874739ECA7B9EC36AE71BEC30307AC0AB4D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x559a50
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6750F820 [Thu Dec 5 00:47:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fc6683d30d9f25244a50fd5357825e79

Entrypoint Preview

Instruction
pushad
mov esi, 00504000h
lea edi, dword ptr [esi-00103000h]
push edi
jmp 00007FAA38E35B4Dh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007FAA38E35B49h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FAA38E35B2Fh
mov eax, 00000001h
add ebx, ebx
jne 00007FAA38E35B49h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007FAA38E35B4Dh
jne 00007FAA38E35B6Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FAA38E35B61h
dec eax
add ebx, ebx
jne 00007FAA38E35B49h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007FAA38E35B16h
add ebx, ebx
jne 00007FAA38E35B49h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007FAA38E35B94h
xor ecx, ecx
sub eax, 03h
jc 00007FAA38E35B53h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007FAA38E35BB7h
sar eax, 1
mov ebp, eax
jmp 00007FAA38E35B4Dh
add ebx, ebx
jne 00007FAA38E35B49h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FAA38E35B0Eh
inc ecx
add ebx, ebx
jne 00007FAA38E35B49h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FAA38E35B00h
add ebx, ebx
jne 00007FAA38E35B49h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007FAA38E35B31h
jne 00007FAA38E35B4Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FAA38E35B26h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007FAA38E35B50h
mov al, byte ptr [edx]

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1db570	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15a000	0x81570	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1db994	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x159c34	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x103000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x104000	0x56000	0x55e00	9a5ee3a0c86f199bf122a550c0a65f3c	False	0.9871241584788938	data	7.935458009975686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x15a000	0x82000	0x81a00	8b3caa2c8cfbffabd42a74ba70e0b5d7	False	0.961195530978785	data	7.960290229125983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x15a5ac	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0x15a6d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0x15a804	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0x15a930	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0x15ac1c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0x15ad48	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0x15bbf4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0x15c4a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0x15ca0c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0x15efb8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0x160064	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	empty	English	Great Britain	0
RT_STRING	0xcd4f0	0x594	empty	English	Great Britain	0
RT_STRING	0xcda84	0x68a	empty	English	Great Britain	0
RT_STRING	0xce110	0x490	empty	English	Great Britain	0
RT_STRING	0xce5a0	0x5fc	empty	English	Great Britain	0
RT_STRING	0xceb9c	0x65c	empty	English	Great Britain	0
RT_STRING	0xcf1f8	0x466	empty	English	Great Britain	0
RT_STRING	0xcf660	0x158	empty	English	Great Britain	0
RT_RCDATA	0x1604d0	0x7ab07	data			1.0003203756952253
RT_GROUP_ICON	0x1dafdc	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x1db058	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1db070	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x1db088	0x14	data	English	Great Britain	1.25
RT_VERSION	0x1db0a0	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1db180	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	GetAce
COMCTL32.dll	ImageList_Remove
COMDLG32.dll	GetOpenFileNameW
GDI32.dll	LineTo
IPHLPAPI.DLL	IcmpSendEcho
MPR.dll	WNetUseConnectionW
ole32.dll	CoGetObject
OLEAUT32.dll	VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragFinish
USER32.dll	GetDC
USERENV.dll	LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WININET.dll	FtpOpenFileW
WINMM.dll	timeGetTime
WSOCK32.dll	connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:31:05.443278074 CET	49782	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:05.448179960 CET	8787	49782	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:05.448256016 CET	49782	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:05.448780060 CET	49782	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:05.453670979 CET	8787	49782	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:06.890799999 CET	8787	49782	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:06.890921116 CET	49782	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:06.891053915 CET	49782	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:06.895842075 CET	8787	49782	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:07.906284094 CET	49801	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:07.911159992 CET	8787	49801	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:07.911242962 CET	49801	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:07.911781073 CET	49801	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:07.916536093 CET	8787	49801	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:09.325340986 CET	8787	49801	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:09.325407982 CET	49801	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:09.325465918 CET	49801	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:09.330249071 CET	8787	49801	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:10.328095913 CET	49820	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:10.333106041 CET	8787	49820	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:10.333194971 CET	49820	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:10.333868027 CET	49820	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:10.338762999 CET	8787	49820	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:11.746443033 CET	8787	49820	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:11.746496916 CET	49820	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:11.746551991 CET	49820	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:11.751339912 CET	8787	49820	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:12.751195908 CET	49838	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:12.756186008 CET	8787	49838	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:12.756263971 CET	49838	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:12.760293961 CET	49838	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:12.765038013 CET	8787	49838	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:14.206666946 CET	8787	49838	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:14.206845999 CET	49838	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:14.206845999 CET	49838	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:14.212770939 CET	8787	49838	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:15.232902050 CET	49856	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:15.237791061 CET	8787	49856	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:15.239298105 CET	49856	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:15.242943048 CET	49856	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:15.247849941 CET	8787	49856	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:16.634737968 CET	8787	49856	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:16.634871960 CET	49856	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:16.634871960 CET	49856	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:16.640024900 CET	8787	49856	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:17.640490055 CET	49872	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:17.645831108 CET	8787	49872	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:17.645927906 CET	49872	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:17.646338940 CET	49872	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:17.651753902 CET	8787	49872	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:19.081588030 CET	8787	49872	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:19.081728935 CET	49872	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:19.081728935 CET	49872	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:19.087420940 CET	8787	49872	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:20.093764067 CET	49885	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:20.098577023 CET	8787	49885	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:20.098670006 CET	49885	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:20.099066973 CET	49885	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:20.103809118 CET	8787	49885	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:21.510458946 CET	8787	49885	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:21.510524035 CET	49885	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:21.510757923 CET	49885	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:21.515600920 CET	8787	49885	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:22.515481949 CET	49903	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:22.520339966 CET	8787	49903	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:22.520416975 CET	49903	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:22.520833969 CET	49903	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:22.525696039 CET	8787	49903	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:23.936595917 CET	8787	49903	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:23.936686039 CET	49903	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:23.936708927 CET	49903	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:23.941669941 CET	8787	49903	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:24.953735113 CET	49921	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:24.958616018 CET	8787	49921	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:24.959445000 CET	49921	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:24.959933996 CET	49921	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:24.964756966 CET	8787	49921	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:26.372728109 CET	8787	49921	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:26.372837067 CET	49921	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:26.372912884 CET	49921	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:26.377676010 CET	8787	49921	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:27.375582933 CET	49936	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:27.380577087 CET	8787	49936	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:27.380748034 CET	49936	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:27.381299973 CET	49936	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:27.386878967 CET	8787	49936	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:28.796571970 CET	8787	49936	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:28.796700001 CET	49936	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:28.796827078 CET	49936	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:28.801568985 CET	8787	49936	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:29.812242985 CET	49953	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:29.817125082 CET	8787	49953	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:29.817215919 CET	49953	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:29.817564964 CET	49953	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:29.822354078 CET	8787	49953	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:31.212498903 CET	8787	49953	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:31.212729931 CET	49953	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:31.212730885 CET	49953	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:31.217607021 CET	8787	49953	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:32.219357014 CET	49969	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:32.224205971 CET	8787	49969	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:32.224471092 CET	49969	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:32.224767923 CET	49969	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:32.229607105 CET	8787	49969	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:33.638323069 CET	8787	49969	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:33.638384104 CET	49969	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:33.639216900 CET	49969	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:33.644052029 CET	8787	49969	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:34.640851021 CET	49985	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:34.645917892 CET	8787	49985	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:34.646051884 CET	49985	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:34.646533966 CET	49985	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:34.651467085 CET	8787	49985	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:36.083566904 CET	8787	49985	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:36.083642006 CET	49985	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:36.083688021 CET	49985	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:36.088496923 CET	8787	49985	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:37.093815088 CET	49995	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:37.100142002 CET	8787	49995	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:37.100271940 CET	49995	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:37.100692987 CET	49995	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:37.106862068 CET	8787	49995	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:38.554140091 CET	8787	49995	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:38.554203987 CET	49995	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:38.554240942 CET	49995	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:38.559175014 CET	8787	49995	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:39.562460899 CET	49996	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:39.568579912 CET	8787	49996	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:39.568670988 CET	49996	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:39.569042921 CET	49996	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:39.573808908 CET	8787	49996	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:40.984052896 CET	8787	49996	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:40.984247923 CET	49996	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:40.986114025 CET	49996	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:40.990977049 CET	8787	49996	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:41.999903917 CET	49997	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:42.005130053 CET	8787	49997	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:42.005239964 CET	49997	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:42.005588055 CET	49997	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:42.010392904 CET	8787	49997	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:43.418291092 CET	8787	49997	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:43.418432951 CET	49997	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:43.419266939 CET	49997	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:43.424079895 CET	8787	49997	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:44.421997070 CET	49998	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:44.426959038 CET	8787	49998	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:44.427081108 CET	49998	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:44.427696943 CET	49998	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:44.432574987 CET	8787	49998	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:45.822895050 CET	8787	49998	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:45.823074102 CET	49998	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:45.823206902 CET	49998	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:45.827931881 CET	8787	49998	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:46.828926086 CET	49999	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:46.834111929 CET	8787	49999	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:46.834250927 CET	49999	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:46.834826946 CET	49999	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:46.839793921 CET	8787	49999	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:48.248053074 CET	8787	49999	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:48.248204947 CET	49999	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:48.248236895 CET	49999	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:48.254009008 CET	8787	49999	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:49.250148058 CET	50001	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:49.255100965 CET	8787	50001	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:49.255187988 CET	50001	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:49.255614996 CET	50001	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:49.260386944 CET	8787	50001	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:50.667773962 CET	8787	50001	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:50.667974949 CET	50001	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:50.667975903 CET	50001	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:50.672908068 CET	8787	50001	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:51.671916962 CET	50002	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:51.676836967 CET	8787	50002	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:51.676939964 CET	50002	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:51.677427053 CET	50002	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:51.682259083 CET	8787	50002	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:53.094279051 CET	8787	50002	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:53.094338894 CET	50002	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:53.094409943 CET	50002	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:53.099396944 CET	8787	50002	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:54.109431982 CET	50003	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:54.114274025 CET	8787	50003	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:54.114346027 CET	50003	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:54.114795923 CET	50003	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:54.119546890 CET	8787	50003	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:55.530018091 CET	8787	50003	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:55.530141115 CET	50003	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:55.530141115 CET	50003	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:55.537374973 CET	8787	50003	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:56.531244040 CET	50004	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:56.536156893 CET	8787	50004	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:56.536295891 CET	50004	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:56.536864042 CET	50004	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:56.541657925 CET	8787	50004	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:57.933216095 CET	8787	50004	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:57.933377981 CET	50004	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:57.933599949 CET	50004	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:57.938385963 CET	8787	50004	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:58.937485933 CET	50005	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:58.942343950 CET	8787	50005	192.210.150.26	192.168.2.6
Jan 11, 2025 02:31:58.942434072 CET	50005	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:58.942851067 CET	50005	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:31:58.947587967 CET	8787	50005	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:00.337548971 CET	8787	50005	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:00.337652922 CET	50005	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:00.340562105 CET	50005	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:00.345366955 CET	8787	50005	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:01.344080925 CET	50006	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:01.349277020 CET	8787	50006	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:01.349711895 CET	50006	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:01.350208998 CET	50006	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:01.355128050 CET	8787	50006	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:02.800870895 CET	8787	50006	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:02.801162958 CET	50006	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:02.824250937 CET	50006	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:02.829184055 CET	8787	50006	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:03.843662977 CET	50007	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:03.848586082 CET	8787	50007	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:03.848659992 CET	50007	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:03.849169970 CET	50007	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:03.854012966 CET	8787	50007	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:05.267805099 CET	8787	50007	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:05.267920971 CET	50007	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:05.268132925 CET	50007	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:05.273535013 CET	8787	50007	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:06.281380892 CET	50009	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:06.286461115 CET	8787	50009	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:06.286549091 CET	50009	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:06.286957979 CET	50009	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:06.291737080 CET	8787	50009	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:07.681946039 CET	8787	50009	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:07.685307980 CET	50009	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:07.685358047 CET	50009	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:07.690239906 CET	8787	50009	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:08.687529087 CET	50010	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:08.692620039 CET	8787	50010	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:08.692846060 CET	50010	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:08.693265915 CET	50010	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:08.698165894 CET	8787	50010	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:10.108612061 CET	8787	50010	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:10.108762026 CET	50010	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:10.108968019 CET	50010	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:10.113759995 CET	8787	50010	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:11.124943018 CET	50011	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:11.129875898 CET	8787	50011	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:11.129954100 CET	50011	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:11.130316973 CET	50011	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:11.135129929 CET	8787	50011	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:12.547899008 CET	8787	50011	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:12.547990084 CET	50011	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:12.547991037 CET	50011	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:12.552949905 CET	8787	50011	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:13.562333107 CET	50013	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:13.567286968 CET	8787	50013	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:13.567385912 CET	50013	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:13.567840099 CET	50013	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:13.572633028 CET	8787	50013	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:14.964373112 CET	8787	50013	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:14.964500904 CET	50013	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:14.964500904 CET	50013	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:14.969661951 CET	8787	50013	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:15.968868017 CET	50014	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:15.973895073 CET	8787	50014	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:15.973993063 CET	50014	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:15.974430084 CET	50014	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:15.979259014 CET	8787	50014	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:17.391381979 CET	8787	50014	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:17.391480923 CET	50014	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:17.391515017 CET	50014	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:17.396279097 CET	8787	50014	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:18.406368971 CET	50015	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:18.411289930 CET	8787	50015	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:18.411609888 CET	50015	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:18.411873102 CET	50015	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:18.416600943 CET	8787	50015	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:19.827488899 CET	8787	50015	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:19.827593088 CET	50015	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:19.827625990 CET	50015	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:19.832462072 CET	8787	50015	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:20.844260931 CET	50016	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:20.849445105 CET	8787	50016	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:20.852811098 CET	50016	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:20.853112936 CET	50016	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:20.857907057 CET	8787	50016	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:22.261995077 CET	8787	50016	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:22.265347958 CET	50016	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:22.265423059 CET	50016	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:22.270277977 CET	8787	50016	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:23.281440973 CET	50017	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:23.287729979 CET	8787	50017	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:23.287843943 CET	50017	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:23.288256884 CET	50017	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:23.294377089 CET	8787	50017	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:24.721637964 CET	8787	50017	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:24.721777916 CET	50017	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:24.721777916 CET	50017	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:24.726747990 CET	8787	50017	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:25.703725100 CET	50018	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:25.708801985 CET	8787	50018	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:25.711591005 CET	50018	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:25.711687088 CET	50018	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:25.716501951 CET	8787	50018	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:27.160671949 CET	8787	50018	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:27.160907984 CET	50018	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:27.160907984 CET	50018	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:27.165733099 CET	8787	50018	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:28.110068083 CET	50019	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:28.114895105 CET	8787	50019	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:28.115014076 CET	50019	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:28.115360975 CET	50019	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:28.120119095 CET	8787	50019	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:29.510627031 CET	8787	50019	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:29.510708094 CET	50019	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:29.510795116 CET	50019	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:29.515608072 CET	8787	50019	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:30.422463894 CET	50020	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:30.427361965 CET	8787	50020	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:30.427472115 CET	50020	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:30.427963972 CET	50020	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:30.432796955 CET	8787	50020	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:31.822478056 CET	8787	50020	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:31.822599888 CET	50020	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:31.822599888 CET	50020	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:31.827421904 CET	8787	50020	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:32.703205109 CET	50022	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:32.708473921 CET	8787	50022	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:32.708565950 CET	50022	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:32.708872080 CET	50022	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:32.713644028 CET	8787	50022	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:34.124792099 CET	8787	50022	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:34.124883890 CET	50022	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:34.124943972 CET	50022	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:34.129708052 CET	8787	50022	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:34.984474897 CET	50023	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:34.989445925 CET	8787	50023	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:34.989747047 CET	50023	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:34.989856958 CET	50023	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:34.994628906 CET	8787	50023	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:36.387859106 CET	8787	50023	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:36.387989044 CET	50023	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:36.388056993 CET	50023	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:36.394009113 CET	8787	50023	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:37.219913960 CET	50024	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:37.226203918 CET	8787	50024	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:37.226311922 CET	50024	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:37.226732969 CET	50024	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:37.232707024 CET	8787	50024	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:38.640338898 CET	8787	50024	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:38.640443087 CET	50024	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:38.640542030 CET	50024	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:38.645446062 CET	8787	50024	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:39.437593937 CET	50025	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:39.442998886 CET	8787	50025	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:39.445318937 CET	50025	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:39.445626974 CET	50025	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:39.450470924 CET	8787	50025	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:40.856079102 CET	8787	50025	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:40.856146097 CET	50025	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:40.856180906 CET	50025	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:40.860977888 CET	8787	50025	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:41.624965906 CET	50026	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:41.629837036 CET	8787	50026	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:41.630450964 CET	50026	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:41.630752087 CET	50026	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:41.635555029 CET	8787	50026	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:43.027858019 CET	8787	50026	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:43.027960062 CET	50026	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:43.028002024 CET	50026	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:43.033405066 CET	8787	50026	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:43.781287909 CET	50027	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:43.788393021 CET	8787	50027	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:43.788471937 CET	50027	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:43.788801908 CET	50027	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:43.795617104 CET	8787	50027	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:45.199796915 CET	8787	50027	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:45.199887991 CET	50027	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:45.199954987 CET	50027	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:45.204706907 CET	8787	50027	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:45.921901941 CET	50028	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:45.926898003 CET	8787	50028	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:45.926995993 CET	50028	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:45.927335978 CET	50028	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:45.932130098 CET	8787	50028	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:47.323331118 CET	8787	50028	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:47.327507973 CET	50028	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:47.327508926 CET	50028	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:47.332386017 CET	8787	50028	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:48.032655001 CET	50029	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:48.037554026 CET	8787	50029	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:48.037658930 CET	50029	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:48.037976027 CET	50029	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:48.042800903 CET	8787	50029	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:49.432962894 CET	8787	50029	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:49.433057070 CET	50029	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:49.433094025 CET	50029	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:49.438623905 CET	8787	50029	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:50.109514952 CET	50030	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:50.114439964 CET	8787	50030	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:50.114520073 CET	50030	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:50.114842892 CET	50030	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:50.119623899 CET	8787	50030	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:51.510736942 CET	8787	50030	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:51.510945082 CET	50030	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:51.510946035 CET	50030	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:51.515872002 CET	8787	50030	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:52.160557985 CET	50031	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:52.165685892 CET	8787	50031	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:52.166321993 CET	50031	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:52.166841984 CET	50031	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:52.171664953 CET	8787	50031	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:53.597646952 CET	8787	50031	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:53.597762108 CET	50031	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:53.597831964 CET	50031	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:53.602596998 CET	8787	50031	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:54.234391928 CET	50032	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:54.239367008 CET	8787	50032	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:54.239450932 CET	50032	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:54.239717007 CET	50032	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:54.244543076 CET	8787	50032	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:55.652548075 CET	8787	50032	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:55.652616978 CET	50032	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:55.652698040 CET	50032	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:55.657648087 CET	8787	50032	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:56.265762091 CET	50033	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:56.270657063 CET	8787	50033	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:56.270792007 CET	50033	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:56.271114111 CET	50033	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:56.275907040 CET	8787	50033	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:57.690388918 CET	8787	50033	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:57.690457106 CET	50033	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:57.690568924 CET	50033	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:57.695410013 CET	8787	50033	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:58.362365961 CET	50034	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:58.367367983 CET	8787	50034	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:58.367711067 CET	50034	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:58.367969990 CET	50034	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:58.372718096 CET	8787	50034	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:59.801244974 CET	8787	50034	192.210.150.26	192.168.2.6
Jan 11, 2025 02:32:59.801378965 CET	50034	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:59.801434994 CET	50034	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:32:59.806207895 CET	8787	50034	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:00.374922037 CET	50035	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:00.379930973 CET	8787	50035	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:00.381335020 CET	50035	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:00.381644964 CET	50035	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:00.386467934 CET	8787	50035	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:01.800343037 CET	8787	50035	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:01.800414085 CET	50035	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:01.800477028 CET	50035	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:01.805346966 CET	8787	50035	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:02.365596056 CET	50036	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:02.370513916 CET	8787	50036	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:02.373325109 CET	50036	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:02.373646975 CET	50036	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:02.378511906 CET	8787	50036	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:03.796593904 CET	8787	50036	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:03.796777964 CET	50036	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:03.800020933 CET	50036	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:03.804826021 CET	8787	50036	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:04.328357935 CET	50037	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:04.333230972 CET	8787	50037	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:04.333363056 CET	50037	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:04.333651066 CET	50037	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:04.338475943 CET	8787	50037	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:05.748071909 CET	8787	50037	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:05.748250961 CET	50037	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:05.748297930 CET	50037	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:05.753315926 CET	8787	50037	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:06.266231060 CET	50038	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:06.271497011 CET	8787	50038	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:06.271627903 CET	50038	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:06.271917105 CET	50038	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:06.276721001 CET	8787	50038	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:07.685133934 CET	8787	50038	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:07.685379982 CET	50038	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:07.685379982 CET	50038	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:07.690196037 CET	8787	50038	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:08.187834024 CET	50040	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:08.192742109 CET	8787	50040	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:08.192820072 CET	50040	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:08.193270922 CET	50040	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:08.198126078 CET	8787	50040	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:09.614613056 CET	8787	50040	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:09.614865065 CET	50040	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:09.615050077 CET	50040	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:09.619961023 CET	8787	50040	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:10.094153881 CET	50041	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:10.099116087 CET	8787	50041	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:10.099212885 CET	50041	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:10.099683046 CET	50041	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:10.104531050 CET	8787	50041	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:11.519067049 CET	8787	50041	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:11.519285917 CET	50041	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:11.519287109 CET	50041	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:11.524204016 CET	8787	50041	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:11.984460115 CET	50042	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:11.989387035 CET	8787	50042	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:11.993331909 CET	50042	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:11.993616104 CET	50042	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:11.998740911 CET	8787	50042	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:13.403956890 CET	8787	50042	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:13.409349918 CET	50042	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:13.410326958 CET	50042	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:13.415231943 CET	8787	50042	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:13.860784054 CET	50043	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:13.865845919 CET	8787	50043	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:13.865926981 CET	50043	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:13.871999025 CET	50043	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:13.876869917 CET	8787	50043	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:15.285173893 CET	8787	50043	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:15.285269022 CET	50043	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:15.285315990 CET	50043	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:15.290113926 CET	8787	50043	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:15.718502045 CET	50044	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:15.723531961 CET	8787	50044	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:15.723630905 CET	50044	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:15.724025965 CET	50044	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:15.728863955 CET	8787	50044	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:17.140096903 CET	8787	50044	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:17.140311003 CET	50044	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:17.140311003 CET	50044	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:17.145230055 CET	8787	50044	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:17.563384056 CET	50045	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:17.568701029 CET	8787	50045	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:17.569370985 CET	50045	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:17.569730997 CET	50045	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:17.574543953 CET	8787	50045	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:18.987097979 CET	8787	50045	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:18.987361908 CET	50045	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:18.987361908 CET	50045	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:18.992166042 CET	8787	50045	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:19.390465975 CET	50046	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:19.395267010 CET	8787	50046	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:19.397418022 CET	50046	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:19.398997068 CET	50046	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:19.403795004 CET	8787	50046	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:20.814795971 CET	8787	50046	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:20.814965963 CET	50046	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:20.814965963 CET	50046	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:20.820902109 CET	8787	50046	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:21.202835083 CET	50047	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:21.207791090 CET	8787	50047	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:21.207906961 CET	50047	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:21.208183050 CET	50047	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:21.212951899 CET	8787	50047	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:22.605595112 CET	8787	50047	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:22.605674982 CET	50047	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:22.605720997 CET	50047	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:22.610498905 CET	8787	50047	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:22.984112024 CET	50048	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:22.989037991 CET	8787	50048	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:22.989109993 CET	50048	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:22.989490032 CET	50048	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:22.994308949 CET	8787	50048	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:24.386535883 CET	8787	50048	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:24.386707067 CET	50048	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:24.386892080 CET	50048	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:24.391727924 CET	8787	50048	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:24.749928951 CET	50049	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:24.754687071 CET	8787	50049	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:24.754820108 CET	50049	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:24.755065918 CET	50049	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:24.759840965 CET	8787	50049	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:26.175685883 CET	8787	50049	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:26.175802946 CET	50049	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:26.175832987 CET	50049	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:26.180591106 CET	8787	50049	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:26.531306028 CET	50050	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:26.536169052 CET	8787	50050	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:26.536257982 CET	50050	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:26.536725998 CET	50050	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:26.541563988 CET	8787	50050	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:27.952912092 CET	8787	50050	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:27.953370094 CET	50050	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:27.953370094 CET	50050	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:27.958244085 CET	8787	50050	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:28.306185961 CET	50051	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:28.311048985 CET	8787	50051	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:28.313369036 CET	50051	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:28.354892015 CET	50051	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:28.360400915 CET	8787	50051	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:29.714524031 CET	8787	50051	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:29.714582920 CET	50051	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:29.714637995 CET	50051	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:29.719408035 CET	8787	50051	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:30.052346945 CET	50052	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:30.057105064 CET	8787	50052	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:30.057333946 CET	50052	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:30.057631969 CET	50052	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:30.062433958 CET	8787	50052	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:31.466253996 CET	8787	50052	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:31.466327906 CET	50052	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:31.466401100 CET	50052	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:31.471201897 CET	8787	50052	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:31.796807051 CET	50053	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:31.801853895 CET	8787	50053	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:31.801970959 CET	50053	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:31.802369118 CET	50053	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:31.807218075 CET	8787	50053	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:33.222367048 CET	8787	50053	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:33.222491026 CET	50053	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:33.222491980 CET	50053	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:33.227505922 CET	8787	50053	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:33.531002998 CET	50054	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:33.535891056 CET	8787	50054	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:33.535990000 CET	50054	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:33.536256075 CET	50054	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:33.541028023 CET	8787	50054	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:34.973026991 CET	8787	50054	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:34.973117113 CET	50054	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:34.973117113 CET	50054	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:34.977952957 CET	8787	50054	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:35.281017065 CET	50055	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:35.285868883 CET	8787	50055	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:35.285952091 CET	50055	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:35.286261082 CET	50055	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:35.291040897 CET	8787	50055	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:36.687562943 CET	8787	50055	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:36.687665939 CET	50055	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:36.687665939 CET	50055	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:36.692569971 CET	8787	50055	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:36.984298944 CET	50056	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:36.989257097 CET	8787	50056	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:36.989341974 CET	50056	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:36.989772081 CET	50056	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:36.994520903 CET	8787	50056	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:38.407301903 CET	8787	50056	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:38.409410954 CET	50056	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:38.409411907 CET	50056	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:38.414256096 CET	8787	50056	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:38.687266111 CET	50057	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:38.692198992 CET	8787	50057	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:38.692389965 CET	50057	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:38.692626953 CET	50057	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:38.697411060 CET	8787	50057	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:40.091844082 CET	8787	50057	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:40.091990948 CET	50057	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:40.091990948 CET	50057	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:40.096872091 CET	8787	50057	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:40.359400034 CET	50058	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:40.364584923 CET	8787	50058	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:40.365298986 CET	50058	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:40.368531942 CET	50058	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:40.373496056 CET	8787	50058	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:41.787460089 CET	8787	50058	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:41.787564039 CET	50058	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:41.787620068 CET	50058	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:41.792412043 CET	8787	50058	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:42.046886921 CET	50059	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:42.052285910 CET	8787	50059	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:42.052381992 CET	50059	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:42.052712917 CET	50059	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:42.057827950 CET	8787	50059	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:43.494180918 CET	8787	50059	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:43.494271994 CET	50059	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:43.494352102 CET	50059	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:43.502814054 CET	8787	50059	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:43.749790907 CET	50060	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:43.755328894 CET	8787	50060	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:43.755575895 CET	50060	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:43.755942106 CET	50060	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:43.760802984 CET	8787	50060	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:45.171892881 CET	8787	50060	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:45.173374891 CET	50060	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:45.173374891 CET	50060	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:45.178248882 CET	8787	50060	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:45.421700954 CET	50061	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:45.426578045 CET	8787	50061	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:45.426915884 CET	50061	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:45.427022934 CET	50061	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:45.431811094 CET	8787	50061	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:46.864533901 CET	8787	50061	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:46.864598036 CET	50061	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:46.864685059 CET	50061	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:46.869420052 CET	8787	50061	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:47.109097958 CET	50062	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:47.114108086 CET	8787	50062	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:47.114284039 CET	50062	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:47.115353107 CET	50062	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:47.120219946 CET	8787	50062	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:48.516745090 CET	8787	50062	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:48.516936064 CET	50062	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:48.516936064 CET	50062	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:48.521812916 CET	8787	50062	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:48.749871016 CET	50063	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:48.754826069 CET	8787	50063	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:48.754957914 CET	50063	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:48.755271912 CET	50063	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:48.760088921 CET	8787	50063	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:50.172189951 CET	8787	50063	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:50.173392057 CET	50063	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:50.173446894 CET	50063	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:50.178297997 CET	8787	50063	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:50.406111002 CET	50064	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:50.410950899 CET	8787	50064	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:50.411036015 CET	50064	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:50.411498070 CET	50064	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:50.416296959 CET	8787	50064	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:51.849791050 CET	8787	50064	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:51.849891901 CET	50064	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:51.849960089 CET	50064	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:51.854814053 CET	8787	50064	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:52.063112974 CET	50065	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:52.067950010 CET	8787	50065	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:52.068044901 CET	50065	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:52.068378925 CET	50065	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:52.073213100 CET	8787	50065	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:53.502100945 CET	8787	50065	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:53.502305031 CET	50065	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:53.502305031 CET	50065	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:53.507303953 CET	8787	50065	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:53.718451977 CET	50066	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:53.723227978 CET	8787	50066	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:53.723331928 CET	50066	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:53.723629951 CET	50066	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:53.728368998 CET	8787	50066	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:55.141185999 CET	8787	50066	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:55.141258955 CET	50066	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:55.141321898 CET	50066	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:55.146132946 CET	8787	50066	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:55.343717098 CET	50067	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:55.348773003 CET	8787	50067	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:55.348893881 CET	50067	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:55.349299908 CET	50067	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:55.354129076 CET	8787	50067	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:56.767946005 CET	8787	50067	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:56.768167973 CET	50067	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:56.768167973 CET	50067	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:56.773016930 CET	8787	50067	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:56.968574047 CET	50068	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:56.973583937 CET	8787	50068	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:56.973659039 CET	50068	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:56.974020958 CET	50068	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:56.978894949 CET	8787	50068	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:58.467262030 CET	8787	50068	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:58.467369080 CET	50068	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:58.467432976 CET	50068	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:58.472321987 CET	8787	50068	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:58.655942917 CET	50069	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:58.661040068 CET	8787	50069	192.210.150.26	192.168.2.6
Jan 11, 2025 02:33:58.661211967 CET	50069	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:58.661567926 CET	50069	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:33:58.666397095 CET	8787	50069	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:00.110271931 CET	8787	50069	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:00.110358000 CET	50069	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:00.110407114 CET	50069	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:00.115196943 CET	8787	50069	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:00.296685934 CET	50070	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:00.301795006 CET	8787	50070	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:00.301888943 CET	50070	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:00.302159071 CET	50070	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:00.306940079 CET	8787	50070	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:01.721200943 CET	8787	50070	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:01.721285105 CET	50070	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:01.721834898 CET	50070	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:01.727284908 CET	8787	50070	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:01.906024933 CET	50071	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:01.912600040 CET	8787	50071	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:01.912683010 CET	50071	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:01.913201094 CET	50071	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:01.918942928 CET	8787	50071	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:03.352025032 CET	8787	50071	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:03.352152109 CET	50071	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:03.352205038 CET	50071	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:03.357070923 CET	8787	50071	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:03.530936003 CET	50072	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:03.535928965 CET	8787	50072	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:03.536027908 CET	50072	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:03.536303997 CET	50072	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:03.541172028 CET	8787	50072	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:04.934201956 CET	8787	50072	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:04.934448004 CET	50072	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:04.934448004 CET	50072	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:04.939388037 CET	8787	50072	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:05.109440088 CET	50073	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:05.114438057 CET	8787	50073	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:05.114531994 CET	50073	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:05.114936113 CET	50073	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:05.119731903 CET	8787	50073	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:06.596299887 CET	8787	50073	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:06.596498013 CET	50073	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:06.596498966 CET	50073	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:06.601341963 CET	8787	50073	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:06.765516043 CET	50074	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:06.771104097 CET	8787	50074	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:06.771193027 CET	50074	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:06.771533966 CET	50074	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:06.776333094 CET	8787	50074	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:08.172684908 CET	8787	50074	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:08.172781944 CET	50074	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:08.172838926 CET	50074	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:08.180722952 CET	8787	50074	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:08.327909946 CET	50075	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:08.332921982 CET	8787	50075	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:08.333165884 CET	50075	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:08.333432913 CET	50075	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:08.338186026 CET	8787	50075	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:09.730695009 CET	8787	50075	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:09.730776072 CET	50075	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:09.730813980 CET	50075	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:09.735634089 CET	8787	50075	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:09.890572071 CET	50076	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:09.895616055 CET	8787	50076	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:09.895698071 CET	50076	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:09.895987988 CET	50076	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:09.900772095 CET	8787	50076	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:11.295269966 CET	8787	50076	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:11.295423985 CET	50076	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:11.295634031 CET	50076	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:11.300673008 CET	8787	50076	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:11.437220097 CET	50077	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:11.442370892 CET	8787	50077	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:11.442487001 CET	50077	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:11.442802906 CET	50077	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:11.447648048 CET	8787	50077	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:12.859873056 CET	8787	50077	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:12.860080004 CET	50077	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:12.860080004 CET	50077	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:12.864994049 CET	8787	50077	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:13.000004053 CET	50078	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:13.005223036 CET	8787	50078	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:13.005311012 CET	50078	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:13.005660057 CET	50078	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:13.010385990 CET	8787	50078	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:14.443162918 CET	8787	50078	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:14.443244934 CET	50078	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:14.443300009 CET	50078	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:14.448226929 CET	8787	50078	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:14.578121901 CET	50079	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:14.583060026 CET	8787	50079	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:14.583188057 CET	50079	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:14.583560944 CET	50079	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:14.588480949 CET	8787	50079	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:16.003546953 CET	8787	50079	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:16.004484892 CET	50079	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:16.004484892 CET	50079	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:16.009329081 CET	8787	50079	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:16.140599012 CET	50080	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:16.145705938 CET	8787	50080	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:16.149163961 CET	50080	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:16.149163961 CET	50080	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:16.154014111 CET	8787	50080	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:17.584794044 CET	8787	50080	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:17.585051060 CET	50080	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:17.585051060 CET	50080	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:17.589919090 CET	8787	50080	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:17.718607903 CET	50081	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:17.723575115 CET	8787	50081	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:17.723701000 CET	50081	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:17.724011898 CET	50081	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:17.728827953 CET	8787	50081	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:19.144784927 CET	8787	50081	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:19.144876003 CET	50081	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:19.144978046 CET	50081	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:19.149808884 CET	8787	50081	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:19.265460968 CET	50082	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:19.270387888 CET	8787	50082	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:19.270462036 CET	50082	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:19.270782948 CET	50082	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:19.275608063 CET	8787	50082	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:20.688994884 CET	8787	50082	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:20.689143896 CET	50082	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:20.689143896 CET	50082	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:20.694055080 CET	8787	50082	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:20.812340975 CET	50083	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:20.817327976 CET	8787	50083	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:20.817456961 CET	50083	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:20.817754984 CET	50083	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:20.822670937 CET	8787	50083	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:22.231439114 CET	8787	50083	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:22.231821060 CET	50083	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:22.231821060 CET	50083	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:22.236717939 CET	8787	50083	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:22.343683958 CET	50084	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:22.348680019 CET	8787	50084	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:22.348891020 CET	50084	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:22.349289894 CET	50084	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:22.354022980 CET	8787	50084	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:23.768373966 CET	8787	50084	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:23.768450975 CET	50084	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:23.768488884 CET	50084	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:23.773319006 CET	8787	50084	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:23.892185926 CET	50085	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:23.897125006 CET	8787	50085	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:23.897233009 CET	50085	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:23.902806044 CET	50085	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:23.907568932 CET	8787	50085	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:25.326858997 CET	8787	50085	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:25.326922894 CET	50085	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:25.327037096 CET	50085	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:25.331907034 CET	8787	50085	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:25.437220097 CET	50086	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:25.442270994 CET	8787	50086	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:25.442348957 CET	50086	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:25.442610979 CET	50086	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:25.447416067 CET	8787	50086	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:26.864207029 CET	8787	50086	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:26.869504929 CET	50086	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:26.869504929 CET	50086	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:26.876523018 CET	8787	50086	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:26.984113932 CET	50087	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:26.989268064 CET	8787	50087	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:26.989373922 CET	50087	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:26.989638090 CET	50087	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:26.995417118 CET	8787	50087	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:28.411403894 CET	8787	50087	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:28.411504984 CET	50087	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:28.411550999 CET	50087	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:28.417113066 CET	8787	50087	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:28.515496969 CET	50088	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:28.520648956 CET	8787	50088	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:28.520742893 CET	50088	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:28.521063089 CET	50088	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:28.525943041 CET	8787	50088	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:29.936388016 CET	8787	50088	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:29.936464071 CET	50088	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:29.936510086 CET	50088	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:29.941349030 CET	8787	50088	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:30.035171032 CET	50089	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:30.040365934 CET	8787	50089	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:30.040467978 CET	50089	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:30.040904045 CET	50089	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:30.045768023 CET	8787	50089	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:31.454396009 CET	8787	50089	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:31.454478025 CET	50089	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:31.454511881 CET	50089	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:31.459479094 CET	8787	50089	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:31.546626091 CET	50090	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:31.551561117 CET	8787	50090	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:31.553383112 CET	50090	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:31.553670883 CET	50090	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:31.558557987 CET	8787	50090	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:32.968254089 CET	8787	50090	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:32.968360901 CET	50090	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:33.022346020 CET	50090	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:33.027229071 CET	8787	50090	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:33.225241899 CET	50091	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:33.230211973 CET	8787	50091	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:33.230298042 CET	50091	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:33.230978966 CET	50091	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:33.235745907 CET	8787	50091	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:34.622385979 CET	8787	50091	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:34.622524023 CET	50091	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:34.622823954 CET	50091	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:34.627604961 CET	8787	50091	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:34.718462944 CET	50092	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:34.723365068 CET	8787	50092	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:34.723592997 CET	50092	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:34.723920107 CET	50092	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:34.728691101 CET	8787	50092	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:36.123023033 CET	8787	50092	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:36.123121977 CET	50092	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:36.123121977 CET	50092	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:36.127964020 CET	8787	50092	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:36.218755007 CET	50093	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:36.223722935 CET	8787	50093	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:36.223795891 CET	50093	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:36.224251032 CET	50093	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:36.229105949 CET	8787	50093	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:37.638150930 CET	8787	50093	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:37.638262033 CET	50093	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:37.638299942 CET	50093	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:37.643101931 CET	8787	50093	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:37.718488932 CET	50096	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:37.723453999 CET	8787	50096	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:37.723551035 CET	50096	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:37.723860979 CET	50096	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:37.728751898 CET	8787	50096	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:39.126576900 CET	8787	50096	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:39.126775980 CET	50096	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:39.126775980 CET	50096	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:39.131623030 CET	8787	50096	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:39.219360113 CET	50097	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:39.224276066 CET	8787	50097	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:39.224853039 CET	50097	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:39.225785971 CET	50097	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:39.230638981 CET	8787	50097	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:40.678740978 CET	8787	50097	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:40.678836107 CET	50097	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:40.678870916 CET	50097	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:40.683717012 CET	8787	50097	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:40.765435934 CET	50098	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:40.770400047 CET	8787	50098	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:40.770495892 CET	50098	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:40.770812035 CET	50098	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:40.775636911 CET	8787	50098	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:42.235821962 CET	8787	50098	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:42.235896111 CET	50098	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:42.235999107 CET	50098	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:42.240941048 CET	8787	50098	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:42.312552929 CET	50099	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:42.317557096 CET	8787	50099	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:42.317635059 CET	50099	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:42.318062067 CET	50099	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:42.322891951 CET	8787	50099	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:43.784099102 CET	8787	50099	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:43.784210920 CET	50099	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:43.784245014 CET	50099	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:43.791419029 CET	8787	50099	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:43.859364986 CET	50100	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:43.864329100 CET	8787	50100	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:43.864444017 CET	50100	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:43.864778042 CET	50100	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:43.869510889 CET	8787	50100	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:45.263046980 CET	8787	50100	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:45.265383005 CET	50100	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:45.269619942 CET	50100	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:45.277869940 CET	8787	50100	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:45.343456030 CET	50101	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:45.351150036 CET	8787	50101	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:45.351247072 CET	50101	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:45.351541996 CET	50101	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:45.358818054 CET	8787	50101	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:46.766968012 CET	8787	50101	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:46.767047882 CET	50101	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:46.767086983 CET	50101	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:46.771927118 CET	8787	50101	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:46.843604088 CET	50102	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:46.848716021 CET	8787	50102	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:46.848826885 CET	50102	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:46.849128008 CET	50102	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:46.853992939 CET	8787	50102	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:48.252593040 CET	8787	50102	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:48.252651930 CET	50102	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:48.252717018 CET	50102	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:48.257503033 CET	8787	50102	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:48.328279972 CET	50103	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:48.333385944 CET	8787	50103	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:48.333523989 CET	50103	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:48.334013939 CET	50103	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:48.338931084 CET	8787	50103	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:49.731956959 CET	8787	50103	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:49.732037067 CET	50103	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:49.732100010 CET	50103	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:49.736998081 CET	8787	50103	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:49.796756029 CET	50104	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:49.801832914 CET	8787	50104	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:49.805458069 CET	50104	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:49.805917978 CET	50104	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:49.810719967 CET	8787	50104	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:51.221930027 CET	8787	50104	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:51.223478079 CET	50104	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:51.227364063 CET	50104	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:51.232302904 CET	8787	50104	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:51.296674967 CET	50105	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:51.301637888 CET	8787	50105	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:51.305428982 CET	50105	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:51.305687904 CET	50105	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:51.310493946 CET	8787	50105	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:52.743736982 CET	8787	50105	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:52.743872881 CET	50105	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:52.743922949 CET	50105	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:52.748704910 CET	8787	50105	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:52.812294960 CET	50106	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:52.817228079 CET	8787	50106	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:52.817339897 CET	50106	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:52.817715883 CET	50106	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:52.822474957 CET	8787	50106	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:54.237987995 CET	8787	50106	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:54.238064051 CET	50106	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:54.238111019 CET	50106	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:54.242969990 CET	8787	50106	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:54.298785925 CET	50107	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:54.303832054 CET	8787	50107	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:54.303911924 CET	50107	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:54.304502964 CET	50107	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:54.309269905 CET	8787	50107	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:55.718010902 CET	8787	50107	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:55.718091965 CET	50107	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:55.718280077 CET	50107	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:55.723056078 CET	8787	50107	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:55.781148911 CET	50108	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:55.786130905 CET	8787	50108	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:55.786218882 CET	50108	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:55.786571026 CET	50108	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:55.791423082 CET	8787	50108	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:57.204704046 CET	8787	50108	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:57.204857111 CET	50108	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:57.204857111 CET	50108	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:57.209791899 CET	8787	50108	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:57.265568972 CET	50109	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:57.270472050 CET	8787	50109	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:57.270657063 CET	50109	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:57.270927906 CET	50109	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:57.276690960 CET	8787	50109	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:58.708709955 CET	8787	50109	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:58.708830118 CET	50109	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:58.708831072 CET	50109	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:58.713726044 CET	8787	50109	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:58.765423059 CET	50110	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:58.770363092 CET	8787	50110	192.210.150.26	192.168.2.6
Jan 11, 2025 02:34:58.770437002 CET	50110	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:58.770741940 CET	50110	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:34:58.775577068 CET	8787	50110	192.210.150.26	192.168.2.6
Jan 11, 2025 02:35:00.185872078 CET	8787	50110	192.210.150.26	192.168.2.6
Jan 11, 2025 02:35:00.187879086 CET	50110	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:35:00.187879086 CET	50110	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:35:00.192823887 CET	8787	50110	192.210.150.26	192.168.2.6
Jan 11, 2025 02:35:00.249870062 CET	50111	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:35:00.254981995 CET	8787	50111	192.210.150.26	192.168.2.6
Jan 11, 2025 02:35:00.257477045 CET	50111	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:35:00.257817984 CET	50111	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:35:00.262620926 CET	8787	50111	192.210.150.26	192.168.2.6
Jan 11, 2025 02:35:01.673810005 CET	8787	50111	192.210.150.26	192.168.2.6
Jan 11, 2025 02:35:01.673901081 CET	50111	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:35:01.724816084 CET	50111	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:35:01.729806900 CET	8787	50111	192.210.150.26	192.168.2.6
Jan 11, 2025 02:35:02.734353065 CET	50112	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:35:02.739274979 CET	8787	50112	192.210.150.26	192.168.2.6
Jan 11, 2025 02:35:02.739372969 CET	50112	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:35:02.739654064 CET	50112	8787	192.168.2.6	192.210.150.26
Jan 11, 2025 02:35:02.744415045 CET	8787	50112	192.210.150.26	192.168.2.6
Jan 11, 2025 02:35:04.163652897 CET	8787	50112	192.210.150.26	192.168.2.6
Jan 11, 2025 02:35:04.163724899 CET	50112	8787	192.168.2.6	192.210.150.26

Target ID:	0
Start time:	20:30:54
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\8kjlHXmbAY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8kjlHXmbAY.exe"
Imagebase:	0x2d0000
File size:	883'712 bytes
MD5 hash:	57F7D9095490A4AADDA9E261FEC73A68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	20:30:57
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\ectosphere\bankrupture.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8kjlHXmbAY.exe"
Imagebase:	0x7d0000
File size:	883'712 bytes
MD5 hash:	57F7D9095490A4AADDA9E261FEC73A68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.2279878788.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	20:31:01
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\ectosphere\bankrupture.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ectosphere\bankrupture.exe"
Imagebase:	0x7d0000
File size:	883'712 bytes
MD5 hash:	57F7D9095490A4AADDA9E261FEC73A68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.4673994833.000000000125C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.4674197020.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000003.00000002.4673225476.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.4674782285.0000000003FEF000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000003.00000002.4674734687.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.4674388122.000000000145C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.4674277679.000000000136C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	7
Start time:	20:31:10
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bankrupture.vbs"
Imagebase:	0x7ff6a99e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	20:31:11
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\ectosphere\bankrupture.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ectosphere\bankrupture.exe"
Imagebase:	0x7d0000
File size:	883'712 bytes
MD5 hash:	57F7D9095490A4AADDA9E261FEC73A68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.2406102574.000000000145C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.2406547212.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.2404726914.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true