Edit tour

Windows Analysis Report
Order Drawing.exe

Overview

General Information

Sample name:	Order Drawing.exe (renamed file extension from pif to exe)
Original sample name:	Order Drawing.pif
Analysis ID:	1591546
MD5:	3a9da3edc40736cc832eded3c389a661
SHA1:	f32f61fb4458696dae4f15d82377163521e4f8b5
SHA256:	f2418ca6e602c9470a8b6e32172432726e50b00d6e7a0ee5bd70d0172017d6c3
Infos:

Detection

Remcos, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Remcos RAT

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates autostart registry keys with suspicious names

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores large binary data to the registry

Uses 32bit PE files

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

Order Drawing.exe (PID: 4084 cmdline: "C:\Users\user\Desktop\Order Drawing.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)

Order Drawing.exe (PID: 6432 cmdline: "C:\Users\user\Desktop\Order Drawing.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)

remcos.exe (PID: 3908 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)

remcos.exe (PID: 5464 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)

WMIADAP.exe (PID: 3908 cmdline: wmiadap.exe /F /T /R MD5: 1BFFABBD200C850E6346820E92B915DC)

remcos.exe (PID: 6808 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)

remcos.exe (PID: 1492 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)

remcos.exe (PID: 5840 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)

remcos.exe (PID: 5916 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)

remcos.exe (PID: 6452 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)

remcos.exe (PID: 2052 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)

remcos.exe (PID: 5576 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["87.120.116.245:2400:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-24L73B", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.4576882925.00000000013E8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2127574047.00000000040D9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000C.00000002.2334188947.0000000000D37000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000003.00000002.2125985990.000000000116A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000E.00000002.2418028511.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c708:$a1: Remcos restarted by watchdog! 0x6cc80:$a3: %02i:%02i:%02i:%03i
00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x66994:$str_a1: C:\Windows\System32\cmd.exe 0x66910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x67410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x66a04:$str_b2: Executing file: 0x6784c:$str_b3: GetDirectListeningPort 0x67200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67380:$str_b7: \update.vbs 0x66a2c:$str_b9: Downloaded file: 0x66a18:$str_b10: Downloading file: 0x66abc:$str_b12: Failed to upload file: 0x67814:$str_b13: StartForward 0x67834:$str_b14: StopForward 0x672d8:$str_b15: fso.DeleteFile " 0x6726c:$str_b16: On Error Resume Next 0x67308:$str_b17: fso.DeleteFolder " 0x66aac:$str_b18: Uploaded file: 0x66a6c:$str_b19: Unable to delete: 0x672a0:$str_b20: while fso.FileExists(" 0x66f49:$str_c0: [Firefox StoredLogins not found]
00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x66880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x66810:$s1: CoGetObject 0x66824:$s1: CoGetObject 0x66840:$s1: CoGetObject 0x70480:$s1: CoGetObject 0x667d0:$s2: Elevation:Administrator!new:
00000008.00000002.2248582094.0000000001097000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2132909890.0000000007510000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b540:$a1: Remcos restarted by watchdog! 0x6bab8:$a3: %02i:%02i:%02i:%03i
00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x14a300:$a1: Remcos restarted by watchdog! 0x16c520:$a1: Remcos restarted by watchdog! 0x14a878:$a3: %02i:%02i:%02i:%03i 0x16ca98:$a3: %02i:%02i:%02i:%03i
Process Memory Space: Order Drawing.exe PID: 4084	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Order Drawing.exe PID: 4084	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Order Drawing.exe PID: 4084	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Order Drawing.exe PID: 4084	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Order Drawing.exe PID: 4084	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x30ca4:$a1: Remcos restarted by watchdog! 0x8c851:$a1: Remcos restarted by watchdog! 0x31201:$a3: %02i:%02i:%02i:%03i 0x315b0:$a3: %02i:%02i:%02i:%03i 0x8cdae:$a3: %02i:%02i:%02i:%03i 0x8d166:$a3: %02i:%02i:%02i:%03i
Process Memory Space: Order Drawing.exe PID: 6432	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Order Drawing.exe PID: 6432	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Order Drawing.exe PID: 6432	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Order Drawing.exe PID: 6432	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xbab4:$a1: Remcos restarted by watchdog! 0xc011:$a3: %02i:%02i:%02i:%03i 0xc3c9:$a3: %02i:%02i:%02i:%03i
Process Memory Space: remcos.exe PID: 3908	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: remcos.exe PID: 5464	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: remcos.exe PID: 5840	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: remcos.exe PID: 6452	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: remcos.exe PID: 5576	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Remcos\remcos.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Order Drawing.exe, ProcessId: 6432, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-24L73B

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Remcos\remcos.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Order Drawing.exe, ProcessId: 6432, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-24L73B

Stealing of Sensitive Information

Sigma detected: Remcos

Source: Registry Key set

Author: Joe Security: Data: Details: 66 57 27 95 79 E4 43 60 A3 C1 CC 09 A2 F2 B0 DC C9 0C 47 50 1A D8 96 5A E5 39 C8 E5 77 FA BB 03 2E 29 40 1B B4 6E C5 35 05 56 FF 36 06 0F 9B D4 CE 11 07 FB BA C6 2D C8 B6 8A 17 DB 53 B8 CE 8E EE 46 , EventID: 13, EventType: SetValue, Image: C:\ProgramData\Remcos\remcos.exe, ProcessId: 5464, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Rmc-24L73B\exepath

Suricata Signatures

ET JA3 Hash - Remcos 3.x/4.x TLS Connection

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T03:52:04.621826+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49712	87.120.116.245	2400	TCP
2025-01-15T03:52:07.276937+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49716	87.120.116.245	2400	TCP
2025-01-15T03:52:09.933454+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49719	87.120.116.245	2400	TCP
2025-01-15T03:52:12.591489+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49730	87.120.116.245	2400	TCP
2025-01-15T03:52:15.259743+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49751	87.120.116.245	2400	TCP
2025-01-15T03:52:17.865612+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49769	87.120.116.245	2400	TCP
2025-01-15T03:52:20.509590+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49788	87.120.116.245	2400	TCP
2025-01-15T03:52:23.185289+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49807	87.120.116.245	2400	TCP
2025-01-15T03:52:25.819711+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49824	87.120.116.245	2400	TCP
2025-01-15T03:52:28.449209+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49844	87.120.116.245	2400	TCP
2025-01-15T03:52:31.107542+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49860	87.120.116.245	2400	TCP
2025-01-15T03:52:33.725550+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49878	87.120.116.245	2400	TCP
2025-01-15T03:52:36.355943+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49892	87.120.116.245	2400	TCP
2025-01-15T03:52:38.991383+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49908	87.120.116.245	2400	TCP
2025-01-15T03:52:41.640594+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49923	87.120.116.245	2400	TCP
2025-01-15T03:52:44.275865+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49944	87.120.116.245	2400	TCP
2025-01-15T03:52:46.916957+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49960	87.120.116.245	2400	TCP
2025-01-15T03:52:49.543468+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49976	87.120.116.245	2400	TCP
2025-01-15T03:52:52.164880+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49993	87.120.116.245	2400	TCP
2025-01-15T03:52:54.792057+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50004	87.120.116.245	2400	TCP
2025-01-15T03:52:57.399239+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50008	87.120.116.245	2400	TCP
2025-01-15T03:53:00.026488+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50009	87.120.116.245	2400	TCP
2025-01-15T03:53:02.666994+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50010	87.120.116.245	2400	TCP
2025-01-15T03:53:05.272535+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50011	87.120.116.245	2400	TCP
2025-01-15T03:53:07.901999+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50012	87.120.116.245	2400	TCP
2025-01-15T03:53:10.667114+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50013	87.120.116.245	2400	TCP
2025-01-15T03:53:13.290530+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50014	87.120.116.245	2400	TCP
2025-01-15T03:53:16.025531+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50015	87.120.116.245	2400	TCP
2025-01-15T03:53:18.654842+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50017	87.120.116.245	2400	TCP
2025-01-15T03:53:21.310575+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50018	87.120.116.245	2400	TCP
2025-01-15T03:53:24.026035+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50019	87.120.116.245	2400	TCP
2025-01-15T03:53:26.639649+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50020	87.120.116.245	2400	TCP
2025-01-15T03:53:29.429905+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50022	87.120.116.245	2400	TCP
2025-01-15T03:53:32.046934+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50023	87.120.116.245	2400	TCP
2025-01-15T03:53:34.617455+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50024	87.120.116.245	2400	TCP
2025-01-15T03:53:37.152143+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50025	87.120.116.245	2400	TCP
2025-01-15T03:53:39.635619+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50026	87.120.116.245	2400	TCP
2025-01-15T03:53:42.105080+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50027	87.120.116.245	2400	TCP
2025-01-15T03:53:44.559002+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50028	87.120.116.245	2400	TCP
2025-01-15T03:53:46.982082+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50029	87.120.116.245	2400	TCP
2025-01-15T03:53:49.370483+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50030	87.120.116.245	2400	TCP
2025-01-15T03:53:51.781420+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50031	87.120.116.245	2400	TCP
2025-01-15T03:53:54.119693+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50032	87.120.116.245	2400	TCP
2025-01-15T03:53:56.414225+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50033	87.120.116.245	2400	TCP
2025-01-15T03:53:58.734421+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50034	87.120.116.245	2400	TCP
2025-01-15T03:54:01.072076+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50035	87.120.116.245	2400	TCP
2025-01-15T03:54:03.347669+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50036	87.120.116.245	2400	TCP
2025-01-15T03:54:05.985373+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50037	87.120.116.245	2400	TCP
2025-01-15T03:54:08.214670+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50038	87.120.116.245	2400	TCP
2025-01-15T03:54:10.401862+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50039	87.120.116.245	2400	TCP
2025-01-15T03:54:12.635517+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50040	87.120.116.245	2400	TCP
2025-01-15T03:54:14.794990+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50041	87.120.116.245	2400	TCP
2025-01-15T03:54:16.953465+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50042	87.120.116.245	2400	TCP
2025-01-15T03:54:19.127044+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50043	87.120.116.245	2400	TCP
2025-01-15T03:54:21.246733+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50044	87.120.116.245	2400	TCP
2025-01-15T03:54:23.355981+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50045	87.120.116.245	2400	TCP
2025-01-15T03:54:25.455162+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50046	87.120.116.245	2400	TCP
2025-01-15T03:54:27.512718+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50047	87.120.116.245	2400	TCP
2025-01-15T03:54:29.563773+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50048	87.120.116.245	2400	TCP
2025-01-15T03:54:31.590137+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50049	87.120.116.245	2400	TCP
2025-01-15T03:54:33.626385+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50050	87.120.116.245	2400	TCP
2025-01-15T03:54:35.618968+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50051	87.120.116.245	2400	TCP
2025-01-15T03:54:37.607783+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50052	87.120.116.245	2400	TCP
2025-01-15T03:54:39.571156+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50053	87.120.116.245	2400	TCP
2025-01-15T03:54:41.546819+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50054	87.120.116.245	2400	TCP
2025-01-15T03:54:43.514335+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50055	87.120.116.245	2400	TCP
2025-01-15T03:54:45.450274+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50056	87.120.116.245	2400	TCP
2025-01-15T03:54:47.388118+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50057	87.120.116.245	2400	TCP
2025-01-15T03:54:49.326076+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50058	87.120.116.245	2400	TCP
2025-01-15T03:54:51.247416+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50059	87.120.116.245	2400	TCP
2025-01-15T03:54:53.155519+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50060	87.120.116.245	2400	TCP
2025-01-15T03:54:55.062336+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50061	87.120.116.245	2400	TCP
2025-01-15T03:54:57.011473+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50062	87.120.116.245	2400	TCP
2025-01-15T03:54:58.908122+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50064	87.120.116.245	2400	TCP
2025-01-15T03:55:00.799650+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50065	87.120.116.245	2400	TCP
2025-01-15T03:55:02.659829+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50066	87.120.116.245	2400	TCP
2025-01-15T03:55:06.915609+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50067	87.120.116.245	2400	TCP
2025-01-15T03:55:08.773635+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50068	87.120.116.245	2400	TCP
2025-01-15T03:55:10.623543+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50069	87.120.116.245	2400	TCP
2025-01-15T03:55:12.451874+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50070	87.120.116.245	2400	TCP
2025-01-15T03:55:14.278998+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50071	87.120.116.245	2400	TCP
2025-01-15T03:55:16.091815+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50072	87.120.116.245	2400	TCP
2025-01-15T03:55:17.923995+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50073	87.120.116.245	2400	TCP
2025-01-15T03:55:19.752076+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50074	87.120.116.245	2400	TCP
2025-01-15T03:55:21.565936+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50075	87.120.116.245	2400	TCP
2025-01-15T03:55:23.377942+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50076	87.120.116.245	2400	TCP
2025-01-15T03:55:25.150772+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50077	87.120.116.245	2400	TCP
2025-01-15T03:55:26.900548+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50078	87.120.116.245	2400	TCP
2025-01-15T03:55:28.650328+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50079	87.120.116.245	2400	TCP
2025-01-15T03:55:30.439932+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50080	87.120.116.245	2400	TCP
2025-01-15T03:55:32.218938+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50081	87.120.116.245	2400	TCP
2025-01-15T03:55:33.963133+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50082	87.120.116.245	2400	TCP
2025-01-15T03:55:35.733580+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50083	87.120.116.245	2400	TCP
2025-01-15T03:55:37.500070+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50084	87.120.116.245	2400	TCP
2025-01-15T03:55:39.280091+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50085	87.120.116.245	2400	TCP
2025-01-15T03:55:41.103972+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50086	87.120.116.245	2400	TCP
2025-01-15T03:55:42.878679+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50087	87.120.116.245	2400	TCP
2025-01-15T03:55:44.608497+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50088	87.120.116.245	2400	TCP
2025-01-15T03:55:46.355985+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50089	87.120.116.245	2400	TCP
2025-01-15T03:55:48.108490+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50090	87.120.116.245	2400	TCP
2025-01-15T03:55:49.843749+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50091	87.120.116.245	2400	TCP
2025-01-15T03:55:51.557415+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50092	87.120.116.245	2400	TCP
2025-01-15T03:55:53.280261+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50093	87.120.116.245	2400	TCP
2025-01-15T03:55:54.984081+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50094	87.120.116.245	2400	TCP
2025-01-15T03:55:56.728142+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50095	87.120.116.245	2400	TCP
2025-01-15T03:55:58.471338+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50096	87.120.116.245	2400	TCP
2025-01-15T03:56:00.234766+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50097	87.120.116.245	2400	TCP
2025-01-15T03:56:01.971692+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50098	87.120.116.245	2400	TCP
2025-01-15T03:56:03.704158+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50099	87.120.116.245	2400	TCP
2025-01-15T03:56:05.629334+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50100	87.120.116.245	2400	TCP
2025-01-15T03:56:07.343262+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50101	87.120.116.245	2400	TCP
2025-01-15T03:56:09.965505+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	50102	87.120.116.245	2400	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000005.00000002.4576882925.00000000013E8000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": ["87.120.116.245:2400:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-24L73B", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Remcos\remcos.exe	ReversingLabs: Detection: 68%
Source: C:\ProgramData\Remcos\remcos.exe	Virustotal: Detection: 77%			Perma Link

Multi AV Scanner detection for submitted file

Source: Order Drawing.exe	Virustotal: Detection: 77%			Perma Link
Source: Order Drawing.exe	ReversingLabs: Detection: 68%

Yara detected Remcos RAT

Source: Yara match	File source: 00000005.00000002.4576882925.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2334188947.0000000000D37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2125985990.000000000116A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2418028511.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2248582094.0000000001097000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 6432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 6452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5576, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\Remcos\remcos.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Order Drawing.exe

Joe Sandbox ML: detected

Source: Order Drawing.exe, 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_6ba4f058-7

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 6432, type: MEMORYSTR

Source: Order Drawing.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Order Drawing.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49716 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49712 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49719 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49730 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49751 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49769 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49807 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49788 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49824 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49844 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49878 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49860 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49923 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49944 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49908 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49960 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49892 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49976 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49993 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50008 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50010 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50009 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50022 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50012 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50024 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50039 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50004 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50026 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50020 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50030 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50038 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50036 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50013 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50041 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50029 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50051 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50037 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50042 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50054 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50040 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50044 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50049 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50062 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50015 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50074 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50075 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50077 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50035 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50025 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50101 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50031 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50089 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50091 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50060 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50058 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50099 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50084 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50064 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50046 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50032 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50093 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50017 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50087 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50014 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50098 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50034 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50067 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50092 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50083 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50082 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50047 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50043 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50066 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50081 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50076 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50079 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50090 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50100 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50078 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50085 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50055 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50070 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50086 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50080 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50018 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50061 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50027 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50019 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50071 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50052 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50023 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50053 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50065 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50094 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50045 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50069 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50059 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50033 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50095 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50072 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50056 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50097 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50096 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50050 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50073 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50048 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50102 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50068 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50088 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50011 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50028 -> 87.120.116.245:2400
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:50057 -> 87.120.116.245:2400

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 87.120.116.245

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 87.120.116.245:2400

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.245

Source: Order Drawing.exe, 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, Order Drawing.exe, 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, Order Drawing.exe, 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp

String found in binary or memory: http://geoplugin.net/json.gp/C

Source: Yara match	File source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 6432, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 00000005.00000002.4576882925.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2334188947.0000000000D37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2125985990.000000000116A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2418028511.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2248582094.0000000001097000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 6432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 6452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5576, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Order Drawing.exe PID: 4084, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Order Drawing.exe PID: 6432, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Order Drawing.exe

Source: C:\ProgramData\Remcos\remcos.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\system32\wbem\Performance\WmiApRpl_new.h
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\inf\WmiApRpl\
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\inf\WmiApRpl\WmiApRpl.h
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\inf\WmiApRpl\WmiApRpl.ini
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\inf\WmiApRpl\0009\
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\system32\PerfStringBackup.TMP

Source: C:\Windows\System32\wbem\WMIADAP.exe

File deleted: C:\Windows\System32\wbem\Performance\WmiApRpl.h

Source: Order Drawing.exe, 00000000.00000002.2127574047.00000000040D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs Order Drawing.exe
Source: Order Drawing.exe, 00000000.00000002.2124605370.000000000162E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Order Drawing.exe
Source: Order Drawing.exe, 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs Order Drawing.exe
Source: Order Drawing.exe, 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Order Drawing.exe
Source: Order Drawing.exe, 00000000.00000002.2133931729.0000000007FC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Order Drawing.exe
Source: Order Drawing.exe, 00000000.00000000.2110197145.0000000000E96000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamebEab.exe@ vs Order Drawing.exe
Source: Order Drawing.exe, 00000000.00000002.2132909890.0000000007510000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs Order Drawing.exe
Source: Order Drawing.exe	Binary or memory string: OriginalFilenamebEab.exe@ vs Order Drawing.exe

Source: Order Drawing.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Order Drawing.exe PID: 4084, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Order Drawing.exe PID: 6432, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: Order Drawing.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: remcos.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@19/14@0/1

Source: C:\Users\user\Desktop\Order Drawing.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Order Drawing.exe.log

Jump to behavior

Source: C:\ProgramData\Remcos\remcos.exe	Mutant created: NULL
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Flag
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\ADAP_WMI_ENTRY
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Lib
Source: C:\ProgramData\Remcos\remcos.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-24L73B

Source: Order Drawing.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Order Drawing.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Order Drawing.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Order Drawing.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Order Drawing.exe	Virustotal: Detection: 77%
Source: Order Drawing.exe	ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\Order Drawing.exe

File read: C:\Users\user\Desktop\Order Drawing.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Order Drawing.exe "C:\Users\user\Desktop\Order Drawing.exe"
Source: C:\Users\user\Desktop\Order Drawing.exe	Process created: C:\Users\user\Desktop\Order Drawing.exe "C:\Users\user\Desktop\Order Drawing.exe"
Source: C:\Users\user\Desktop\Order Drawing.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: unknown	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: unknown	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: unknown	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: C:\Users\user\Desktop\Order Drawing.exe	Process created: C:\Windows\System32\wbem\WMIADAP.exe wmiadap.exe /F /T /R
Source: C:\Users\user\Desktop\Order Drawing.exe	Process created: C:\Users\user\Desktop\Order Drawing.exe "C:\Users\user\Desktop\Order Drawing.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: winmm.dll
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: netutils.dll
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\Remcos\remcos.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: loadperf.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: ntmarta.dll

Source: C:\Users\user\Desktop\Order Drawing.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\wbem\WMIADAP.exe

File written: C:\Windows\System32\wbem\Performance\WmiApRpl_new.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Order Drawing.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Order Drawing.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Order Drawing.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Order Drawing.exe	Static PE information: section name: .text entropy: 7.831221418025935
Source: remcos.exe.3.dr	Static PE information: section name: .text entropy: 7.831221418025935

Source: C:\Users\user\Desktop\Order Drawing.exe

File created: C:\ProgramData\Remcos\remcos.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Order Drawing.exe

File created: C:\ProgramData\Remcos\remcos.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\Order Drawing.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-24L73B

Jump to behavior

Source: C:\Windows\System32\wbem\WMIADAP.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance

Source: C:\Users\user\Desktop\Order Drawing.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-24L73B	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-24L73B	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-24L73B	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-24L73B	Jump to behavior

Source: C:\Windows\System32\wbem\WMIADAP.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\PROVIDERS\Performance Performance Data

Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 3908, type: MEMORYSTR

Source: C:\Users\user\Desktop\Order Drawing.exe	Memory allocated: 15B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Memory allocated: 30D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Memory allocated: 50D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Memory allocated: 8180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Memory allocated: 9180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Memory allocated: 9340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Memory allocated: A340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 30D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 7B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 8B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 8CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 9CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 77F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 87F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 8990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 9990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 2F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 7B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 8B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 8CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 9CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 2600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 4600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 7200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 8200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 83A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory allocated: 93A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Order Drawing.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\ProgramData\Remcos\remcos.exe	Window / User API: threadDelayed 6979	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Window / User API: threadDelayed 2966	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 1791
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 980
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 1464
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 1150
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 883

Source: C:\Users\user\Desktop\Order Drawing.exe TID: 3792	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe TID: 6468	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe TID: 1612	Thread sleep count: 6979 > 30	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe TID: 1612	Thread sleep time: -20937000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe TID: 1612	Thread sleep count: 2966 > 30	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe TID: 1612	Thread sleep time: -8898000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe TID: 5268	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe TID: 4876	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe TID: 6432	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Order Drawing.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Order Drawing.exe, 00000003.00000002.2125985990.0000000001181000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: remcos.exe, 00000005.00000002.4576882925.0000000001401000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\ProgramData\Remcos\remcos.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Order Drawing.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Order Drawing.exe	Memory written: C:\Users\user\Desktop\Order Drawing.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory written: C:\ProgramData\Remcos\remcos.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory written: C:\ProgramData\Remcos\remcos.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Memory written: C:\ProgramData\Remcos\remcos.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\Order Drawing.exe	Process created: C:\Users\user\Desktop\Order Drawing.exe "C:\Users\user\Desktop\Order Drawing.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Order Drawing.exe	Queries volume information: C:\Users\user\Desktop\Order Drawing.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order Drawing.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\ProgramData\Remcos\remcos.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\ProgramData\Remcos\remcos.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\ProgramData\Remcos\remcos.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\ProgramData\Remcos\remcos.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Order Drawing.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 00000000.00000002.2127574047.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2132909890.0000000007510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Remcos RAT

Source: Yara match	File source: 00000005.00000002.4576882925.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2334188947.0000000000D37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2125985990.000000000116A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2418028511.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2248582094.0000000001097000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 6432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 6452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5576, type: MEMORYSTR

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\Order Drawing.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-24L73B	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-24L73B	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-24L73B	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-24L73B	Jump to behavior
Source: C:\ProgramData\Remcos\remcos.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-24L73B

Yara detected PureLog Stealer

Source: Yara match	File source: 00000000.00000002.2127574047.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2132909890.0000000007510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Remcos RAT

Source: Yara match	File source: 00000005.00000002.4576882925.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2334188947.0000000000D37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2125985990.000000000116A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2418028511.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2248582094.0000000001097000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order Drawing.exe PID: 6432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 6452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: remcos.exe PID: 5576, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	111 Process Injection	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Order Drawing.exe	78%	Virustotal		Browse
Order Drawing.exe	68%	ReversingLabs	Win32.Trojan.Remcos
Order Drawing.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\Remcos\remcos.exe	100%	Joe Sandbox ML
C:\ProgramData\Remcos\remcos.exe	68%	ReversingLabs	Win32.Trojan.Remcos
C:\ProgramData\Remcos\remcos.exe	78%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp/C	Order Drawing.exe, 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, Order Drawing.exe, 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, Order Drawing.exe, 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.116.245	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591546
Start date and time:	2025-01-15 03:51:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Order Drawing.exe (renamed file extension from pif to exe)
Original Sample Name:	Order Drawing.pif
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@19/14@0/1
Cookbook Comments:	Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:52:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-24L73B "C:\ProgramData\Remcos\remcos.exe"
03:52:12	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Rmc-24L73B "C:\ProgramData\Remcos\remcos.exe"
03:52:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-24L73B "C:\ProgramData\Remcos\remcos.exe"
21:51:59	API Interceptor	1x Sleep call for process: Order Drawing.exe modified
21:52:01	API Interceptor	5246927x Sleep call for process: remcos.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.120.116.245	Material requirements_1.pif.exe	Get hash	malicious	Remcos	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	preliminary drawing.pif.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	87.120.127.120
	5tCuNr661k.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	5tCuNr661k.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	shaLnqmyTS.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	shaLnqmyTS.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	zAGUEDGSTM.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	WtZl31OLfA.exe	Get hash	malicious	Remcos, GuLoader	Browse	87.120.116.187
	C5Zr4LSzmp.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	C5Zr4LSzmp.exe	Get hash	malicious	RedLine	Browse	87.120.120.86

Process:	C:\Users\user\Desktop\Order Drawing.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1005568
Entropy (8bit):	7.827484845541161
Encrypted:	false
SSDEEP:	24576:rbT8S0ck7b8crshYjBSbIBDESo13E/WFRHVJmSr39RrE:rf8S0cXcrsWtDfoFRVJvNRrE
MD5:	3A9DA3EDC40736CC832EDED3C389A661
SHA1:	F32F61FB4458696DAE4F15D82377163521E4F8B5
SHA-256:	F2418CA6E602C9470A8B6E32172432726E50B00D6E7A0EE5BD70D0172017D6C3
SHA-512:	A1E2EFE247E78CFB0AD62125C69C44200F6FC094085A570A0AD9A4FF3D0F2025EB9F0AACBE7CD7DCE46A18121C02D46FEC471A3353733A93EC49B6A81D243E95
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68% Antivirus: Virustotal, Detection: 78%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^&.g..............0..,..........K... ...`....@.. ....................................`.................................4K..O....`..\|'........................................................................... ............... ..H............text....+... ...,.................. ..`.rsrc...\|'...`...(..................@..@.reloc...............V..............@..B................hK......H........C...:......%...D~.................................................}......}.....(........}......o.......0............{........+....0............{........+....0..9.........(.........,.r...ps....z.{....o ...o!....o"...t.....+......0..9.........(.........,.r...ps....z.{....o#...o!....o"...t.....+......0..C.........($...u...........,...+(.o%...u.............,...+..o$...u.....+....0..+.........(......,.r+..ps....z..}.....(!....o&......0..8.........{.........,...+$.{

C:\ProgramData\Remcos\remcos.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Order Drawing.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Order Drawing.exe.log

Download File

Process:	C:\Users\user\Desktop\Order Drawing.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\remcos.exe.log

Download File

Process:	C:\ProgramData\Remcos\remcos.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Windows\INF\WmiApRpl\WmiApRpl.h

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	5.011954215267298
Encrypted:	false
SSDEEP:	48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
MD5:	B133A676D139032A27DE3D9619E70091
SHA1:	1248AA89938A13640252A79113930EDE2F26F1FA
SHA-256:	AE2B6236D3EEB4822835714AE9444E5DCD21BC60F7A909F2962C43BC743C7B15
SHA-512:	C6B99E13D854CE7A6874497473614EE4BD81C490802783DB1349AB851CD80D1DC06DF8C1F6E434ABA873A5BBF6125CC64104709064E19A9DC1C66DCDE3F898F5
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////////////////////////..//..// Copyright (C) 2000 Microsoft Corporation..//..// Module Name:..// WmiApRpl..//..// Abstract:..//..// Include file for object and counters definitions...//..//////////////////////////////////////////////////////////////////////////////////////////////......#define.WMI_Objects.0..#define.HiPerf_Classes.2..#define.HiPerf_Validity.4....#define.MSiSCSI_ConnectionStatistics_00000.6....#define.BytesReceived_00000.8..#define.BytesSent_00000.10..#define.PDUCommandsSent_00000.12..#define.PDUResponsesReceived_00000.14....#define.MSiSCSI_InitiatorInstanceStatistics_00001.16....#define.SessionConnectionTimeoutErrorCount_00001.18..#define.SessionDigestErrorCount_00001.20..#define.SessionFailureCount_00001.22..#define.SessionFormatErrorCount_00001.24....#define.MSiSCSI_InitiatorLoginStatistics_00002.26....#define.LoginAcceptRsps_00002.28..#define.LoginAuthenticateFails_00002.30..#define.LoginAuthFai

C:\Windows\INF\WmiApRpl\WmiApRpl.ini

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (405), with CRLF line terminators
Category:	dropped
Size (bytes):	48786
Entropy (8bit):	3.5854495362228453
Encrypted:	false
SSDEEP:	384:esozoNc1+12zG1+b61ubSGMLVrj4+PtC81ZBg4Lg4ung4og4uo91K91zI91K91z2:esozozBg4Lg4ung4og4uWG4MG4o1
MD5:	DF877BEC5C9E3382E94FEA48FEE049AC
SHA1:	1D61436C8A1C057C1B1089EB794D90EE4B0D8FE9
SHA-256:	7F0F3FA64E41A30BACA377B6399F8F7087BC54DA9FCA876BFDC2C2EEECA8454B
SHA-512:	433CB16EBE2292CB60CB8CE71207EBB752295FB73E6D13E215E771EC5FC433EE29577AF28641255810C18078B95F04A9D37734B6F49CB6A6302821E365672205
Malicious:	false
Preview:	.././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././....././....././. .C.o.p.y.r.i.g.h.t. .(.C.). .2.0.0.0. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....././....././. .M.o.d.u.l.e. .N.a.m.e.:....././. .W.m.i.A.p.R.p.l....././....././. .A.b.s.t.r.a.c.t.:....././....././. .D.e.s.c.r.i.b.e.s. .a.l.l. .t.h.e. .c.o.u.n.t.e.r.s. .s.u.p.p.o.r.t.e.d. .v.i.a. .W.M.I. .H.i.-.P.e.r.f.o.r.m.a.n.c.e. .p.r.o.v.i.d.e.r.s....././....././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.............[.i.n.f.o.].....d.r.i.v.e.r.n.a.m.e.=.W.m.i.A.p.R.p.l.....s.y.m.b.o.l.f.i.l.e.=.W.m.i.A.p.R.p.l...h.........[.l.a.n.g.u.a.g.e.s.].....0.0.9.=.E.n.g.l.i.s.h.....0.0.9.=.E.n.g.l.i.s.h.........[.o.b.j.e.c.t.s.].....W.M.I._.O.b.j.e.c.t.s._.0.0.

C:\Windows\System32\PerfStringBackup.INI

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	data
Category:	dropped
Size (bytes):	840878
Entropy (8bit):	3.4224066455051885
Encrypted:	false
SSDEEP:	3072:xJQGb/6IPolY/OhyIGmZkzTMWcnqgspmTbQiIJEDc3dv+eBrq2Bw+1wQ5xcEkc7+:01nqgsp2gOKih3
MD5:	D3ED23A3E63ACA8CF656C585568DA6D7
SHA1:	1A499D7E9A030D53B2A4DBD36F6F14B6531A6094
SHA-256:	AE5A6E258A41298BE6CF2B3DA812E992E1D6A3C7FBC7DD4AA8B413DA850E8B65
SHA-512:	21E2953B0819567865DA9C80A7D07021D7ED48F4BA3CD843C42D13D18E0E8FB27FA2F7C4EC86D4A1F4D887146F0F7E9E05B6A53D85398EA43240C2E180D52E00
Malicious:	false
Preview:	........[.P.e.r.f.l.i.b.].....B.a.s.e. .I.n.d.e.x.=.1.8.4.7.....L.a.s.t. .C.o.u.n.t.e.r.=.1.0.1.2.2.....L.a.s.t. .H.e.l.p.=.1.0.1.2.3.........[.P.E.R.F._...N.E.T. .C.L.R. .D.a.t.a.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.8.4.0.....F.i.r.s.t. .H.e.l.p.=.6.8.4.1.....L.a.s.t. .C.o.u.n.t.e.r.=.6.8.5.2.....L.a.s.t. .H.e.l.p.=.6.8.5.3.........[.P.E.R.F._...N.E.T. .C.L.R. .N.e.t.w.o.r.k.i.n.g.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.8.2.8.....F.i.r.s.t. .H.e.l.p.=.6.8.2.9.....L.a.s.t. .C.o.u.n.t.e.r.=.6.8.3.8.....L.a.s.t. .H.e.l.p.=.6.8.3.9.........[.P.E.R.F._...N.E.T. .C.L.R. .N.e.t.w.o.r.k.i.n.g. .4...0...0...0.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.9.0.0.....F.i.r.s.t. .H.e.l.p.=.6.9.0.1.....L.a.s.t. .C.o.u.n.t.e.r.=.6.9.2.6.....L.a.s.t. .H.e.l.p.=.6.9.2.7.........[.P.E.R.F._...N.E.T. .D.a.t.a. .P.r.o.v.i.d.e.r. .f.o.r. .O.r.a.c.l.e.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.8.9.1.6.....F.i.r.s.t. .H.e.l.p.=.8.9.1.7.....L.a.s.t. .C.o.u.n.t.e.r.=.8.9.4.4.....L.a.s.t. .H.e.l.p.=.8.9.4.5.........[.P.E.R.F._...N.E.

C:\Windows\System32\PerfStringBackup.TMP

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	data
Category:	dropped
Size (bytes):	840878
Entropy (8bit):	3.4224066455051885
Encrypted:	false
SSDEEP:	3072:xJQGb/6IPolY/OhyIGmZkzTMWcnqgspmTbQiIJEDc3dv+eBrq2Bw+1wQ5xcEkc7+:01nqgsp2gOKih3
MD5:	D3ED23A3E63ACA8CF656C585568DA6D7
SHA1:	1A499D7E9A030D53B2A4DBD36F6F14B6531A6094
SHA-256:	AE5A6E258A41298BE6CF2B3DA812E992E1D6A3C7FBC7DD4AA8B413DA850E8B65
SHA-512:	21E2953B0819567865DA9C80A7D07021D7ED48F4BA3CD843C42D13D18E0E8FB27FA2F7C4EC86D4A1F4D887146F0F7E9E05B6A53D85398EA43240C2E180D52E00
Malicious:	false
Preview:	........[.P.e.r.f.l.i.b.].....B.a.s.e. .I.n.d.e.x.=.1.8.4.7.....L.a.s.t. .C.o.u.n.t.e.r.=.1.0.1.2.2.....L.a.s.t. .H.e.l.p.=.1.0.1.2.3.........[.P.E.R.F._...N.E.T. .C.L.R. .D.a.t.a.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.8.4.0.....F.i.r.s.t. .H.e.l.p.=.6.8.4.1.....L.a.s.t. .C.o.u.n.t.e.r.=.6.8.5.2.....L.a.s.t. .H.e.l.p.=.6.8.5.3.........[.P.E.R.F._...N.E.T. .C.L.R. .N.e.t.w.o.r.k.i.n.g.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.8.2.8.....F.i.r.s.t. .H.e.l.p.=.6.8.2.9.....L.a.s.t. .C.o.u.n.t.e.r.=.6.8.3.8.....L.a.s.t. .H.e.l.p.=.6.8.3.9.........[.P.E.R.F._...N.E.T. .C.L.R. .N.e.t.w.o.r.k.i.n.g. .4...0...0...0.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.9.0.0.....F.i.r.s.t. .H.e.l.p.=.6.9.0.1.....L.a.s.t. .C.o.u.n.t.e.r.=.6.9.2.6.....L.a.s.t. .H.e.l.p.=.6.9.2.7.........[.P.E.R.F._...N.E.T. .D.a.t.a. .P.r.o.v.i.d.e.r. .f.o.r. .O.r.a.c.l.e.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.8.9.1.6.....F.i.r.s.t. .H.e.l.p.=.8.9.1.7.....L.a.s.t. .C.o.u.n.t.e.r.=.8.9.4.4.....L.a.s.t. .H.e.l.p.=.8.9.4.5.........[.P.E.R.F._...N.E.

C:\Windows\System32\perfc009.dat

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	data
Category:	dropped
Size (bytes):	137550
Entropy (8bit):	3.409189992022338
Encrypted:	false
SSDEEP:	1536:X1i4nfw8ld9+mRDaUR28oV7TYfXLi7NwrgSwNu56FRtg:XBnfw8ld9+mRDaUR28oV7TY+7S0ba
MD5:	084B771A167854C5B38E25D4E199B637
SHA1:	AE6D36D4EC5A9E515E8735525BD80C96AC0F8122
SHA-256:	B3CF0050FAF325C36535D665C24411F3877E3667904DFE9D8A1C802ED4BCD56D
SHA-512:	426C15923F54EC93F22D9523B5CB6D326F727A34F5FF2BDE63D1CB3AD97CAB7E5B2ABABBC6ED5082B5E3140E9342A4E6F354359357A3F9AEF285278CB38A5835
Malicious:	false
Preview:	1...1.8.4.7...2...S.y.s.t.e.m...4...M.e.m.o.r.y...6...%. .P.r.o.c.e.s.s.o.r. .T.i.m.e...1.0...F.i.l.e. .R.e.a.d. .O.p.e.r.a.t.i.o.n.s./.s.e.c...1.2...F.i.l.e. .W.r.i.t.e. .O.p.e.r.a.t.i.o.n.s./.s.e.c...1.4...F.i.l.e. .C.o.n.t.r.o.l. .O.p.e.r.a.t.i.o.n.s./.s.e.c...1.6...F.i.l.e. .R.e.a.d. .B.y.t.e.s./.s.e.c...1.8...F.i.l.e. .W.r.i.t.e. .B.y.t.e.s./.s.e.c...2.0...F.i.l.e. .C.o.n.t.r.o.l. .B.y.t.e.s./.s.e.c...2.4...A.v.a.i.l.a.b.l.e. .B.y.t.e.s...2.6...C.o.m.m.i.t.t.e.d. .B.y.t.e.s...2.8...P.a.g.e. .F.a.u.l.t.s./.s.e.c...3.0...C.o.m.m.i.t. .L.i.m.i.t...3.2...W.r.i.t.e. .C.o.p.i.e.s./.s.e.c...3.4...T.r.a.n.s.i.t.i.o.n. .F.a.u.l.t.s./.s.e.c...3.6...C.a.c.h.e. .F.a.u.l.t.s./.s.e.c...3.8...D.e.m.a.n.d. .Z.e.r.o. .F.a.u.l.t.s./.s.e.c...4.0...P.a.g.e.s./.s.e.c...4.2...P.a.g.e. .R.e.a.d.s./.s.e.c...4.4...P.r.o.c.e.s.s.o.r. .Q.u.e.u.e. .L.e.n.g.t.h...4.6...T.h.r.e.a.d. .S.t.a.t.e...4.8...P.a.g.e.s. .O.u.t.p.u.t./.s.e.c...5.0...P.a.g.e. .W.r.i.t.e.s./.s.e.c...5.2...B.r.o.w.s.e.r...5.4...A.n.n.o.u.

C:\Windows\System32\perfh009.dat

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	data
Category:	dropped
Size (bytes):	715050
Entropy (8bit):	3.278818886805871
Encrypted:	false
SSDEEP:	3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHHx643/A5BK9YXdhPHlVziwC4ALWI1dnmRh:78M6d0w+WB6I
MD5:	342BC94F85E143BE85B5B997163A0BB3
SHA1:	8780CD88D169AE88C843E19239D9A32625F6A73E
SHA-256:	F7D40B4FADA44B2A5231780F99C3CE784BCF33866B59D5EB767EEA8E532AD2C4
SHA-512:	0A4ED9104CAFCE95E204B5505181816E7AA7941DED2694FF75EFABAAB821BF0F0FE5B32261ED213C710250B7845255F4E317D86A3A6D4C2C21F866207233C57E
Malicious:	false
Preview:	3...T.h.e. .S.y.s.t.e.m. .p.e.r.f.o.r.m.a.n.c.e. .o.b.j.e.c.t. .c.o.n.s.i.s.t.s. .o.f. .c.o.u.n.t.e.r.s. .t.h.a.t. .a.p.p.l.y. .t.o. .m.o.r.e. .t.h.a.n. .o.n.e. .i.n.s.t.a.n.c.e. .o.f. .a. .c.o.m.p.o.n.e.n.t. .p.r.o.c.e.s.s.o.r.s. .o.n. .t.h.e. .c.o.m.p.u.t.e.r.....5...T.h.e. .M.e.m.o.r.y. .p.e.r.f.o.r.m.a.n.c.e. .o.b.j.e.c.t. . .c.o.n.s.i.s.t.s. .o.f. .c.o.u.n.t.e.r.s. .t.h.a.t. .d.e.s.c.r.i.b.e. .t.h.e. .b.e.h.a.v.i.o.r. .o.f. .p.h.y.s.i.c.a.l. .a.n.d. .v.i.r.t.u.a.l. .m.e.m.o.r.y. .o.n. .t.h.e. .c.o.m.p.u.t.e.r... . .P.h.y.s.i.c.a.l. .m.e.m.o.r.y. .i.s. .t.h.e. .a.m.o.u.n.t. .o.f. .r.a.n.d.o.m. .a.c.c.e.s.s. .m.e.m.o.r.y. .o.n. .t.h.e. .c.o.m.p.u.t.e.r... . .V.i.r.t.u.a.l. .m.e.m.o.r.y. .c.o.n.s.i.s.t.s. .o.f. .t.h.e. .s.p.a.c.e. .i.n. .p.h.y.s.i.c.a.l. .m.e.m.o.r.y. .a.n.d. .o.n. .d.i.s.k... . .M.a.n.y. .o.f. .t.h.e. .m.e.m.o.r.y. .c.o.u.n.t.e.r.s. .m.o.n.i.t.o.r. .p.a.g.i.n.g.,. .w.h.i.c.h. .i.s. .t.h.e. .m.o.v.e.m.e.n.t. .o.f. .p.a.g.e.s. .o.f. .c.o.d.e. .a.n.d. .d.a.t.a. .b.e.t.

C:\Windows\System32\wbem\Performance\WmiApRpl_new.h

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	5.011954215267298
Encrypted:	false
SSDEEP:	48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
MD5:	B133A676D139032A27DE3D9619E70091
SHA1:	1248AA89938A13640252A79113930EDE2F26F1FA
SHA-256:	AE2B6236D3EEB4822835714AE9444E5DCD21BC60F7A909F2962C43BC743C7B15
SHA-512:	C6B99E13D854CE7A6874497473614EE4BD81C490802783DB1349AB851CD80D1DC06DF8C1F6E434ABA873A5BBF6125CC64104709064E19A9DC1C66DCDE3F898F5
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////////////////////////..//..// Copyright (C) 2000 Microsoft Corporation..//..// Module Name:..// WmiApRpl..//..// Abstract:..//..// Include file for object and counters definitions...//..//////////////////////////////////////////////////////////////////////////////////////////////......#define.WMI_Objects.0..#define.HiPerf_Classes.2..#define.HiPerf_Validity.4....#define.MSiSCSI_ConnectionStatistics_00000.6....#define.BytesReceived_00000.8..#define.BytesSent_00000.10..#define.PDUCommandsSent_00000.12..#define.PDUResponsesReceived_00000.14....#define.MSiSCSI_InitiatorInstanceStatistics_00001.16....#define.SessionConnectionTimeoutErrorCount_00001.18..#define.SessionDigestErrorCount_00001.20..#define.SessionFailureCount_00001.22..#define.SessionFormatErrorCount_00001.24....#define.MSiSCSI_InitiatorLoginStatistics_00002.26....#define.LoginAcceptRsps_00002.28..#define.LoginAuthenticateFails_00002.30..#define.LoginAuthFai

C:\Windows\System32\wbem\Performance\WmiApRpl_new.ini

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (405), with CRLF line terminators
Category:	dropped
Size (bytes):	48786
Entropy (8bit):	3.5854495362228453
Encrypted:	false
SSDEEP:	384:esozoNc1+12zG1+b61ubSGMLVrj4+PtC81ZBg4Lg4ung4og4uo91K91zI91K91z2:esozozBg4Lg4ung4og4uWG4MG4o1
MD5:	DF877BEC5C9E3382E94FEA48FEE049AC
SHA1:	1D61436C8A1C057C1B1089EB794D90EE4B0D8FE9
SHA-256:	7F0F3FA64E41A30BACA377B6399F8F7087BC54DA9FCA876BFDC2C2EEECA8454B
SHA-512:	433CB16EBE2292CB60CB8CE71207EBB752295FB73E6D13E215E771EC5FC433EE29577AF28641255810C18078B95F04A9D37734B6F49CB6A6302821E365672205
Malicious:	false
Preview:	.././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././....././....././. .C.o.p.y.r.i.g.h.t. .(.C.). .2.0.0.0. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....././....././. .M.o.d.u.l.e. .N.a.m.e.:....././. .W.m.i.A.p.R.p.l....././....././. .A.b.s.t.r.a.c.t.:....././....././. .D.e.s.c.r.i.b.e.s. .a.l.l. .t.h.e. .c.o.u.n.t.e.r.s. .s.u.p.p.o.r.t.e.d. .v.i.a. .W.M.I. .H.i.-.P.e.r.f.o.r.m.a.n.c.e. .p.r.o.v.i.d.e.r.s....././....././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.............[.i.n.f.o.].....d.r.i.v.e.r.n.a.m.e.=.W.m.i.A.p.R.p.l.....s.y.m.b.o.l.f.i.l.e.=.W.m.i.A.p.R.p.l...h.........[.l.a.n.g.u.a.g.e.s.].....0.0.9.=.E.n.g.l.i.s.h.....0.0.9.=.E.n.g.l.i.s.h.........[.o.b.j.e.c.t.s.].....W.M.I._.O.b.j.e.c.t.s._.0.0.

C:\Windows\system32\wbem\Performance\WmiApRpl.h (copy)

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	5.011954215267298
Encrypted:	false
SSDEEP:	48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
MD5:	B133A676D139032A27DE3D9619E70091
SHA1:	1248AA89938A13640252A79113930EDE2F26F1FA
SHA-256:	AE2B6236D3EEB4822835714AE9444E5DCD21BC60F7A909F2962C43BC743C7B15
SHA-512:	C6B99E13D854CE7A6874497473614EE4BD81C490802783DB1349AB851CD80D1DC06DF8C1F6E434ABA873A5BBF6125CC64104709064E19A9DC1C66DCDE3F898F5
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////////////////////////..//..// Copyright (C) 2000 Microsoft Corporation..//..// Module Name:..// WmiApRpl..//..// Abstract:..//..// Include file for object and counters definitions...//..//////////////////////////////////////////////////////////////////////////////////////////////......#define.WMI_Objects.0..#define.HiPerf_Classes.2..#define.HiPerf_Validity.4....#define.MSiSCSI_ConnectionStatistics_00000.6....#define.BytesReceived_00000.8..#define.BytesSent_00000.10..#define.PDUCommandsSent_00000.12..#define.PDUResponsesReceived_00000.14....#define.MSiSCSI_InitiatorInstanceStatistics_00001.16....#define.SessionConnectionTimeoutErrorCount_00001.18..#define.SessionDigestErrorCount_00001.20..#define.SessionFailureCount_00001.22..#define.SessionFormatErrorCount_00001.24....#define.MSiSCSI_InitiatorLoginStatistics_00002.26....#define.LoginAcceptRsps_00002.28..#define.LoginAuthenticateFails_00002.30..#define.LoginAuthFai

C:\Windows\system32\wbem\Performance\WmiApRpl.ini (copy)

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (405), with CRLF line terminators
Category:	dropped
Size (bytes):	48786
Entropy (8bit):	3.5854495362228453
Encrypted:	false
SSDEEP:	384:esozoNc1+12zG1+b61ubSGMLVrj4+PtC81ZBg4Lg4ung4og4uo91K91zI91K91z2:esozozBg4Lg4ung4og4uWG4MG4o1
MD5:	DF877BEC5C9E3382E94FEA48FEE049AC
SHA1:	1D61436C8A1C057C1B1089EB794D90EE4B0D8FE9
SHA-256:	7F0F3FA64E41A30BACA377B6399F8F7087BC54DA9FCA876BFDC2C2EEECA8454B
SHA-512:	433CB16EBE2292CB60CB8CE71207EBB752295FB73E6D13E215E771EC5FC433EE29577AF28641255810C18078B95F04A9D37734B6F49CB6A6302821E365672205
Malicious:	false
Preview:	.././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././....././....././. .C.o.p.y.r.i.g.h.t. .(.C.). .2.0.0.0. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....././....././. .M.o.d.u.l.e. .N.a.m.e.:....././. .W.m.i.A.p.R.p.l....././....././. .A.b.s.t.r.a.c.t.:....././....././. .D.e.s.c.r.i.b.e.s. .a.l.l. .t.h.e. .c.o.u.n.t.e.r.s. .s.u.p.p.o.r.t.e.d. .v.i.a. .W.M.I. .H.i.-.P.e.r.f.o.r.m.a.n.c.e. .p.r.o.v.i.d.e.r.s....././....././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.............[.i.n.f.o.].....d.r.i.v.e.r.n.a.m.e.=.W.m.i.A.p.R.p.l.....s.y.m.b.o.l.f.i.l.e.=.W.m.i.A.p.R.p.l...h.........[.l.a.n.g.u.a.g.e.s.].....0.0.9.=.E.n.g.l.i.s.h.....0.0.9.=.E.n.g.l.i.s.h.........[.o.b.j.e.c.t.s.].....W.M.I._.O.b.j.e.c.t.s._.0.0.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.827484845541161
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Order Drawing.exe
File size:	1'005'568 bytes
MD5:	3a9da3edc40736cc832eded3c389a661
SHA1:	f32f61fb4458696dae4f15d82377163521e4f8b5
SHA256:	f2418ca6e602c9470a8b6e32172432726e50b00d6e7a0ee5bd70d0172017d6c3
SHA512:	a1e2efe247e78cfb0ad62125c69c44200f6fc094085a570a0ad9a4ff3d0f2025eb9f0aacbe7cd7dce46a18121c02d46fec471a3353733a93ec49b6a81d243e95
SSDEEP:	24576:rbT8S0ck7b8crshYjBSbIBDESo13E/WFRHVJmSr39RrE:rf8S0cXcrsWtDfoFRVJvNRrE
TLSH:	252512592749ED06C8D20BB098B0E3F826705FD9EA51C3039AFDBEFB7C265967418394
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^&.g..............0..,...*.......K... ...`....@.. ....................................`................................

File Icon


Icon Hash:	33362c2d36335470

Static PE Info

General

Entrypoint:	0x4f4b86
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x677F265E [Thu Jan 9 01:29:02 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf4b34	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf6000	0x277c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xf2b8c	0xf2c00	0a8b8c4bd722d339244aaee111723f05	False	0.935753049369207	data	7.831221418025935	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf6000	0x277c	0x2800	4e9b0506103b0eab1b88df4722769ed0	False	0.87890625	data	7.595806949277348	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfa000	0xc	0x200	f7cd7afbc98af4aee0e8ddfc076da2a5	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xf60c8	0x2356	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9427371213796153
RT_GROUP_ICON	0xf8430	0x14	data	1.05
RT_VERSION	0xf8454	0x324	data	0.43283582089552236

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T03:52:04.621826+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49712	87.120.116.245	2400	TCP
2025-01-15T03:52:07.276937+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49716	87.120.116.245	2400	TCP
2025-01-15T03:52:09.933454+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49719	87.120.116.245	2400	TCP
2025-01-15T03:52:12.591489+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49730	87.120.116.245	2400	TCP
2025-01-15T03:52:15.259743+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49751	87.120.116.245	2400	TCP
2025-01-15T03:52:17.865612+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49769	87.120.116.245	2400	TCP
2025-01-15T03:52:20.509590+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49788	87.120.116.245	2400	TCP
2025-01-15T03:52:23.185289+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49807	87.120.116.245	2400	TCP
2025-01-15T03:52:25.819711+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49824	87.120.116.245	2400	TCP
2025-01-15T03:52:28.449209+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49844	87.120.116.245	2400	TCP
2025-01-15T03:52:31.107542+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49860	87.120.116.245	2400	TCP
2025-01-15T03:52:33.725550+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49878	87.120.116.245	2400	TCP
2025-01-15T03:52:36.355943+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49892	87.120.116.245	2400	TCP
2025-01-15T03:52:38.991383+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49908	87.120.116.245	2400	TCP
2025-01-15T03:52:41.640594+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49923	87.120.116.245	2400	TCP
2025-01-15T03:52:44.275865+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49944	87.120.116.245	2400	TCP
2025-01-15T03:52:46.916957+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49960	87.120.116.245	2400	TCP
2025-01-15T03:52:49.543468+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49976	87.120.116.245	2400	TCP
2025-01-15T03:52:52.164880+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49993	87.120.116.245	2400	TCP
2025-01-15T03:52:54.792057+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50004	87.120.116.245	2400	TCP
2025-01-15T03:52:57.399239+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50008	87.120.116.245	2400	TCP
2025-01-15T03:53:00.026488+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50009	87.120.116.245	2400	TCP
2025-01-15T03:53:02.666994+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50010	87.120.116.245	2400	TCP
2025-01-15T03:53:05.272535+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50011	87.120.116.245	2400	TCP
2025-01-15T03:53:07.901999+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50012	87.120.116.245	2400	TCP
2025-01-15T03:53:10.667114+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50013	87.120.116.245	2400	TCP
2025-01-15T03:53:13.290530+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50014	87.120.116.245	2400	TCP
2025-01-15T03:53:16.025531+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50015	87.120.116.245	2400	TCP
2025-01-15T03:53:18.654842+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50017	87.120.116.245	2400	TCP
2025-01-15T03:53:21.310575+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50018	87.120.116.245	2400	TCP
2025-01-15T03:53:24.026035+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50019	87.120.116.245	2400	TCP
2025-01-15T03:53:26.639649+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50020	87.120.116.245	2400	TCP
2025-01-15T03:53:29.429905+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50022	87.120.116.245	2400	TCP
2025-01-15T03:53:32.046934+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50023	87.120.116.245	2400	TCP
2025-01-15T03:53:34.617455+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50024	87.120.116.245	2400	TCP
2025-01-15T03:53:37.152143+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50025	87.120.116.245	2400	TCP
2025-01-15T03:53:39.635619+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50026	87.120.116.245	2400	TCP
2025-01-15T03:53:42.105080+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50027	87.120.116.245	2400	TCP
2025-01-15T03:53:44.559002+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50028	87.120.116.245	2400	TCP
2025-01-15T03:53:46.982082+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50029	87.120.116.245	2400	TCP
2025-01-15T03:53:49.370483+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50030	87.120.116.245	2400	TCP
2025-01-15T03:53:51.781420+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50031	87.120.116.245	2400	TCP
2025-01-15T03:53:54.119693+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50032	87.120.116.245	2400	TCP
2025-01-15T03:53:56.414225+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50033	87.120.116.245	2400	TCP
2025-01-15T03:53:58.734421+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50034	87.120.116.245	2400	TCP
2025-01-15T03:54:01.072076+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50035	87.120.116.245	2400	TCP
2025-01-15T03:54:03.347669+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50036	87.120.116.245	2400	TCP
2025-01-15T03:54:05.985373+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50037	87.120.116.245	2400	TCP
2025-01-15T03:54:08.214670+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50038	87.120.116.245	2400	TCP
2025-01-15T03:54:10.401862+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50039	87.120.116.245	2400	TCP
2025-01-15T03:54:12.635517+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50040	87.120.116.245	2400	TCP
2025-01-15T03:54:14.794990+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50041	87.120.116.245	2400	TCP
2025-01-15T03:54:16.953465+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50042	87.120.116.245	2400	TCP
2025-01-15T03:54:19.127044+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50043	87.120.116.245	2400	TCP
2025-01-15T03:54:21.246733+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50044	87.120.116.245	2400	TCP
2025-01-15T03:54:23.355981+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50045	87.120.116.245	2400	TCP
2025-01-15T03:54:25.455162+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50046	87.120.116.245	2400	TCP
2025-01-15T03:54:27.512718+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50047	87.120.116.245	2400	TCP
2025-01-15T03:54:29.563773+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50048	87.120.116.245	2400	TCP
2025-01-15T03:54:31.590137+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50049	87.120.116.245	2400	TCP
2025-01-15T03:54:33.626385+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50050	87.120.116.245	2400	TCP
2025-01-15T03:54:35.618968+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50051	87.120.116.245	2400	TCP
2025-01-15T03:54:37.607783+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50052	87.120.116.245	2400	TCP
2025-01-15T03:54:39.571156+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50053	87.120.116.245	2400	TCP
2025-01-15T03:54:41.546819+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50054	87.120.116.245	2400	TCP
2025-01-15T03:54:43.514335+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50055	87.120.116.245	2400	TCP
2025-01-15T03:54:45.450274+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50056	87.120.116.245	2400	TCP
2025-01-15T03:54:47.388118+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50057	87.120.116.245	2400	TCP
2025-01-15T03:54:49.326076+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50058	87.120.116.245	2400	TCP
2025-01-15T03:54:51.247416+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50059	87.120.116.245	2400	TCP
2025-01-15T03:54:53.155519+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50060	87.120.116.245	2400	TCP
2025-01-15T03:54:55.062336+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50061	87.120.116.245	2400	TCP
2025-01-15T03:54:57.011473+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50062	87.120.116.245	2400	TCP
2025-01-15T03:54:58.908122+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50064	87.120.116.245	2400	TCP
2025-01-15T03:55:00.799650+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50065	87.120.116.245	2400	TCP
2025-01-15T03:55:02.659829+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50066	87.120.116.245	2400	TCP
2025-01-15T03:55:06.915609+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50067	87.120.116.245	2400	TCP
2025-01-15T03:55:08.773635+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50068	87.120.116.245	2400	TCP
2025-01-15T03:55:10.623543+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50069	87.120.116.245	2400	TCP
2025-01-15T03:55:12.451874+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50070	87.120.116.245	2400	TCP
2025-01-15T03:55:14.278998+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50071	87.120.116.245	2400	TCP
2025-01-15T03:55:16.091815+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50072	87.120.116.245	2400	TCP
2025-01-15T03:55:17.923995+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50073	87.120.116.245	2400	TCP
2025-01-15T03:55:19.752076+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50074	87.120.116.245	2400	TCP
2025-01-15T03:55:21.565936+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50075	87.120.116.245	2400	TCP
2025-01-15T03:55:23.377942+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50076	87.120.116.245	2400	TCP
2025-01-15T03:55:25.150772+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50077	87.120.116.245	2400	TCP
2025-01-15T03:55:26.900548+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50078	87.120.116.245	2400	TCP
2025-01-15T03:55:28.650328+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50079	87.120.116.245	2400	TCP
2025-01-15T03:55:30.439932+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50080	87.120.116.245	2400	TCP
2025-01-15T03:55:32.218938+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50081	87.120.116.245	2400	TCP
2025-01-15T03:55:33.963133+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50082	87.120.116.245	2400	TCP
2025-01-15T03:55:35.733580+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50083	87.120.116.245	2400	TCP
2025-01-15T03:55:37.500070+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50084	87.120.116.245	2400	TCP
2025-01-15T03:55:39.280091+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50085	87.120.116.245	2400	TCP
2025-01-15T03:55:41.103972+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50086	87.120.116.245	2400	TCP
2025-01-15T03:55:42.878679+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50087	87.120.116.245	2400	TCP
2025-01-15T03:55:44.608497+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50088	87.120.116.245	2400	TCP
2025-01-15T03:55:46.355985+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50089	87.120.116.245	2400	TCP
2025-01-15T03:55:48.108490+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50090	87.120.116.245	2400	TCP
2025-01-15T03:55:49.843749+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50091	87.120.116.245	2400	TCP
2025-01-15T03:55:51.557415+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50092	87.120.116.245	2400	TCP
2025-01-15T03:55:53.280261+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50093	87.120.116.245	2400	TCP
2025-01-15T03:55:54.984081+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50094	87.120.116.245	2400	TCP
2025-01-15T03:55:56.728142+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50095	87.120.116.245	2400	TCP
2025-01-15T03:55:58.471338+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50096	87.120.116.245	2400	TCP
2025-01-15T03:56:00.234766+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50097	87.120.116.245	2400	TCP
2025-01-15T03:56:01.971692+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50098	87.120.116.245	2400	TCP
2025-01-15T03:56:03.704158+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50099	87.120.116.245	2400	TCP
2025-01-15T03:56:05.629334+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50100	87.120.116.245	2400	TCP
2025-01-15T03:56:07.343262+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50101	87.120.116.245	2400	TCP
2025-01-15T03:56:09.965505+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	50102	87.120.116.245	2400	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 03:52:02.978421926 CET	49712	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:02.983285904 CET	2400	49712	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:02.983407021 CET	49712	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:02.989250898 CET	49712	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:02.994033098 CET	2400	49712	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:04.618639946 CET	2400	49712	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:04.621825933 CET	49712	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:04.621912956 CET	49712	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:04.626684904 CET	2400	49712	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:05.636647940 CET	49716	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:05.641565084 CET	2400	49716	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:05.641661882 CET	49716	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:05.645498037 CET	49716	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:05.650320053 CET	2400	49716	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:07.276669025 CET	2400	49716	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:07.276937008 CET	49716	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:07.279249907 CET	49716	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:07.284006119 CET	2400	49716	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:08.294406891 CET	49719	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:08.299282074 CET	2400	49719	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:08.299741030 CET	49719	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:08.306720018 CET	49719	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:08.311674118 CET	2400	49719	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:09.932882071 CET	2400	49719	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:09.933454037 CET	49719	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:09.936491013 CET	49719	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:09.941337109 CET	2400	49719	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:10.949480057 CET	49730	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:10.954396963 CET	2400	49730	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:10.954560041 CET	49730	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:10.958491087 CET	49730	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:10.963367939 CET	2400	49730	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:12.591417074 CET	2400	49730	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:12.591489077 CET	49730	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:12.591552973 CET	49730	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:12.597291946 CET	2400	49730	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:13.626962900 CET	49751	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:13.631803036 CET	2400	49751	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:13.631896973 CET	49751	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:13.635905981 CET	49751	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:13.640732050 CET	2400	49751	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:15.259685040 CET	2400	49751	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:15.259742975 CET	49751	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:15.259839058 CET	49751	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:15.264619112 CET	2400	49751	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:16.261625051 CET	49769	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:16.266618967 CET	2400	49769	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:16.266701937 CET	49769	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:16.271123886 CET	49769	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:16.275999069 CET	2400	49769	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:17.865540028 CET	2400	49769	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:17.865612030 CET	49769	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:17.865695953 CET	49769	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:17.870500088 CET	2400	49769	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:18.888117075 CET	49788	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:18.892997026 CET	2400	49788	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:18.893106937 CET	49788	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:18.927238941 CET	49788	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:18.932008028 CET	2400	49788	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:20.509500027 CET	2400	49788	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:20.509589911 CET	49788	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:20.509744883 CET	49788	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:20.514609098 CET	2400	49788	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:21.535116911 CET	49807	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:21.539958954 CET	2400	49807	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:21.542047024 CET	49807	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:21.604512930 CET	49807	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:21.609353065 CET	2400	49807	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:23.185029984 CET	2400	49807	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:23.185288906 CET	49807	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:23.185288906 CET	49807	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:23.190171003 CET	2400	49807	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:24.224265099 CET	49824	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:24.229121923 CET	2400	49824	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:24.229243040 CET	49824	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:24.250636101 CET	49824	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:24.255577087 CET	2400	49824	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:25.819499969 CET	2400	49824	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:25.819710970 CET	49824	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:25.819710970 CET	49824	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:25.824496031 CET	2400	49824	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:26.824440002 CET	49844	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:26.829864979 CET	2400	49844	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:26.829936981 CET	49844	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:26.834953070 CET	49844	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:26.840895891 CET	2400	49844	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:28.449078083 CET	2400	49844	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:28.449208975 CET	49844	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:28.449208975 CET	49844	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:28.454051018 CET	2400	49844	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:29.464864016 CET	49860	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:29.469816923 CET	2400	49860	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:29.469923019 CET	49860	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:29.474042892 CET	49860	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:29.478811026 CET	2400	49860	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:31.107399940 CET	2400	49860	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:31.107542038 CET	49860	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:31.107656956 CET	49860	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:31.113122940 CET	2400	49860	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:32.121323109 CET	49878	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:32.126256943 CET	2400	49878	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:32.126487970 CET	49878	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:32.130717039 CET	49878	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:32.135530949 CET	2400	49878	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:33.725478888 CET	2400	49878	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:33.725549936 CET	49878	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:33.725622892 CET	49878	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:33.730526924 CET	2400	49878	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:34.730310917 CET	49892	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:34.735109091 CET	2400	49892	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:34.735179901 CET	49892	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:34.738713026 CET	49892	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:34.743534088 CET	2400	49892	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:36.355532885 CET	2400	49892	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:36.355942965 CET	49892	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:36.356009007 CET	49892	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:36.360825062 CET	2400	49892	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:37.371963978 CET	49908	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:37.376992941 CET	2400	49908	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:37.377470016 CET	49908	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:37.409121990 CET	49908	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:37.413935900 CET	2400	49908	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:38.990545988 CET	2400	49908	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:38.991383076 CET	49908	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:38.991470098 CET	49908	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:38.996265888 CET	2400	49908	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:39.995984077 CET	49923	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:40.000845909 CET	2400	49923	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:40.000931978 CET	49923	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:40.006294966 CET	49923	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:40.011147976 CET	2400	49923	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:41.640528917 CET	2400	49923	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:41.640594006 CET	49923	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:41.640680075 CET	49923	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:41.645706892 CET	2400	49923	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:42.652134895 CET	49944	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:42.657097101 CET	2400	49944	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:42.657196999 CET	49944	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:42.660850048 CET	49944	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:42.665757895 CET	2400	49944	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:44.275624990 CET	2400	49944	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:44.275865078 CET	49944	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:44.275913954 CET	49944	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:44.280724049 CET	2400	49944	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:45.277390957 CET	49960	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:45.290734053 CET	2400	49960	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:45.290890932 CET	49960	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:45.296243906 CET	49960	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:45.301104069 CET	2400	49960	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:46.916856050 CET	2400	49960	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:46.916956902 CET	49960	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:46.917006969 CET	49960	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:46.921953917 CET	2400	49960	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:47.917963028 CET	49976	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:47.922872066 CET	2400	49976	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:47.922986031 CET	49976	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:47.926626921 CET	49976	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:47.931457996 CET	2400	49976	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:49.539668083 CET	2400	49976	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:49.543467999 CET	49976	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:49.543519974 CET	49976	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:49.548408031 CET	2400	49976	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:50.558542013 CET	49993	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:50.563668013 CET	2400	49993	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:50.563827991 CET	49993	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:50.567085028 CET	49993	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:50.571990967 CET	2400	49993	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:52.164798021 CET	2400	49993	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:52.164880037 CET	49993	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:52.167066097 CET	49993	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:52.172002077 CET	2400	49993	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:53.168240070 CET	50004	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:53.173202038 CET	2400	50004	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:53.173289061 CET	50004	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:53.179851055 CET	50004	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:53.184755087 CET	2400	50004	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:54.791961908 CET	2400	50004	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:54.792057037 CET	50004	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:54.792107105 CET	50004	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:54.796957970 CET	2400	50004	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:55.792962074 CET	50008	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:55.798172951 CET	2400	50008	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:55.798238993 CET	50008	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:55.801907063 CET	50008	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:55.806953907 CET	2400	50008	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:57.398926973 CET	2400	50008	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:57.399239063 CET	50008	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:57.399240017 CET	50008	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:57.404094934 CET	2400	50008	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:58.404797077 CET	50009	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:58.410165071 CET	2400	50009	87.120.116.245	192.168.2.6
Jan 15, 2025 03:52:58.410262108 CET	50009	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:58.424817085 CET	50009	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:52:58.429689884 CET	2400	50009	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:00.026046038 CET	2400	50009	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:00.026488066 CET	50009	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:00.026489019 CET	50009	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:00.031441927 CET	2400	50009	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:01.049073935 CET	50010	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:01.054197073 CET	2400	50010	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:01.054297924 CET	50010	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:01.115165949 CET	50010	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:01.120225906 CET	2400	50010	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:02.666785002 CET	2400	50010	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:02.666994095 CET	50010	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:02.667058945 CET	50010	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:02.671952009 CET	2400	50010	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:03.667885065 CET	50011	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:03.672842979 CET	2400	50011	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:03.674155951 CET	50011	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:03.678220034 CET	50011	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:03.683022022 CET	2400	50011	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:05.272393942 CET	2400	50011	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:05.272535086 CET	50011	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:05.272610903 CET	50011	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:05.277451038 CET	2400	50011	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:06.277385950 CET	50012	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:06.282383919 CET	2400	50012	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:06.282478094 CET	50012	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:06.285671949 CET	50012	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:06.290435076 CET	2400	50012	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:07.901401997 CET	2400	50012	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:07.901998997 CET	50012	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:07.902060986 CET	50012	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:07.907021046 CET	2400	50012	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:08.919822931 CET	50013	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:08.924865007 CET	2400	50013	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:08.924927950 CET	50013	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:08.929352999 CET	50013	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:08.934393883 CET	2400	50013	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:10.667032003 CET	2400	50013	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:10.667114019 CET	50013	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:10.667159081 CET	50013	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:10.672019005 CET	2400	50013	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:11.667851925 CET	50014	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:11.672933102 CET	2400	50014	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:11.675589085 CET	50014	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:11.684227943 CET	50014	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:11.689086914 CET	2400	50014	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:13.290189028 CET	2400	50014	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:13.290529966 CET	50014	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:13.290585041 CET	50014	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:13.295422077 CET	2400	50014	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:14.292927027 CET	50015	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:14.420785904 CET	2400	50015	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:14.420923948 CET	50015	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:14.423645020 CET	50015	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:14.428503036 CET	2400	50015	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:16.024184942 CET	2400	50015	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:16.025531054 CET	50015	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:16.025578022 CET	50015	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:16.030441999 CET	2400	50015	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:17.027704954 CET	50017	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:17.032960892 CET	2400	50017	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:17.033039093 CET	50017	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:17.038358927 CET	50017	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:17.043358088 CET	2400	50017	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:18.654757023 CET	2400	50017	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:18.654841900 CET	50017	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:18.654895067 CET	50017	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:18.659668922 CET	2400	50017	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:19.667968035 CET	50018	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:19.672908068 CET	2400	50018	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:19.675540924 CET	50018	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:19.679740906 CET	50018	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:19.684536934 CET	2400	50018	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:21.308309078 CET	2400	50018	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:21.310575008 CET	50018	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:21.310663939 CET	50018	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:21.315442085 CET	2400	50018	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:22.324068069 CET	50019	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:22.329056025 CET	2400	50019	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:22.329118967 CET	50019	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:22.332175970 CET	50019	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:22.337521076 CET	2400	50019	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:24.025899887 CET	2400	50019	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:24.026035070 CET	50019	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:24.026185989 CET	50019	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:24.031001091 CET	2400	50019	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:25.027486086 CET	50020	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:25.032388926 CET	2400	50020	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:25.032469988 CET	50020	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:25.035712004 CET	50020	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:25.040462017 CET	2400	50020	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:26.638124943 CET	2400	50020	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:26.639648914 CET	50020	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:26.639648914 CET	50020	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:26.644488096 CET	2400	50020	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:27.652246952 CET	50022	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:27.657238960 CET	2400	50022	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:27.657341003 CET	50022	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:27.660156012 CET	50022	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:27.664984941 CET	2400	50022	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:29.427689075 CET	2400	50022	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:29.429904938 CET	50022	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:29.429941893 CET	50022	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:29.434853077 CET	2400	50022	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:30.402452946 CET	50023	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:30.407764912 CET	2400	50023	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:30.407850027 CET	50023	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:30.412923098 CET	50023	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:30.417712927 CET	2400	50023	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:32.046850920 CET	2400	50023	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:32.046933889 CET	50023	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:32.047024012 CET	50023	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:32.051759958 CET	2400	50023	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:32.996234894 CET	50024	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:33.001280069 CET	2400	50024	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:33.001656055 CET	50024	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:33.005825043 CET	50024	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:33.010611057 CET	2400	50024	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:34.617367983 CET	2400	50024	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:34.617455006 CET	50024	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:34.617604971 CET	50024	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:34.622306108 CET	2400	50024	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:35.527587891 CET	50025	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:35.532584906 CET	2400	50025	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:35.532666922 CET	50025	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:35.538175106 CET	50025	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:35.542988062 CET	2400	50025	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:37.152057886 CET	2400	50025	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:37.152143002 CET	50025	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:37.152939081 CET	50025	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:37.157779932 CET	2400	50025	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:38.027520895 CET	50026	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:38.032474995 CET	2400	50026	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:38.032620907 CET	50026	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:38.037724018 CET	50026	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:38.042567015 CET	2400	50026	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:39.632786036 CET	2400	50026	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:39.635618925 CET	50026	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:39.635670900 CET	50026	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:39.640485048 CET	2400	50026	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:40.480730057 CET	50027	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:40.485858917 CET	2400	50027	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:40.485929012 CET	50027	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:40.490380049 CET	50027	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:40.496246099 CET	2400	50027	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:42.105009079 CET	2400	50027	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:42.105079889 CET	50027	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:42.105154991 CET	50027	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:42.109915972 CET	2400	50027	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:42.933621883 CET	50028	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:42.938705921 CET	2400	50028	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:42.938790083 CET	50028	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:42.942327023 CET	50028	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:42.947173119 CET	2400	50028	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:44.558903933 CET	2400	50028	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:44.559001923 CET	50028	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:44.559031963 CET	50028	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:44.563927889 CET	2400	50028	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:45.355462074 CET	50029	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:45.360831976 CET	2400	50029	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:45.363635063 CET	50029	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:45.368349075 CET	50029	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:45.373291016 CET	2400	50029	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:46.980585098 CET	2400	50029	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:46.982081890 CET	50029	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:46.982131004 CET	50029	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:46.986965895 CET	2400	50029	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:47.746329069 CET	50030	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:47.760318041 CET	2400	50030	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:47.760499001 CET	50030	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:47.764746904 CET	50030	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:47.769567966 CET	2400	50030	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:49.370417118 CET	2400	50030	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:49.370482922 CET	50030	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:49.370605946 CET	50030	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:49.375493050 CET	2400	50030	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:50.121243000 CET	50031	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:50.126276970 CET	2400	50031	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:50.129647970 CET	50031	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:50.133131027 CET	50031	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:50.137926102 CET	2400	50031	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:51.781323910 CET	2400	50031	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:51.781419992 CET	50031	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:51.781455994 CET	50031	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:51.786254883 CET	2400	50031	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:52.496095896 CET	50032	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:52.501204014 CET	2400	50032	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:52.503762960 CET	50032	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:52.507159948 CET	50032	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:52.512042999 CET	2400	50032	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:54.119244099 CET	2400	50032	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:54.119693041 CET	50032	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:54.123595953 CET	50032	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:54.128599882 CET	2400	50032	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:54.808695078 CET	50033	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:54.813672066 CET	2400	50033	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:54.813749075 CET	50033	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:54.818295002 CET	50033	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:54.823126078 CET	2400	50033	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:56.414171934 CET	2400	50033	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:56.414225101 CET	50033	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:56.414307117 CET	50033	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:56.419033051 CET	2400	50033	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:57.089834929 CET	50034	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:57.096148014 CET	2400	50034	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:57.098782063 CET	50034	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:57.102431059 CET	50034	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:57.107362986 CET	2400	50034	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:58.730552912 CET	2400	50034	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:58.734421015 CET	50034	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:58.734513044 CET	50034	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:58.739399910 CET	2400	50034	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:59.386853933 CET	50035	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:59.391861916 CET	2400	50035	87.120.116.245	192.168.2.6
Jan 15, 2025 03:53:59.391943932 CET	50035	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:59.396375895 CET	50035	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:53:59.401204109 CET	2400	50035	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:01.071938038 CET	2400	50035	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:01.072076082 CET	50035	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:01.072077036 CET	50035	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:01.076898098 CET	2400	50035	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:01.699323893 CET	50036	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:01.705862045 CET	2400	50036	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:01.709944963 CET	50036	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:01.713255882 CET	50036	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:01.718879938 CET	2400	50036	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:03.345391989 CET	2400	50036	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:03.347668886 CET	50036	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:03.736371994 CET	50036	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:03.741450071 CET	2400	50036	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:04.355401039 CET	50037	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:04.360505104 CET	2400	50037	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:04.360569000 CET	50037	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:04.363317966 CET	50037	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:04.368148088 CET	2400	50037	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:05.982726097 CET	2400	50037	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:05.985373020 CET	50037	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:05.985421896 CET	50037	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:05.990266085 CET	2400	50037	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:06.574243069 CET	50038	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:06.579241037 CET	2400	50038	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:06.579341888 CET	50038	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:06.582493067 CET	50038	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:06.587383032 CET	2400	50038	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:08.214334965 CET	2400	50038	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:08.214669943 CET	50038	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:08.214669943 CET	50038	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:08.219549894 CET	2400	50038	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:08.777384043 CET	50039	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:08.782329082 CET	2400	50039	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:08.782386065 CET	50039	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:08.786397934 CET	50039	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:08.791268110 CET	2400	50039	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:10.401659012 CET	2400	50039	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:10.401861906 CET	50039	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:10.401861906 CET	50039	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:10.406681061 CET	2400	50039	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:10.949377060 CET	50040	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:11.036547899 CET	2400	50040	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:11.036637068 CET	50040	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:11.039721012 CET	50040	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:11.045485973 CET	2400	50040	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:12.635387897 CET	2400	50040	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:12.635516882 CET	50040	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:12.635607958 CET	50040	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:12.640485048 CET	2400	50040	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:13.168003082 CET	50041	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:13.173013926 CET	2400	50041	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:13.174068928 CET	50041	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:13.177217007 CET	50041	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:13.182029009 CET	2400	50041	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:14.794780970 CET	2400	50041	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:14.794990063 CET	50041	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:14.794990063 CET	50041	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:14.799952984 CET	2400	50041	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:15.308733940 CET	50042	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:15.313793898 CET	2400	50042	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:15.317821026 CET	50042	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:15.320843935 CET	50042	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:15.325650930 CET	2400	50042	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:16.953380108 CET	2400	50042	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:16.953464985 CET	50042	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:16.959208012 CET	50042	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:16.964031935 CET	2400	50042	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:17.464956045 CET	50043	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:17.470451117 CET	2400	50043	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:17.471046925 CET	50043	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:17.474698067 CET	50043	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:17.479574919 CET	2400	50043	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:19.126920938 CET	2400	50043	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:19.127043962 CET	50043	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:19.127134085 CET	50043	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:19.131941080 CET	2400	50043	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:19.615953922 CET	50044	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:19.621521950 CET	2400	50044	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:19.622366905 CET	50044	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:19.685911894 CET	50044	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:19.690887928 CET	2400	50044	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:21.246639013 CET	2400	50044	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:21.246732950 CET	50044	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:21.246819973 CET	50044	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:21.251698017 CET	2400	50044	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:21.715095997 CET	50045	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:21.720484972 CET	2400	50045	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:21.720561028 CET	50045	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:21.723509073 CET	50045	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:21.728518009 CET	2400	50045	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:23.355886936 CET	2400	50045	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:23.355981112 CET	50045	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:23.356024027 CET	50045	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:23.360919952 CET	2400	50045	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:23.808743954 CET	50046	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:23.813659906 CET	2400	50046	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:23.813721895 CET	50046	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:23.817136049 CET	50046	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:23.821989059 CET	2400	50046	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:25.455101967 CET	2400	50046	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:25.455162048 CET	50046	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:25.455241919 CET	50046	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:25.460089922 CET	2400	50046	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:25.886833906 CET	50047	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:25.891884089 CET	2400	50047	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:25.891972065 CET	50047	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:25.895104885 CET	50047	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:25.900852919 CET	2400	50047	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:27.512581110 CET	2400	50047	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:27.512717962 CET	50047	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:27.512717962 CET	50047	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:27.517565966 CET	2400	50047	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:27.933621883 CET	50048	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:27.938601017 CET	2400	50048	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:27.942610979 CET	50048	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:27.945966005 CET	50048	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:27.950742960 CET	2400	50048	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:29.561222076 CET	2400	50048	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:29.563772917 CET	50048	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:29.563826084 CET	50048	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:29.568710089 CET	2400	50048	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:29.965240955 CET	50049	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:29.971470118 CET	2400	50049	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:29.971772909 CET	50049	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:29.976501942 CET	50049	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:29.981504917 CET	2400	50049	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:31.590024948 CET	2400	50049	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:31.590137005 CET	50049	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:31.590240002 CET	50049	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:31.595115900 CET	2400	50049	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:31.980585098 CET	50050	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:31.985610008 CET	2400	50050	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:31.985706091 CET	50050	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:31.988776922 CET	50050	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:31.993628979 CET	2400	50050	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:33.626246929 CET	2400	50050	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:33.626384974 CET	50050	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:33.626579046 CET	50050	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:33.631428003 CET	2400	50050	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:34.011991978 CET	50051	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:34.016794920 CET	2400	50051	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:34.016921043 CET	50051	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:34.021444082 CET	50051	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:34.026222944 CET	2400	50051	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:35.618864059 CET	2400	50051	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:35.618968010 CET	50051	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:35.619038105 CET	50051	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:35.623927116 CET	2400	50051	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:35.996654987 CET	50052	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:36.001746893 CET	2400	50052	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:36.003806114 CET	50052	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:36.008429050 CET	50052	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:36.013344049 CET	2400	50052	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:37.603030920 CET	2400	50052	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:37.607783079 CET	50052	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:37.607860088 CET	50052	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:37.612725973 CET	2400	50052	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:37.965111971 CET	50053	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:37.970740080 CET	2400	50053	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:37.973844051 CET	50053	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:37.977349997 CET	50053	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:37.982254028 CET	2400	50053	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:39.571064949 CET	2400	50053	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:39.571156025 CET	50053	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:39.571235895 CET	50053	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:39.576091051 CET	2400	50053	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:39.918232918 CET	50054	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:39.923234940 CET	2400	50054	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:39.923338890 CET	50054	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:39.926347017 CET	50054	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:39.931169033 CET	2400	50054	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:41.544028997 CET	2400	50054	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:41.546818972 CET	50054	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:41.546819925 CET	50054	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:41.551886082 CET	2400	50054	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:41.887099981 CET	50055	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:41.892079115 CET	2400	50055	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:41.892159939 CET	50055	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:41.895386934 CET	50055	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:41.900213957 CET	2400	50055	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:43.514247894 CET	2400	50055	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:43.514334917 CET	50055	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:43.514417887 CET	50055	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:43.519352913 CET	2400	50055	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:43.839916945 CET	50056	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:43.845071077 CET	2400	50056	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:43.845139980 CET	50056	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:43.847896099 CET	50056	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:43.852897882 CET	2400	50056	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:45.450206041 CET	2400	50056	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:45.450273991 CET	50056	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:45.450345039 CET	50056	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:45.455213070 CET	2400	50056	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:45.768903017 CET	50057	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:45.774017096 CET	2400	50057	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:45.774096966 CET	50057	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:45.842219114 CET	50057	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:45.847291946 CET	2400	50057	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:47.387960911 CET	2400	50057	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:47.388118029 CET	50057	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:47.388248920 CET	50057	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:47.393112898 CET	2400	50057	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:47.683705091 CET	50058	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:47.688750029 CET	2400	50058	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:47.688843966 CET	50058	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:47.692840099 CET	50058	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:47.697710991 CET	2400	50058	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:49.325920105 CET	2400	50058	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:49.326076031 CET	50058	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:49.326076031 CET	50058	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:49.331165075 CET	2400	50058	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:49.621296883 CET	50059	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:49.626444101 CET	2400	50059	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:49.626699924 CET	50059	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:49.629405022 CET	50059	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:49.634239912 CET	2400	50059	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:51.247183084 CET	2400	50059	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:51.247416019 CET	50059	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:51.247453928 CET	50059	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:51.252372026 CET	2400	50059	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:51.527477026 CET	50060	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:51.532418013 CET	2400	50060	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:51.532869101 CET	50060	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:51.535650015 CET	50060	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:51.540508032 CET	2400	50060	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:53.155425072 CET	2400	50060	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:53.155519009 CET	50060	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:53.155572891 CET	50060	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:53.160523891 CET	2400	50060	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:53.433805943 CET	50061	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:53.438740969 CET	2400	50061	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:53.438807964 CET	50061	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:53.443140030 CET	50061	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:53.448010921 CET	2400	50061	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:55.060750961 CET	2400	50061	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:55.062335968 CET	50061	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:55.062380075 CET	50061	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:55.067584038 CET	2400	50061	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:55.324553013 CET	50062	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:55.330847025 CET	2400	50062	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:55.330923080 CET	50062	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:55.335057020 CET	50062	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:55.340078115 CET	2400	50062	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:57.011348009 CET	2400	50062	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:57.011472940 CET	50062	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:57.011624098 CET	50062	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:57.016494036 CET	2400	50062	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:57.261873960 CET	50064	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:57.267338991 CET	2400	50064	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:57.267443895 CET	50064	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:57.270226955 CET	50064	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:57.275074005 CET	2400	50064	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:58.908026934 CET	2400	50064	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:58.908122063 CET	50064	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:58.908168077 CET	50064	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:58.913074970 CET	2400	50064	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:59.152654886 CET	50065	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:59.157830954 CET	2400	50065	87.120.116.245	192.168.2.6
Jan 15, 2025 03:54:59.157908916 CET	50065	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:59.162003040 CET	50065	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:54:59.166928053 CET	2400	50065	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:00.797777891 CET	2400	50065	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:00.799649954 CET	50065	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:00.799746037 CET	50065	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:00.804801941 CET	2400	50065	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:01.043179989 CET	50066	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:01.048206091 CET	2400	50066	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:01.052567959 CET	50066	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:01.055335045 CET	50066	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:01.060136080 CET	2400	50066	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:02.658929110 CET	2400	50066	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:02.659828901 CET	50066	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:02.659867048 CET	50066	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:02.664766073 CET	2400	50066	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:02.887155056 CET	50067	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:02.892256021 CET	2400	50067	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:02.892329931 CET	50067	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:02.895107985 CET	50067	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:02.899955988 CET	2400	50067	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:06.915535927 CET	2400	50067	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:06.915608883 CET	50067	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:06.915651083 CET	50067	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:06.920488119 CET	2400	50067	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:07.137031078 CET	50068	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:07.142119884 CET	2400	50068	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:07.143416882 CET	50068	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:07.146589994 CET	50068	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:07.151442051 CET	2400	50068	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:08.771703959 CET	2400	50068	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:08.773634911 CET	50068	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:08.773684025 CET	50068	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:08.778594017 CET	2400	50068	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:09.004348993 CET	50069	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:09.009186029 CET	2400	50069	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:09.011624098 CET	50069	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:09.041688919 CET	50069	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:09.046582937 CET	2400	50069	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:10.623481035 CET	2400	50069	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:10.623543024 CET	50069	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:10.623574018 CET	50069	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:10.628397942 CET	2400	50069	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:10.840183973 CET	50070	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:10.845854044 CET	2400	50070	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:10.845938921 CET	50070	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:10.848653078 CET	50070	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:10.853569031 CET	2400	50070	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:12.447890043 CET	2400	50070	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:12.451874018 CET	50070	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:12.451936960 CET	50070	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:12.456796885 CET	2400	50070	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:12.652517080 CET	50071	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:12.657346010 CET	2400	50071	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:12.659892082 CET	50071	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:12.662602901 CET	50071	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:12.667454004 CET	2400	50071	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:14.278808117 CET	2400	50071	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:14.278997898 CET	50071	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:14.278997898 CET	50071	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:14.283926010 CET	2400	50071	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:14.480808020 CET	50072	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:14.485848904 CET	2400	50072	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:14.485929012 CET	50072	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:14.489814997 CET	50072	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:14.495798111 CET	2400	50072	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:16.091641903 CET	2400	50072	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:16.091814995 CET	50072	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:16.091814995 CET	50072	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:16.096733093 CET	2400	50072	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:16.277565956 CET	50073	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:16.282427073 CET	2400	50073	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:16.287444115 CET	50073	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:16.290653944 CET	50073	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:16.295511961 CET	2400	50073	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:17.923861980 CET	2400	50073	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:17.923995018 CET	50073	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:17.924030066 CET	50073	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:17.928756952 CET	2400	50073	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:18.105988026 CET	50074	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:18.111090899 CET	2400	50074	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:18.111246109 CET	50074	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:18.114543915 CET	50074	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:18.119339943 CET	2400	50074	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:19.751929998 CET	2400	50074	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:19.752075911 CET	50074	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:19.752176046 CET	50074	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:19.756980896 CET	2400	50074	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:19.934089899 CET	50075	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:19.939277887 CET	2400	50075	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:19.939374924 CET	50075	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:19.942468882 CET	50075	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:19.947344065 CET	2400	50075	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:21.562868118 CET	2400	50075	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:21.565936089 CET	50075	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:21.565973043 CET	50075	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:21.570755005 CET	2400	50075	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:21.746279001 CET	50076	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:21.751334906 CET	2400	50076	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:21.751395941 CET	50076	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:21.754966021 CET	50076	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:21.759804964 CET	2400	50076	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:23.375386953 CET	2400	50076	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:23.377942085 CET	50076	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:23.378016949 CET	50076	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:23.384030104 CET	2400	50076	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:23.543261051 CET	50077	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:23.549413919 CET	2400	50077	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:23.549508095 CET	50077	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:23.552984953 CET	50077	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:23.559004068 CET	2400	50077	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:25.150698900 CET	2400	50077	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:25.150772095 CET	50077	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:25.150825024 CET	50077	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:25.155555964 CET	2400	50077	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:25.309021950 CET	50078	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:25.313885927 CET	2400	50078	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:25.313946009 CET	50078	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:25.320658922 CET	50078	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:25.325371981 CET	2400	50078	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:26.900355101 CET	2400	50078	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:26.900547981 CET	50078	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:26.900548935 CET	50078	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:26.905518055 CET	2400	50078	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:27.059027910 CET	50079	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:27.064502954 CET	2400	50079	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:27.064579010 CET	50079	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:27.068717003 CET	50079	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:27.073601007 CET	2400	50079	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:28.650233984 CET	2400	50079	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:28.650327921 CET	50079	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:28.650378942 CET	50079	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:28.656042099 CET	2400	50079	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:28.808938026 CET	50080	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:28.814116001 CET	2400	50080	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:28.814208031 CET	50080	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:28.817507029 CET	50080	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:28.822294950 CET	2400	50080	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:30.437328100 CET	2400	50080	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:30.439932108 CET	50080	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:30.440347910 CET	50080	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:30.445158005 CET	2400	50080	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:30.590126991 CET	50081	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:30.595284939 CET	2400	50081	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:30.595381021 CET	50081	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:30.598530054 CET	50081	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:30.603379011 CET	2400	50081	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:32.217396021 CET	2400	50081	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:32.218938112 CET	50081	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:32.218986034 CET	50081	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:32.223810911 CET	2400	50081	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:32.355674028 CET	50082	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:32.360506058 CET	2400	50082	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:32.362878084 CET	50082	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:32.364404917 CET	50082	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:32.369319916 CET	2400	50082	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:33.963022947 CET	2400	50082	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:33.963133097 CET	50082	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:33.963186026 CET	50082	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:33.967964888 CET	2400	50082	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:34.108500957 CET	50083	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:34.113428116 CET	2400	50083	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:34.113504887 CET	50083	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:34.116771936 CET	50083	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:34.121603012 CET	2400	50083	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:35.733486891 CET	2400	50083	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:35.733580112 CET	50083	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:35.733665943 CET	50083	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:35.738564968 CET	2400	50083	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:35.871432066 CET	50084	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:35.876372099 CET	2400	50084	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:35.879965067 CET	50084	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:35.883218050 CET	50084	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:35.888362885 CET	2400	50084	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:37.499677896 CET	2400	50084	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:37.500070095 CET	50084	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:37.500102043 CET	50084	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:37.504906893 CET	2400	50084	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:37.637042046 CET	50085	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:37.641895056 CET	2400	50085	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:37.641961098 CET	50085	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:37.645275116 CET	50085	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:37.650032997 CET	2400	50085	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:39.278992891 CET	2400	50085	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:39.280091047 CET	50085	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:39.282602072 CET	50085	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:39.287435055 CET	2400	50085	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:39.402596951 CET	50086	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:39.407733917 CET	2400	50086	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:39.407952070 CET	50086	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:39.410701990 CET	50086	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:39.415602922 CET	2400	50086	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:41.103554964 CET	2400	50086	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:41.103971958 CET	50086	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:41.104016066 CET	50086	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:41.108936071 CET	2400	50086	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:41.230830908 CET	50087	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:41.235773087 CET	2400	50087	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:41.235894918 CET	50087	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:41.239037037 CET	50087	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:41.243793964 CET	2400	50087	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:42.878599882 CET	2400	50087	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:42.878679037 CET	50087	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:42.878722906 CET	50087	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:42.883632898 CET	2400	50087	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:42.996352911 CET	50088	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:43.001266003 CET	2400	50088	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:43.001363039 CET	50088	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:43.005978107 CET	50088	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:43.011445999 CET	2400	50088	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:44.608395100 CET	2400	50088	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:44.608496904 CET	50088	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:44.608582973 CET	50088	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:44.613460064 CET	2400	50088	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:44.730791092 CET	50089	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:44.735797882 CET	2400	50089	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:44.735879898 CET	50089	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:44.738763094 CET	50089	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:44.743671894 CET	2400	50089	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:46.354209900 CET	2400	50089	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:46.355984926 CET	50089	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:46.356060028 CET	50089	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:46.361025095 CET	2400	50089	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:46.468552113 CET	50090	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:46.473584890 CET	2400	50090	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:46.474450111 CET	50090	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:46.477269888 CET	50090	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:46.482160091 CET	2400	50090	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:48.108403921 CET	2400	50090	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:48.108489990 CET	50090	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:48.108557940 CET	50090	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:48.113396883 CET	2400	50090	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:48.215159893 CET	50091	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:48.220108032 CET	2400	50091	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:48.222054005 CET	50091	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:48.224796057 CET	50091	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:48.229625940 CET	2400	50091	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:49.843677044 CET	2400	50091	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:49.843749046 CET	50091	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:49.846743107 CET	50091	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:49.851644993 CET	2400	50091	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:49.950846910 CET	50092	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:49.955966949 CET	2400	50092	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:49.956034899 CET	50092	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:49.969739914 CET	50092	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:49.974818945 CET	2400	50092	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:51.557281017 CET	2400	50092	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:51.557415009 CET	50092	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:51.557463884 CET	50092	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:51.562280893 CET	2400	50092	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:51.652755022 CET	50093	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:51.657799006 CET	2400	50093	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:51.657896996 CET	50093	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:51.661001921 CET	50093	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:51.665787935 CET	2400	50093	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:53.280168056 CET	2400	50093	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:53.280261040 CET	50093	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:53.280369043 CET	50093	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:53.285321951 CET	2400	50093	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:53.371457100 CET	50094	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:53.376564980 CET	2400	50094	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:53.376648903 CET	50094	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:53.380441904 CET	50094	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:53.385313034 CET	2400	50094	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:54.979027033 CET	2400	50094	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:54.984081030 CET	50094	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:54.984139919 CET	50094	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:54.989053965 CET	2400	50094	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:55.074562073 CET	50095	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:55.079603910 CET	2400	50095	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:55.081752062 CET	50095	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:55.084884882 CET	50095	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:55.089677095 CET	2400	50095	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:56.722593069 CET	2400	50095	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:56.728142023 CET	50095	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:56.728142023 CET	50095	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:56.733161926 CET	2400	50095	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:56.824949026 CET	50096	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:56.830100060 CET	2400	50096	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:56.830260038 CET	50096	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:56.835416079 CET	50096	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:56.840280056 CET	2400	50096	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:58.471281052 CET	2400	50096	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:58.471338034 CET	50096	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:58.471510887 CET	50096	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:58.476350069 CET	2400	50096	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:58.559369087 CET	50097	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:58.564274073 CET	2400	50097	87.120.116.245	192.168.2.6
Jan 15, 2025 03:55:58.567018032 CET	50097	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:58.578865051 CET	50097	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:55:58.583720922 CET	2400	50097	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:00.234673977 CET	2400	50097	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:00.234766006 CET	50097	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:00.234853983 CET	50097	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:00.239825010 CET	2400	50097	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:00.324790001 CET	50098	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:00.329787016 CET	2400	50098	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:00.329888105 CET	50098	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:00.333894014 CET	50098	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:00.338751078 CET	2400	50098	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:01.971571922 CET	2400	50098	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:01.971692085 CET	50098	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:01.971798897 CET	50098	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:01.976546049 CET	2400	50098	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:02.059329033 CET	50099	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:02.066319942 CET	2400	50099	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:02.066399097 CET	50099	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:02.072093964 CET	50099	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:02.076963902 CET	2400	50099	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:03.702630997 CET	2400	50099	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:03.704158068 CET	50099	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:03.707649946 CET	50099	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:03.712671995 CET	2400	50099	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:03.973910093 CET	50100	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:03.978979111 CET	2400	50100	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:03.980041027 CET	50100	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:04.150588036 CET	50100	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:04.155635118 CET	2400	50100	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:05.629137993 CET	2400	50100	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:05.629333973 CET	50100	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:05.629334927 CET	50100	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:05.634330988 CET	2400	50100	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:05.715420961 CET	50101	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:05.720382929 CET	2400	50101	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:05.720447063 CET	50101	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:05.724539995 CET	50101	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:05.729315042 CET	2400	50101	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:07.343180895 CET	2400	50101	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:07.343261957 CET	50101	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:07.343302011 CET	50101	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:07.348216057 CET	2400	50101	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:08.355761051 CET	50102	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:08.360950947 CET	2400	50102	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:08.361037970 CET	50102	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:08.363967896 CET	50102	2400	192.168.2.6	87.120.116.245
Jan 15, 2025 03:56:08.368880033 CET	2400	50102	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:09.965425968 CET	2400	50102	87.120.116.245	192.168.2.6
Jan 15, 2025 03:56:09.965504885 CET	50102	2400	192.168.2.6	87.120.116.245

Target ID:	0
Start time:	21:51:59
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\Order Drawing.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Order Drawing.exe"
Imagebase:	0xda0000
File size:	1'005'568 bytes
MD5 hash:	3A9DA3EDC40736CC832EDED3C389A661
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2127574047.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2132909890.0000000007510000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2127574047.0000000004C39000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2127574047.0000000004118000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:52:00
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\Order Drawing.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Order Drawing.exe"
Imagebase:	0xc80000
File size:	1'005'568 bytes
MD5 hash:	3A9DA3EDC40736CC832EDED3C389A661
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.2125985990.000000000116A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000003.00000002.2125581218.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:52:00
Start date:	14/01/2025
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0xc60000
File size:	1'005'568 bytes
MD5 hash:	3A9DA3EDC40736CC832EDED3C389A661
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs Detection: 78%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:52:01
Start date:	14/01/2025
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0xe10000
File size:	1'005'568 bytes
MD5 hash:	3A9DA3EDC40736CC832EDED3C389A661
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.4576882925.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:52:11
Start date:	14/01/2025
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0x850000
File size:	1'005'568 bytes
MD5 hash:	3A9DA3EDC40736CC832EDED3C389A661
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:52:12
Start date:	14/01/2025
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0x60000
File size:	1'005'568 bytes
MD5 hash:	3A9DA3EDC40736CC832EDED3C389A661
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:52:12
Start date:	14/01/2025
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0xb70000
File size:	1'005'568 bytes
MD5 hash:	3A9DA3EDC40736CC832EDED3C389A661
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.2248582094.0000000001097000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:52:20
Start date:	14/01/2025
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0xb20000
File size:	1'005'568 bytes
MD5 hash:	3A9DA3EDC40736CC832EDED3C389A661
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:52:21
Start date:	14/01/2025
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0x6c0000
File size:	1'005'568 bytes
MD5 hash:	3A9DA3EDC40736CC832EDED3C389A661
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.2334188947.0000000000D37000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:52:29
Start date:	14/01/2025
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0x230000
File size:	1'005'568 bytes
MD5 hash:	3A9DA3EDC40736CC832EDED3C389A661
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:52:29
Start date:	14/01/2025
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0x950000
File size:	1'005'568 bytes
MD5 hash:	3A9DA3EDC40736CC832EDED3C389A661
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.2418028511.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:52:34
Start date:	14/01/2025
Path:	C:\Windows\System32\wbem\WMIADAP.exe
Wow64 process (32bit):	false
Commandline:	wmiadap.exe /F /T /R
Imagebase:	0x7ff64ef10000
File size:	182'272 bytes
MD5 hash:	1BFFABBD200C850E6346820E92B915DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Order Drawing.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Remcos\remcos.exe

C:\ProgramData\Remcos\remcos.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Order Drawing.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\remcos.exe.log

C:\Windows\INF\WmiApRpl\WmiApRpl.h

C:\Windows\INF\WmiApRpl\WmiApRpl.ini

C:\Windows\System32\PerfStringBackup.INI

C:\Windows\System32\PerfStringBackup.TMP

C:\Windows\System32\perfc009.dat

C:\Windows\System32\perfh009.dat

C:\Windows\System32\wbem\Performance\WmiApRpl_new.h

Windows Analysis Report
Order Drawing.exe